copilot-swe-agent[bot]
42cac76c0e
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
344 lines
12 KiB
Python
344 lines
12 KiB
Python
"""
|
|
Tests for app/utils/encryption.py
|
|
|
|
Tests encryption/decryption functionality for sensitive settings.
|
|
"""
|
|
|
|
from unittest.mock import Mock, patch
|
|
|
|
import pytest
|
|
|
|
|
|
@pytest.mark.unit
|
|
class TestEncryption:
|
|
"""Test encryption utility functions"""
|
|
|
|
def test_encrypt_value_with_none(self):
|
|
"""Test that None values are returned as-is"""
|
|
from app.utils.encryption import encrypt_value
|
|
|
|
result = encrypt_value(None)
|
|
assert result is None
|
|
|
|
def test_encrypt_value_with_empty_string(self):
|
|
"""Test that empty strings are returned as-is"""
|
|
from app.utils.encryption import encrypt_value
|
|
|
|
result = encrypt_value("")
|
|
assert result == ""
|
|
|
|
@patch("app.utils.encryption._get_cipher_suite")
|
|
def test_encrypt_value_when_encryption_unavailable(self, mock_cipher):
|
|
"""Test that plaintext is returned when encryption is unavailable"""
|
|
from app.utils.encryption import encrypt_value
|
|
|
|
mock_cipher.return_value = None
|
|
result = encrypt_value("secret_value")
|
|
|
|
# Should return plaintext with warning logged
|
|
assert result == "secret_value"
|
|
|
|
@patch("app.utils.encryption._get_cipher_suite")
|
|
def test_encrypt_value_success(self, mock_cipher):
|
|
"""Test successful encryption"""
|
|
from app.utils.encryption import encrypt_value
|
|
|
|
# Mock cipher that returns encrypted bytes
|
|
mock_fernet = Mock()
|
|
mock_fernet.encrypt.return_value = b"encrypted_data"
|
|
mock_cipher.return_value = mock_fernet
|
|
|
|
result = encrypt_value("secret_value")
|
|
|
|
# Should have "enc:" prefix
|
|
assert result.startswith("enc:")
|
|
assert "encrypted_data" in result
|
|
mock_fernet.encrypt.assert_called_once()
|
|
|
|
@patch("app.utils.encryption._get_cipher_suite")
|
|
def test_encrypt_value_encryption_failure(self, mock_cipher):
|
|
"""Test that encryption failures fall back to plaintext"""
|
|
from app.utils.encryption import encrypt_value
|
|
|
|
# Mock cipher that raises exception
|
|
mock_fernet = Mock()
|
|
mock_fernet.encrypt.side_effect = Exception("Encryption error")
|
|
mock_cipher.return_value = mock_fernet
|
|
|
|
result = encrypt_value("secret_value")
|
|
|
|
# Should fall back to plaintext
|
|
assert result == "secret_value"
|
|
|
|
def test_decrypt_value_with_none(self):
|
|
"""Test that None values are returned as-is"""
|
|
from app.utils.encryption import decrypt_value
|
|
|
|
result = decrypt_value(None)
|
|
assert result is None
|
|
|
|
def test_decrypt_value_with_empty_string(self):
|
|
"""Test that empty strings are returned as-is"""
|
|
from app.utils.encryption import decrypt_value
|
|
|
|
result = decrypt_value("")
|
|
assert result == ""
|
|
|
|
def test_decrypt_value_plaintext(self):
|
|
"""Test that plaintext values without enc: prefix are returned as-is"""
|
|
from app.utils.encryption import decrypt_value
|
|
|
|
result = decrypt_value("plain_value")
|
|
assert result == "plain_value"
|
|
|
|
@patch("app.utils.encryption._get_cipher_suite")
|
|
def test_decrypt_value_when_encryption_unavailable(self, mock_cipher):
|
|
"""Test decryption when cipher is unavailable"""
|
|
from app.utils.encryption import decrypt_value
|
|
|
|
mock_cipher.return_value = None
|
|
result = decrypt_value("enc:encrypted_data")
|
|
|
|
# Should return error message
|
|
assert result == "[ENCRYPTED - Cannot decrypt]"
|
|
|
|
@patch("app.utils.encryption._get_cipher_suite")
|
|
def test_decrypt_value_success(self, mock_cipher):
|
|
"""Test successful decryption"""
|
|
from app.utils.encryption import decrypt_value
|
|
|
|
# Mock cipher that returns decrypted bytes
|
|
mock_fernet = Mock()
|
|
mock_fernet.decrypt.return_value = b"decrypted_value"
|
|
mock_cipher.return_value = mock_fernet
|
|
|
|
result = decrypt_value("enc:encrypted_data")
|
|
|
|
assert result == "decrypted_value"
|
|
mock_fernet.decrypt.assert_called_once()
|
|
|
|
@patch("app.utils.encryption._get_cipher_suite")
|
|
def test_decrypt_value_decryption_failure(self, mock_cipher):
|
|
"""Test that decryption failures return error message"""
|
|
from app.utils.encryption import decrypt_value
|
|
|
|
# Mock cipher that raises exception
|
|
mock_fernet = Mock()
|
|
mock_fernet.decrypt.side_effect = Exception("Decryption error")
|
|
mock_cipher.return_value = mock_fernet
|
|
|
|
result = decrypt_value("enc:bad_data")
|
|
|
|
# Should return error message
|
|
assert result == "[DECRYPTION FAILED]"
|
|
|
|
def test_is_encrypted_with_encrypted_value(self):
|
|
"""Test is_encrypted returns True for encrypted values"""
|
|
from app.utils.encryption import is_encrypted
|
|
|
|
assert is_encrypted("enc:some_encrypted_data") is True
|
|
|
|
def test_is_encrypted_with_plaintext(self):
|
|
"""Test is_encrypted returns False for plaintext"""
|
|
from app.utils.encryption import is_encrypted
|
|
|
|
assert is_encrypted("plain_value") is False
|
|
|
|
def test_is_encrypted_with_none(self):
|
|
"""Test is_encrypted returns False for None"""
|
|
from app.utils.encryption import is_encrypted
|
|
|
|
assert is_encrypted(None) is False
|
|
|
|
def test_is_encrypted_with_empty_string(self):
|
|
"""Test is_encrypted returns False for empty string"""
|
|
from app.utils.encryption import is_encrypted
|
|
|
|
assert is_encrypted("") is False
|
|
|
|
def test_is_encrypted_with_non_string(self):
|
|
"""Test is_encrypted returns False for non-string types"""
|
|
from app.utils.encryption import is_encrypted
|
|
|
|
assert is_encrypted(123) is False
|
|
assert is_encrypted([]) is False
|
|
assert is_encrypted({}) is False
|
|
|
|
@patch("app.utils.encryption._get_cipher_suite")
|
|
def test_is_encryption_available_true(self, mock_cipher):
|
|
"""Test is_encryption_available when cryptography is available"""
|
|
from app.utils.encryption import is_encryption_available
|
|
|
|
mock_cipher.return_value = Mock() # Non-None cipher
|
|
assert is_encryption_available() is True
|
|
|
|
@patch("app.utils.encryption._get_cipher_suite")
|
|
def test_is_encryption_available_false(self, mock_cipher):
|
|
"""Test is_encryption_available when cryptography is not available"""
|
|
from app.utils.encryption import is_encryption_available
|
|
|
|
mock_cipher.return_value = None
|
|
assert is_encryption_available() is False
|
|
|
|
|
|
@pytest.mark.unit
|
|
class TestGetCipherSuite:
|
|
"""Test the _get_cipher_suite internal function"""
|
|
|
|
def test_cipher_suite_caching(self):
|
|
"""Test that cipher suite is cached after first call"""
|
|
import app.utils.encryption
|
|
|
|
# First call
|
|
result1 = app.utils.encryption._get_cipher_suite()
|
|
|
|
# Second call should return same instance (cached)
|
|
result2 = app.utils.encryption._get_cipher_suite()
|
|
|
|
# Both calls should return the same object (cached)
|
|
assert result1 is result2
|
|
|
|
|
|
@pytest.mark.unit
|
|
class TestEncryptionIntegration:
|
|
"""Integration tests for encrypt/decrypt cycle"""
|
|
|
|
@patch("app.utils.encryption._get_cipher_suite")
|
|
def test_encrypt_decrypt_cycle(self, mock_cipher):
|
|
"""Test that encrypting and then decrypting returns original value"""
|
|
from app.utils.encryption import decrypt_value, encrypt_value
|
|
|
|
# Mock a simple reversible encryption
|
|
mock_fernet = Mock()
|
|
|
|
# Simulate encryption: just add a prefix
|
|
def mock_encrypt(data):
|
|
return b"ENCRYPTED_" + data
|
|
|
|
# Simulate decryption: remove the prefix
|
|
def mock_decrypt(data):
|
|
return data.replace(b"ENCRYPTED_", b"")
|
|
|
|
mock_fernet.encrypt = mock_encrypt
|
|
mock_fernet.decrypt = mock_decrypt
|
|
mock_cipher.return_value = mock_fernet
|
|
|
|
original = "my_secret_password"
|
|
encrypted = encrypt_value(original)
|
|
decrypted = decrypt_value(encrypted)
|
|
|
|
assert encrypted != original
|
|
assert encrypted.startswith("enc:")
|
|
assert decrypted == original
|
|
|
|
def test_real_encryption_round_trip(self):
|
|
"""Test actual encryption/decryption with real cryptography library."""
|
|
from app.utils.encryption import decrypt_value, encrypt_value, is_encryption_available
|
|
|
|
# Skip if encryption is not available
|
|
if not is_encryption_available():
|
|
pytest.skip("Encryption not available (cryptography library not installed)")
|
|
|
|
original_value = "my_super_secret_password_123"
|
|
|
|
# Encrypt the value
|
|
encrypted = encrypt_value(original_value)
|
|
|
|
# Should be encrypted (has enc: prefix)
|
|
assert encrypted.startswith("enc:")
|
|
assert encrypted != original_value
|
|
|
|
# Decrypt should return original value
|
|
decrypted = decrypt_value(encrypted)
|
|
assert decrypted == original_value
|
|
|
|
def test_encryption_with_special_characters(self):
|
|
"""Test encryption with special characters and symbols."""
|
|
from app.utils.encryption import decrypt_value, encrypt_value, is_encryption_available
|
|
|
|
if not is_encryption_available():
|
|
pytest.skip("Encryption not available")
|
|
|
|
original = "P@ssw0rd!#$%^&*()_+-=[]{}|;:',.<>?/~`"
|
|
encrypted = encrypt_value(original)
|
|
decrypted = decrypt_value(encrypted)
|
|
|
|
assert decrypted == original
|
|
|
|
def test_encryption_with_unicode(self):
|
|
"""Test encryption with unicode characters."""
|
|
from app.utils.encryption import decrypt_value, encrypt_value, is_encryption_available
|
|
|
|
if not is_encryption_available():
|
|
pytest.skip("Encryption not available")
|
|
|
|
original = "Hello 世界 🌍 Привет мир"
|
|
encrypted = encrypt_value(original)
|
|
decrypted = decrypt_value(encrypted)
|
|
|
|
assert decrypted == original
|
|
|
|
def test_encryption_with_long_string(self):
|
|
"""Test encryption with very long strings."""
|
|
from app.utils.encryption import decrypt_value, encrypt_value, is_encryption_available
|
|
|
|
if not is_encryption_available():
|
|
pytest.skip("Encryption not available")
|
|
|
|
# Create a long string (1000 characters)
|
|
original = "A" * 1000
|
|
encrypted = encrypt_value(original)
|
|
decrypted = decrypt_value(encrypted)
|
|
|
|
assert decrypted == original
|
|
assert len(decrypted) == 1000
|
|
|
|
def test_encryption_with_newlines_and_whitespace(self):
|
|
"""Test encryption preserves newlines and whitespace."""
|
|
from app.utils.encryption import decrypt_value, encrypt_value, is_encryption_available
|
|
|
|
if not is_encryption_available():
|
|
pytest.skip("Encryption not available")
|
|
|
|
original = "line1\n line2\t\ttabbed\r\nline3 "
|
|
encrypted = encrypt_value(original)
|
|
decrypted = decrypt_value(encrypted)
|
|
|
|
assert decrypted == original
|
|
|
|
def test_encryption_with_json_string(self):
|
|
"""Test encryption with JSON string."""
|
|
from app.utils.encryption import decrypt_value, encrypt_value, is_encryption_available
|
|
|
|
if not is_encryption_available():
|
|
pytest.skip("Encryption not available")
|
|
|
|
original = '{"key": "value", "nested": {"array": [1, 2, 3]}}'
|
|
encrypted = encrypt_value(original)
|
|
decrypted = decrypt_value(encrypted)
|
|
|
|
assert decrypted == original
|
|
|
|
def test_multiple_encrypt_same_value_produces_different_ciphertext(self):
|
|
"""Test that encrypting the same value twice produces different ciphertext (if using random IV)."""
|
|
from app.utils.encryption import encrypt_value, is_encryption_available
|
|
|
|
if not is_encryption_available():
|
|
pytest.skip("Encryption not available")
|
|
|
|
original = "same_value"
|
|
encrypted1 = encrypt_value(original)
|
|
encrypted2 = encrypt_value(original)
|
|
|
|
# Both should be encrypted
|
|
assert encrypted1.startswith("enc:")
|
|
assert encrypted2.startswith("enc:")
|
|
|
|
# Fernet uses timestamp-based encryption, so they might be different
|
|
# (depending on timing). This test documents the behavior.
|
|
# We'll just verify both decrypt correctly
|
|
from app.utils.encryption import decrypt_value
|
|
|
|
assert decrypt_value(encrypted1) == original
|
|
assert decrypt_value(encrypted2) == original
|