46 lines
1.5 KiB
Python
46 lines
1.5 KiB
Python
import pytest
|
|
from cryptography.fernet import Fernet
|
|
|
|
from backend.bootstrap.settings import ConfigurationError, Settings
|
|
from backend.security import SecretCipher, load_or_create_cipher
|
|
|
|
|
|
def test_development_cipher_persists_in_ignored_data_directory(tmp_path) -> None:
|
|
settings = Settings.for_test(tmp_path)
|
|
first = load_or_create_cipher(settings)
|
|
encrypted = first.encrypt("private profile")
|
|
|
|
second = load_or_create_cipher(settings)
|
|
|
|
assert second.decrypt(encrypted) == "private profile"
|
|
assert (tmp_path / ".encryption.key").exists()
|
|
assert "private profile" not in encrypted
|
|
|
|
|
|
def test_explicit_encryption_key_is_reusable(tmp_path) -> None:
|
|
key = Fernet.generate_key().decode("ascii")
|
|
settings = Settings.for_test(tmp_path)
|
|
configured = Settings(
|
|
environment=settings.environment,
|
|
debug=settings.debug,
|
|
data_directory=settings.data_directory,
|
|
database_path=settings.database_path,
|
|
mentor_skills_directory=settings.mentor_skills_directory,
|
|
private_mentor_skills_directory=settings.private_mentor_skills_directory,
|
|
log_file=settings.log_file,
|
|
log_level=settings.log_level,
|
|
host=settings.host,
|
|
port=settings.port,
|
|
encryption_key=key,
|
|
)
|
|
|
|
first = load_or_create_cipher(configured).encrypt("secret")
|
|
second = SecretCipher.from_key(key).decrypt(first)
|
|
|
|
assert second == "secret"
|
|
|
|
|
|
def test_invalid_encryption_key_is_rejected() -> None:
|
|
with pytest.raises(ConfigurationError):
|
|
SecretCipher.from_key("invalid")
|