Jonathan
32 lines
1021 B
Python
32 lines
1021 B
Python
import pytest
|
|
|
|
from lyra_worker.crypto import decrypt_secret, encrypt_secret
|
|
|
|
TEST_KEY = "MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY=" # 32 bytes, base64
|
|
# Produced by web/src/lib/crypto.ts encryptSecret("cross-lang-secret") with TEST_KEY (see Step 2).
|
|
NODE_FIXTURE = '{"iv":"j9RH6WtmcmkD716H","ct":"5nWNQDDhIHJJVgvEzrO+b8M=","tag":"MBtkQ+ygwAeXwLQLpTsvWw=="}'
|
|
|
|
|
|
@pytest.fixture(autouse=True)
|
|
def _key(monkeypatch):
|
|
monkeypatch.setenv("LYRA_SECRET_KEY", TEST_KEY)
|
|
|
|
|
|
def test_round_trip():
|
|
env = encrypt_secret("hunter2")
|
|
assert "hunter2" not in env
|
|
assert decrypt_secret(env) == "hunter2"
|
|
|
|
|
|
def test_decrypts_node_produced_envelope():
|
|
# Cross-language contract: the worker must decrypt what the web app encrypted.
|
|
assert decrypt_secret(NODE_FIXTURE) == "cross-lang-secret"
|
|
|
|
|
|
def test_rejects_tampered_envelope():
|
|
import json
|
|
env = json.loads(encrypt_secret("secret"))
|
|
env["ct"] = "Z2FyYmFnZQ==" # "garbage"
|
|
with pytest.raises(Exception):
|
|
decrypt_secret(json.dumps(env))
|