123470b81b
* Update db init code to verify that all the required environment variables are set. * Add a workaround for integration secret encryption code - make sure we don't try to encrypt the secret twice. This is needed due to the bug in the code which would encrypt secrets even if they are already encrypted. * fixes spelling & folder structure --------- Co-authored-by: Christian Beutel <>
108 lines
3.1 KiB
Go
108 lines
3.1 KiB
Go
package util
|
|
|
|
import (
|
|
"crypto/aes"
|
|
"crypto/cipher"
|
|
"encoding/base64"
|
|
"os"
|
|
"pocketbase/util"
|
|
"testing"
|
|
|
|
"github.com/pocketbase/pocketbase/tools/security"
|
|
)
|
|
|
|
func TestLooksLikeEncrypted(t *testing.T) {
|
|
// Sub-test for non-base64 input.
|
|
t.Run("NonBase64", func(t *testing.T) {
|
|
if util.LooksLikeEncrypted("not a base64 string!") {
|
|
t.Errorf("Expected false for non-base64 input")
|
|
}
|
|
})
|
|
|
|
// Sub-test for an empty string.
|
|
t.Run("EmptyString", func(t *testing.T) {
|
|
if util.LooksLikeEncrypted("") {
|
|
t.Errorf("Expected false for empty string")
|
|
}
|
|
})
|
|
|
|
// Create a dummy byte slice to determine the nonce size using a dummy 32-byte key.
|
|
dummyKey := make([]byte, 32)
|
|
block, err := aes.NewCipher(dummyKey)
|
|
if err != nil {
|
|
t.Fatalf("Failed to create dummy cipher: %v", err)
|
|
}
|
|
gcm, err := cipher.NewGCM(block)
|
|
if err != nil {
|
|
t.Fatalf("Failed to create dummy GCM: %v", err)
|
|
}
|
|
nonceSize := gcm.NonceSize()
|
|
minSize := nonceSize + 16
|
|
|
|
// Sub-test for data length less than nonce+16 bytes.
|
|
t.Run("ShortData", func(t *testing.T) {
|
|
shortData := make([]byte, minSize-1)
|
|
encodedShort := base64.StdEncoding.EncodeToString(shortData)
|
|
if util.LooksLikeEncrypted(encodedShort) {
|
|
t.Errorf("Expected false for data length < nonce+16, got true")
|
|
}
|
|
})
|
|
|
|
// Sub-test for data length exactly equal to nonce+16 bytes.
|
|
t.Run("ExactData", func(t *testing.T) {
|
|
exactData := make([]byte, minSize)
|
|
encodedExact := base64.StdEncoding.EncodeToString(exactData)
|
|
if !util.LooksLikeEncrypted(encodedExact) {
|
|
t.Errorf("Expected true for data length == nonce+16")
|
|
}
|
|
})
|
|
|
|
// Sub-test for data length greater than nonce+16 bytes.
|
|
t.Run("LongData", func(t *testing.T) {
|
|
longData := make([]byte, minSize+10)
|
|
encodedLong := base64.StdEncoding.EncodeToString(longData)
|
|
if !util.LooksLikeEncrypted(encodedLong) {
|
|
t.Errorf("Expected true for data length > nonce+16")
|
|
}
|
|
})
|
|
}
|
|
|
|
func TestCanDecryptSecret(t *testing.T) {
|
|
// Sub-test: When POCKETBASE_ENCRYPTION_KEY is not set.
|
|
t.Run("NoEncryptionKey", func(t *testing.T) {
|
|
os.Unsetenv("POCKETBASE_ENCRYPTION_KEY")
|
|
if util.CanDecryptSecret("anyciphertext") {
|
|
t.Errorf("Expected false when POCKETBASE_ENCRYPTION_KEY is not set")
|
|
}
|
|
})
|
|
|
|
// Set a valid 32-byte key (for AES-256).
|
|
encryptionKey := "0123456789abcdef0123456789abcdef" // exactly 32 bytes
|
|
os.Setenv("POCKETBASE_ENCRYPTION_KEY", encryptionKey)
|
|
// Cleanup environment variable after the test.
|
|
t.Cleanup(func() {
|
|
os.Unsetenv("POCKETBASE_ENCRYPTION_KEY")
|
|
})
|
|
|
|
// Sub-test: Valid ciphertext should return true.
|
|
t.Run("ValidCiphertext", func(t *testing.T) {
|
|
plaintext := "my secret message"
|
|
// Cast plaintext to []byte as required by security.Encrypt.
|
|
ciphertext, err := security.Encrypt([]byte(plaintext), encryptionKey)
|
|
if err != nil {
|
|
t.Fatalf("Failed to encrypt secret: %v", err)
|
|
}
|
|
if !util.CanDecryptSecret(ciphertext) {
|
|
t.Errorf("Expected true for valid ciphertext with correct key")
|
|
}
|
|
})
|
|
|
|
// Sub-test: Invalid ciphertext should return false.
|
|
t.Run("InvalidCiphertext", func(t *testing.T) {
|
|
invalidCiphertext := "invalid_ciphertext"
|
|
if util.CanDecryptSecret(invalidCiphertext) {
|
|
t.Errorf("Expected false for invalid ciphertext")
|
|
}
|
|
})
|
|
}
|