peter
b1832afd18
Mechanical, whole-tree `ruff format` pass — no behaviour change. Recorded in .git-blame-ignore-revs (next commit) so git blame skips it.
38 lines
1.8 KiB
Python
38 lines
1.8 KiB
Python
"""Crypto primitives — a guard for the cryptography (Fernet) + argon2 dependency bumps.
|
|
|
|
Added with the cryptography 46->50 CVE bump: encrypt/decrypt/decrypt_optional had NO test, and they are
|
|
the token-at-rest path (Google/API/SMTP/Plex secrets in system_config, OAuth refresh tokens). A fresh
|
|
Fernet key is monkeypatched in so the test doesn't depend on TOKEN_ENCRYPTION_KEY being set in the env.
|
|
Pure-logic (no DB).
|
|
"""
|
|
|
|
from cryptography.fernet import Fernet
|
|
|
|
from app import security
|
|
|
|
|
|
def test_fernet_encrypt_decrypt_roundtrip(monkeypatch):
|
|
monkeypatch.setattr(security, "_fernet", Fernet(Fernet.generate_key()))
|
|
assert security.decrypt(security.encrypt("hunter2")) == "hunter2"
|
|
assert security.encrypt(None) is None
|
|
assert security.decrypt(None) is None
|
|
|
|
|
|
def test_decrypt_optional_degrades_instead_of_raising(monkeypatch):
|
|
# Garbage / absent input -> None (never raises).
|
|
monkeypatch.setattr(security, "_fernet", Fernet(Fernet.generate_key()))
|
|
assert security.decrypt_optional("not-a-valid-token") is None
|
|
assert security.decrypt_optional(None) is None
|
|
# And a ciphertext written under a DIFFERENT key (the TOKEN_ENCRYPTION_KEY-mismatch case that B-core-2
|
|
# made non-fatal) also degrades to None rather than raising InvalidToken.
|
|
ciphertext = security.encrypt("secret")
|
|
monkeypatch.setattr(security, "_fernet", Fernet(Fernet.generate_key())) # rotate the key
|
|
assert security.decrypt_optional(ciphertext) is None
|
|
|
|
|
|
def test_password_hash_and_verify_roundtrip():
|
|
hashed = security.hash_password("correct horse battery")
|
|
assert security.verify_password("correct horse battery", hashed) is True
|
|
assert security.verify_password("wrong password", hashed) is False
|
|
assert security.verify_password("anything", None) is False
|