ochan.kwon
8d8cc051be
When a tenant setting is updated via PUT /tenants/kv/{key} (e.g.,
retrieval-config, parser-engine-config), the GORM AfterFind-decrypted
plaintext api_key was silently written back to the database because
db.Updates() does not trigger the BeforeSave hook.
Guard the repository's UpdateTenant to skip writing plaintext api_key
back to the database. Pre-encrypted values (enc:v1:… from CreateTenant
/ UpdateAPIKey) are written as-is; AfterFind-decrypted plaintext is
blanked so GORM skips the column entirely.
Closes #798
96 lines
2.6 KiB
Go
96 lines
2.6 KiB
Go
package utils
|
|
|
|
import (
|
|
"strings"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
const testAESKey = "01234567890123456789012345678901" // 32 bytes
|
|
|
|
func TestEncryptAESGCM(t *testing.T) {
|
|
key := []byte(testAESKey)
|
|
|
|
t.Run("encrypts plaintext with enc:v1: prefix", func(t *testing.T) {
|
|
encrypted, err := EncryptAESGCM("sk-secret-key", key)
|
|
require.NoError(t, err)
|
|
assert.True(t, strings.HasPrefix(encrypted, EncPrefix))
|
|
assert.NotEqual(t, "sk-secret-key", encrypted)
|
|
})
|
|
|
|
t.Run("returns empty string as-is", func(t *testing.T) {
|
|
encrypted, err := EncryptAESGCM("", key)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, "", encrypted)
|
|
})
|
|
|
|
t.Run("returns already encrypted string as-is (idempotent)", func(t *testing.T) {
|
|
first, err := EncryptAESGCM("sk-secret-key", key)
|
|
require.NoError(t, err)
|
|
|
|
second, err := EncryptAESGCM(first, key)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, first, second, "re-encrypting should be a no-op")
|
|
})
|
|
|
|
t.Run("returns plaintext when key is nil", func(t *testing.T) {
|
|
encrypted, err := EncryptAESGCM("sk-secret-key", nil)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, "sk-secret-key", encrypted)
|
|
})
|
|
}
|
|
|
|
func TestDecryptAESGCM(t *testing.T) {
|
|
key := []byte(testAESKey)
|
|
|
|
t.Run("round-trip encrypt then decrypt", func(t *testing.T) {
|
|
original := "sk-my-secret-api-key"
|
|
encrypted, err := EncryptAESGCM(original, key)
|
|
require.NoError(t, err)
|
|
|
|
decrypted, err := DecryptAESGCM(encrypted, key)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, original, decrypted)
|
|
})
|
|
|
|
t.Run("returns legacy plaintext as-is (no enc:v1: prefix)", func(t *testing.T) {
|
|
decrypted, err := DecryptAESGCM("sk-legacy-plaintext", key)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, "sk-legacy-plaintext", decrypted)
|
|
})
|
|
|
|
t.Run("returns empty string as-is", func(t *testing.T) {
|
|
decrypted, err := DecryptAESGCM("", key)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, "", decrypted)
|
|
})
|
|
|
|
t.Run("returns as-is when key is nil", func(t *testing.T) {
|
|
decrypted, err := DecryptAESGCM("enc:v1:something", nil)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, "enc:v1:something", decrypted)
|
|
})
|
|
}
|
|
|
|
func TestGetAESKey(t *testing.T) {
|
|
t.Run("returns key when SYSTEM_AES_KEY is 32 bytes", func(t *testing.T) {
|
|
t.Setenv("SYSTEM_AES_KEY", testAESKey)
|
|
key := GetAESKey()
|
|
assert.Equal(t, []byte(testAESKey), key)
|
|
})
|
|
|
|
t.Run("returns nil when SYSTEM_AES_KEY is not set", func(t *testing.T) {
|
|
t.Setenv("SYSTEM_AES_KEY", "")
|
|
key := GetAESKey()
|
|
assert.Nil(t, key)
|
|
})
|
|
|
|
t.Run("returns nil when SYSTEM_AES_KEY is wrong length", func(t *testing.T) {
|
|
t.Setenv("SYSTEM_AES_KEY", "too-short")
|
|
key := GetAESKey()
|
|
assert.Nil(t, key)
|
|
})
|
|
}
|