158 lines
4.1 KiB
Python
158 lines
4.1 KiB
Python
"""crypto 模块测试"""
|
||
|
||
import os
|
||
import pytest
|
||
|
||
# 测试开始前设置密钥（必须在 import data.orders.crypto 之前）
|
||
os.environ.setdefault("GAOKAO_ORDERS_FERNET_KEY", "test-secret-for-unit-tests")
|
||
|
||
from data.orders.crypto import (
|
||
derive_key,
|
||
encrypt,
|
||
decrypt,
|
||
hash_for_index,
|
||
constant_time_equals,
|
||
EncryptionError,
|
||
MissingEncryptionKey,
|
||
ENV_KEY_NAME,
|
||
)
|
||
from cryptography.fernet import Fernet
|
||
|
||
|
||
def setup_function(_):
|
||
"""每个用例前清掉缓存，避免环境变量副作用。"""
|
||
from data.orders import crypto
|
||
|
||
crypto.get_fernet.cache_clear()
|
||
|
||
|
||
# -------- derive_key --------
|
||
|
||
|
||
def test_derive_key_is_deterministic():
|
||
"""同 secret 派生同 key。"""
|
||
k1 = derive_key("hello")
|
||
k2 = derive_key("hello")
|
||
assert k1 == k2
|
||
assert len(k1) > 0
|
||
|
||
|
||
def test_derive_key_distinct_for_different_secrets():
|
||
"""不同 secret 派生不同 key。"""
|
||
assert derive_key("a") != derive_key("b")
|
||
|
||
|
||
def test_derive_key_rejects_empty():
|
||
with pytest.raises(EncryptionError):
|
||
derive_key("")
|
||
|
||
|
||
def test_derive_key_accepts_fernet_key_directly():
|
||
"""Fernet 直接生成的 key 应被接受（兼容）。"""
|
||
direct = Fernet.generate_key()
|
||
# derive_key 用 sha256 派生；这里验证 Fernet 能用直接 key 初始化
|
||
Fernet(direct) # 不抛即可
|
||
|
||
|
||
# -------- encrypt/decrypt round-trip --------
|
||
|
||
|
||
def test_encrypt_decrypt_round_trip_chinese():
|
||
"""中文明文 round-trip。"""
|
||
plaintext = "张同学 13800001234"
|
||
ct = encrypt(plaintext)
|
||
assert ct != plaintext
|
||
assert decrypt(ct) == plaintext
|
||
|
||
|
||
def test_encrypt_decrypt_round_trip_empty_string():
|
||
"""空字符串也能 round-trip。"""
|
||
assert decrypt(encrypt("")) == ""
|
||
|
||
|
||
def test_encrypt_output_is_ascii():
|
||
"""密文为 base64-url 字符串，仅含 ASCII。"""
|
||
ct = encrypt("hello world")
|
||
ct.encode("ascii") # 不抛即通过
|
||
|
||
|
||
def test_decrypt_with_wrong_key_fails():
|
||
"""错误密钥解密应抛 EncryptionError。"""
|
||
# 先用当前 key 加密
|
||
ct = encrypt("secret-value")
|
||
# 切换密钥
|
||
os.environ[ENV_KEY_NAME] = "different-secret"
|
||
from data.orders import crypto
|
||
|
||
crypto.get_fernet.cache_clear()
|
||
with pytest.raises(EncryptionError):
|
||
decrypt(ct)
|
||
# 恢复
|
||
os.environ[ENV_KEY_NAME] = "test-secret-for-unit-tests"
|
||
crypto.get_fernet.cache_clear()
|
||
|
||
|
||
def test_encrypt_rejects_non_string():
|
||
with pytest.raises(EncryptionError):
|
||
encrypt(12345) # type: ignore[arg-type]
|
||
|
||
|
||
def test_decrypt_rejects_non_string():
|
||
with pytest.raises(EncryptionError):
|
||
decrypt(12345) # type: ignore[arg-type]
|
||
|
||
|
||
def test_missing_key_raises_missing_encryption_key(monkeypatch):
|
||
"""未配置密钥时 get_fernet 抛 MissingEncryptionKey，不静默降级。"""
|
||
monkeypatch.delenv(ENV_KEY_NAME, raising=False)
|
||
from data.orders import crypto
|
||
|
||
crypto.get_fernet.cache_clear()
|
||
with pytest.raises(MissingEncryptionKey):
|
||
encrypt("test")
|
||
|
||
|
||
# -------- hash_for_index --------
|
||
|
||
|
||
def test_hash_for_index_is_stable():
|
||
"""同输入同输出。"""
|
||
assert hash_for_index("13800001234") == hash_for_index("13800001234")
|
||
|
||
|
||
def test_hash_for_index_strips_whitespace():
|
||
"""前后空白不影响 hash。"""
|
||
assert hash_for_index(" 13800001234 ") == hash_for_index("13800001234")
|
||
|
||
|
||
def test_hash_for_index_is_hex_64_chars():
|
||
"""SHA-256 hex 应为 64 字符。"""
|
||
h = hash_for_index("13800001234")
|
||
assert len(h) == 64
|
||
int(h, 16) # 可被解析为 16 进制
|
||
|
||
|
||
def test_hash_for_index_different_inputs():
|
||
"""不同输入产生不同 hash。"""
|
||
assert hash_for_index("13800001234") != hash_for_index("13800001235")
|
||
|
||
|
||
def test_hash_for_index_rejects_non_string():
|
||
with pytest.raises(EncryptionError):
|
||
hash_for_index(12345) # type: ignore[arg-type]
|
||
|
||
|
||
# -------- constant_time_equals --------
|
||
|
||
|
||
def test_constant_time_equals_equal():
|
||
assert constant_time_equals("abc", "abc") is True
|
||
|
||
|
||
def test_constant_time_equals_unequal():
|
||
assert constant_time_equals("abc", "abd") is False
|
||
|
||
|
||
def test_constant_time_equals_different_length():
|
||
assert constant_time_equals("abc", "abcd") is False
|