glm-5.2
110146870a
Rename the crate from alknet-vault to alkvault across source and docs: - Cargo.toml: package name and lib name (alknet_vault -> alkvault) - src/ doc comments and doc-test use statements - tests/ use statements and one string literal Convert references to non-vault alknet ADRs (003, 005, 008, 010, 014, 064) that were broken local links into @alkdev/alknet: cross-repo references, matching the alktype sibling pattern. Local ADR/OQ references are now proper links. Rewrote monorepo path references (crates/alknet-vault/src/...) to the flat layout (src/...). Fixed sdd_process.md package name (@alkdev/storage -> @alkdev/alkvault). ADR/OQ renumbering is deferred to a subsequent pass per the alknet- origin numbering convention. Generic prose 'vault' and type names (VaultServiceHandle, VaultServiceError, etc.) are unchanged. Build, 108 tests, and clippy all pass clean.
59 lines
1.9 KiB
Rust
59 lines
1.9 KiB
Rust
//! Integration tests for AES-256-GCM encryption and decryption.
|
|
//!
|
|
//! These tests verify round-trip encryption, key version handling,
|
|
//! and wire format compatibility.
|
|
|
|
use alkvault::encryption::CURRENT_KEY_VERSION;
|
|
use alkvault::service::VaultServiceHandle;
|
|
|
|
#[test]
|
|
fn test_encrypt_decrypt_round_trip_via_service() {
|
|
let service = VaultServiceHandle::new();
|
|
service.unlock_new(24).unwrap();
|
|
|
|
let plaintext = "sk-proj-abc123xyz789";
|
|
|
|
let encrypted = service.encrypt(plaintext, CURRENT_KEY_VERSION).unwrap();
|
|
let decrypted = service.decrypt(&encrypted).unwrap();
|
|
|
|
assert_eq!(decrypted, plaintext);
|
|
}
|
|
|
|
#[test]
|
|
fn test_encrypt_produces_different_ciphertext_each_time() {
|
|
let service = VaultServiceHandle::new();
|
|
service.unlock_new(24).unwrap();
|
|
|
|
let plaintext = "same input different ciphertexts";
|
|
|
|
let encrypted1 = service.encrypt(plaintext, CURRENT_KEY_VERSION).unwrap();
|
|
let encrypted2 = service.encrypt(plaintext, CURRENT_KEY_VERSION).unwrap();
|
|
|
|
// Different IVs mean different ciphertexts
|
|
assert_ne!(encrypted1.iv, encrypted2.iv);
|
|
assert_ne!(encrypted1.data, encrypted2.data);
|
|
// But same key version
|
|
assert_eq!(encrypted1.key_version, encrypted2.key_version);
|
|
}
|
|
|
|
#[test]
|
|
fn test_encrypted_data_serialization() {
|
|
let service = VaultServiceHandle::new();
|
|
service.unlock_new(24).unwrap();
|
|
|
|
let plaintext = "test serialization";
|
|
let encrypted = service.encrypt(plaintext, CURRENT_KEY_VERSION).unwrap();
|
|
|
|
// Verify EncryptedData serializes to JSON
|
|
let json = serde_json::to_string(&encrypted).unwrap();
|
|
assert!(json.contains("key_version"));
|
|
assert!(json.contains("salt"));
|
|
assert!(json.contains("iv"));
|
|
assert!(json.contains("data"));
|
|
|
|
// Verify round-trip through JSON
|
|
let deserialized: alkvault::encryption::EncryptedData =
|
|
serde_json::from_str(&json).unwrap();
|
|
assert_eq!(deserialized, encrypted);
|
|
}
|