spb/polyllm

1import { describe, it, expect, beforeAll } from "vitest";23beforeAll(() => {4  process.env.API_KEY_ENCRYPTION_SECRET = "unit-test-secret-0123456789abcdef0123456789abcdef";5});67describe("provider key encryption", () => {8  it("round-trips and binds ciphertext to the user/provider context", async () => {9    const { encryptSecret, decryptSecret, fingerprintSecret, keyHint, redactSecrets } = await import("@/lib/crypto/keys");10    const ctx = { userId: "u1", provider: "openai" };11    const env = encryptSecret("sk-proj-abcdefghijklmnopqrstuvwxyz0123456789ABCD", ctx);12    expect(env.startsWith("v1.")).toBe(true);13    expect(env.split(".")).toHaveLength(4);14    expect(decryptSecret(env, ctx)).toBe("sk-proj-abcdefghijklmnopqrstuvwxyz0123456789ABCD");15    // different user → AAD mismatch → auth tag failure16    expect(() => decryptSecret(env, { userId: "u2", provider: "openai" })).toThrow();17    expect(() => decryptSecret(env, { userId: "u1", provider: "anthropic" })).toThrow();18    // never the plaintext19    expect(env).not.toContain("sk-proj");20    // random IV → different envelopes for the same key21    expect(encryptSecret("same", ctx)).not.toBe(encryptSecret("same", ctx));22    expect(fingerprintSecret("a")).toBe(fingerprintSecret("a"));23    expect(fingerprintSecret("a")).not.toBe(fingerprintSecret("b"));24    expect(keyHint("sk-ant-api03-verylongkeyvaluethatendswith9A2K")).toBe("sk-ant-••••••••9A2K");25    expect(keyHint("xai-abcdefgh1234")).toBe("xai-••••••••1234");26    expect(redactSecrets("Bearer sk-proj-abcdefghijklmnopqrstuvwxyz0123 and re_7KMNpXFh_JqMY4Gf4vxBYTVkiLhxB7WkA")).not.toMatch(/sk-proj-abc|re_7KMN/);27  });28});29