feat: add worker AES-256-GCM crypto matching the web envelope

worker/tests/test_crypto.py

@@ -0,0 +1,31 @@
+import pytest
+
+from lyra_worker.crypto import decrypt_secret, encrypt_secret
+
+TEST_KEY = "MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY="  # 32 bytes, base64
+# Produced by web/src/lib/crypto.ts encryptSecret("cross-lang-secret") with TEST_KEY (see Step 2).
+NODE_FIXTURE = '{"iv":"j9RH6WtmcmkD716H","ct":"5nWNQDDhIHJJVgvEzrO+b8M=","tag":"MBtkQ+ygwAeXwLQLpTsvWw=="}'
+
+
+@pytest.fixture(autouse=True)
+def _key(monkeypatch):
+    monkeypatch.setenv("LYRA_SECRET_KEY", TEST_KEY)
+
+
+def test_round_trip():
+    env = encrypt_secret("hunter2")
+    assert "hunter2" not in env
+    assert decrypt_secret(env) == "hunter2"
+
+
+def test_decrypts_node_produced_envelope():
+    # Cross-language contract: the worker must decrypt what the web app encrypted.
+    assert decrypt_secret(NODE_FIXTURE) == "cross-lang-secret"
+
+
+def test_rejects_tampered_envelope():
+    import json
+    env = json.loads(encrypt_secret("secret"))
+    env["ct"] = "Z2FyYmFnZQ=="  # "garbage"
+    with pytest.raises(Exception):
+        decrypt_secret(json.dumps(env))