superidou
5759c1862e
M0-M7 已完成:核心网关(身份/RBAC/TOTP/OIDC/SAML/Provider/配额/路由/内容策略/审计/定价)+ 资源市场(MCP/Skills/数字员工)。 含 22 个 PostgreSQL 迁移、管理端/门户端前端源码、OpenAPI 契约、部署 compose。 Co-Authored-By: Claude <noreply@anthropic.com>
38 lines
1.1 KiB
Go
38 lines
1.1 KiB
Go
package cryptox
|
|
|
|
import (
|
|
"encoding/base64"
|
|
"fmt"
|
|
"testing"
|
|
)
|
|
|
|
func TestKeyringDecryptsOldVersionAndEncryptsActiveVersion(t *testing.T) {
|
|
oldKey := base64.StdEncoding.EncodeToString(make([]byte, 32))
|
|
newBytes := make([]byte, 32)
|
|
newBytes[0] = 1
|
|
newKey := base64.StdEncoding.EncodeToString(newBytes)
|
|
oldCipher, err := NewAESGCM(oldKey, 1, "test")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
oldEncrypted, _, err := oldCipher.Encrypt([]byte("secret"))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
keyring, err := NewKeyring(newKey, 2, fmt.Sprintf(`{"1":%q}`, oldKey), "test")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
plaintext, err := keyring.Decrypt(oldEncrypted, 1)
|
|
if err != nil || string(plaintext) != "secret" {
|
|
t.Fatalf("old key was not usable: %q, %v", plaintext, err)
|
|
}
|
|
newEncrypted, version, err := keyring.Encrypt([]byte("new-secret"))
|
|
if err != nil || version != 2 {
|
|
t.Fatalf("active version was not used: version=%d error=%v", version, err)
|
|
}
|
|
if _, err := oldCipher.Decrypt(newEncrypted, version); err == nil {
|
|
t.Fatal("old cipher must not decrypt the new version")
|
|
}
|
|
}
|