82de3181df
Some checks failed
Validation applicative / TypeScript, tests et build (push) Failing after 1m54s
38 lines
1.5 KiB
TypeScript
38 lines
1.5 KiB
TypeScript
import { afterEach, beforeEach, describe, expect, it } from "vitest";
|
|
import { decryptPayrollPdf, encryptPayrollPdf, getPayrollEncryptionStatus } from "./payrollCrypto";
|
|
|
|
const originalKey = process.env.PAYROLL_ENCRYPTION_KEY;
|
|
|
|
describe.sequential("payrollCrypto", () => {
|
|
beforeEach(() => {
|
|
process.env.PAYROLL_ENCRYPTION_KEY = Buffer.alloc(32, 7).toString("base64");
|
|
});
|
|
|
|
afterEach(() => {
|
|
if (originalKey === undefined) delete process.env.PAYROLL_ENCRYPTION_KEY;
|
|
else process.env.PAYROLL_ENCRYPTION_KEY = originalKey;
|
|
});
|
|
|
|
it("chiffre puis déchiffre un PDF sans changer son contenu", () => {
|
|
const original = Buffer.from("%PDF-1.7 contenu de test", "utf8");
|
|
const encrypted = encryptPayrollPdf(original);
|
|
|
|
expect(encrypted.ciphertext).not.toEqual(original);
|
|
expect(decryptPayrollPdf(encrypted)).toEqual(original);
|
|
expect(getPayrollEncryptionStatus()).toEqual({ ready: true, algorithm: "AES-256-GCM" });
|
|
});
|
|
|
|
it("refuse un tag d'authentification altéré", () => {
|
|
const encrypted = encryptPayrollPdf(Buffer.from("%PDF-1.7 contenu de test", "utf8"));
|
|
const tamperedTag = Buffer.from(encrypted.authTagBase64, "base64");
|
|
tamperedTag[0] = tamperedTag[0]! ^ 0xff;
|
|
|
|
expect(() => decryptPayrollPdf({ ...encrypted, authTagBase64: tamperedTag.toString("base64") })).toThrow();
|
|
});
|
|
|
|
it("ne révèle aucune erreur détaillée lorsque la clé est invalide", () => {
|
|
process.env.PAYROLL_ENCRYPTION_KEY = "invalide";
|
|
expect(getPayrollEncryptionStatus()).toEqual({ ready: false, algorithm: "AES-256-GCM" });
|
|
});
|
|
});
|