rebuild(stage-3): establish accounts permissions and secure settings

next/tests/test_cipher.py

@@ -0,0 +1,43 @@
+import pytest
+from cryptography.fernet import Fernet
+
+from backend.bootstrap.settings import ConfigurationError, Settings
+from backend.security import SecretCipher, load_or_create_cipher
+
+
+def test_development_cipher_persists_in_ignored_data_directory(tmp_path) -> None:
+    settings = Settings.for_test(tmp_path)
+    first = load_or_create_cipher(settings)
+    encrypted = first.encrypt("private profile")
+
+    second = load_or_create_cipher(settings)
+
+    assert second.decrypt(encrypted) == "private profile"
+    assert (tmp_path / ".encryption.key").exists()
+    assert "private profile" not in encrypted
+
+
+def test_explicit_encryption_key_is_reusable(tmp_path) -> None:
+    key = Fernet.generate_key().decode("ascii")
+    settings = Settings.for_test(tmp_path)
+    configured = Settings(
+        environment=settings.environment,
+        debug=settings.debug,
+        data_directory=settings.data_directory,
+        database_path=settings.database_path,
+        log_file=settings.log_file,
+        log_level=settings.log_level,
+        host=settings.host,
+        port=settings.port,
+        encryption_key=key,
+    )
+
+    first = load_or_create_cipher(configured).encrypt("secret")
+    second = SecretCipher.from_key(key).decrypt(first)
+
+    assert second == "secret"
+
+
+def test_invalid_encryption_key_is_rejected() -> None:
+    with pytest.raises(ConfigurationError):
+        SecretCipher.from_key("invalid")