22 lines
1.0 KiB
TypeScript
22 lines
1.0 KiB
TypeScript
import { expect, test } from "bun:test";
|
|
import { createKeyring, generateKey, seal } from "@wrnexus/encryption";
|
|
import { createAuthSecretProtector } from "../src/protector.ts";
|
|
|
|
test("secret protector binds encrypted values to their auth purpose", async () => {
|
|
const keyring = createKeyring([{ id: "primary", secret: await generateKey(), active: true }]);
|
|
const protector = createAuthSecretProtector(keyring);
|
|
const protectedValue = await protector.protect("secret-value", "totp");
|
|
|
|
expect(await protector.reveal(protectedValue, "totp")).toBe("secret-value");
|
|
await expect(protector.reveal(protectedValue, "oauth-access")).rejects.toThrow(
|
|
"WRN-AUTH-SECRET-PURPOSE",
|
|
);
|
|
});
|
|
|
|
test("secret protector can read legacy unbound ciphertext", async () => {
|
|
const keyring = createKeyring([{ id: "primary", secret: await generateKey(), active: true }]);
|
|
const protector = createAuthSecretProtector(keyring);
|
|
const legacy = await seal("legacy-secret", keyring);
|
|
expect(await protector.reveal(legacy, "oauth-refresh")).toBe("legacy-secret");
|
|
});
|