22 lines
643 B
Python
22 lines
643 B
Python
from __future__ import annotations
|
|
|
|
import os
|
|
|
|
import pytest
|
|
from backup_tool.security.repository_crypto import (
|
|
RepositoryKeyError,
|
|
decrypt_object,
|
|
encrypt_object,
|
|
object_aad,
|
|
)
|
|
|
|
|
|
def test_encrypted_object_hides_plaintext_and_rejects_tampering() -> None:
|
|
key = os.urandom(32)
|
|
aad = object_aad("repository", "epoch", "blob", "identity")
|
|
stored = encrypt_object(key, aad, b"secret-content")
|
|
assert b"secret-content" not in stored
|
|
assert decrypt_object(key, aad, stored) == b"secret-content"
|
|
with pytest.raises(RepositoryKeyError):
|
|
decrypt_object(key, aad, stored[:-1] + bytes([stored[-1] ^ 1]))
|