29 行
1.3 KiB
TypeScript
29 行
1.3 KiB
TypeScript
|
import assert from 'node:assert/strict'
|
||
|
|
import test from 'node:test'
|
||
|
|
|
||
|
|
import { isCacheRecordFresh, openLocalCache, sealLocalCache } from '../src/secureCache'
|
||
|
|
|
||
|
|
test('LKG cache round-trips with context-bound authenticated encryption', () => {
|
||
|
|
const encrypted = sealLocalCache('{"enabled":true}', 'signed-secret', 'app|package|environment')
|
||
|
|
assert.equal(
|
||
|
|
openLocalCache(encrypted, 'signed-secret', 'app|package|environment'),
|
||
|
|
'{"enabled":true}',
|
||
|
|
)
|
||
|
|
assert.equal(encrypted.includes('enabled'), false)
|
||
|
|
})
|
||
|
|
|
||
|
|
test('LKG cache rejects tampering and a different package/environment context', () => {
|
||
|
|
const encrypted = sealLocalCache('payload', 'signed-secret', 'app|package|environment')
|
||
|
|
const parts = encrypted.split('.')
|
||
|
|
parts[2] = `${parts[2][0] === 'A' ? 'B' : 'A'}${parts[2].slice(1)}`
|
||
|
|
assert.throws(() => openLocalCache(parts.join('.'), 'signed-secret', 'app|package|environment'))
|
||
|
|
assert.throws(() => openLocalCache(encrypted, 'signed-secret', 'app|other|environment'))
|
||
|
|
})
|
||
|
|
|
||
|
|
test('LKG freshness rejects future timestamps and expired records', () => {
|
||
|
|
const now = 1_000_000
|
||
|
|
assert.equal(isCacheRecordFresh(now - 1_000, now, 2_000), true)
|
||
|
|
assert.equal(isCacheRecordFresh(now - 2_001, now, 2_000), false)
|
||
|
|
assert.equal(isCacheRecordFresh(now + 1, now, 2_000), false)
|
||
|
|
})
|
