44 lines
1.2 KiB
Python
44 lines
1.2 KiB
Python
from __future__ import annotations
|
|
|
|
import pytest
|
|
from cryptography.fernet import Fernet
|
|
|
|
from app.core.crypto import FieldEncryptor, MASKED, mask_secret
|
|
|
|
|
|
def test_mask_secret() -> None:
|
|
assert mask_secret(None) == ""
|
|
assert mask_secret("") == ""
|
|
assert mask_secret(" ") == ""
|
|
assert mask_secret("secret") == MASKED
|
|
|
|
|
|
def test_encrypt_decrypt_roundtrip() -> None:
|
|
key = Fernet.generate_key().decode("utf-8")
|
|
crypto = FieldEncryptor.from_key(key)
|
|
|
|
plaintext = "refresh_token_123"
|
|
token = crypto.encrypt_text(plaintext)
|
|
|
|
assert isinstance(token, str)
|
|
assert token != plaintext
|
|
assert crypto.decrypt_text(token) == plaintext
|
|
|
|
|
|
def test_requires_key() -> None:
|
|
with pytest.raises(ValueError, match="FIELD_ENCRYPTION_KEY is required"):
|
|
FieldEncryptor.from_key("")
|
|
|
|
|
|
def test_invalid_key_rejected() -> None:
|
|
with pytest.raises(ValueError, match="Invalid FIELD_ENCRYPTION_KEY"):
|
|
FieldEncryptor.from_key("not-a-fernet-key")
|
|
|
|
|
|
def test_invalid_token_rejected() -> None:
|
|
key = Fernet.generate_key().decode("utf-8")
|
|
crypto = FieldEncryptor.from_key(key)
|
|
with pytest.raises(ValueError, match="Invalid encrypted value"):
|
|
crypto.decrypt_text("not-a-fernet-token")
|
|
|