import { describe, expect, it } from 'vitest';
import { encryptSecret, decryptSecret, isEncrypted, encryptStringArray, decryptStringArray, } from '../../security/secret-storage.js';
const KEY = 'a'.repeat(64); // 32 bytes hex
describe('secret-storage', () => {
    it('round-trips a secret when CMS_ENCRYPTION_KEY is set', async () => {
        process.env.CMS_ENCRYPTION_KEY = KEY;
        const ciphertext = await encryptSecret('totp-seed-12345');
        expect(ciphertext.startsWith('enc:v1:')).toBe(true);
        expect(isEncrypted(ciphertext)).toBe(true);
        expect(await decryptSecret(ciphertext)).toBe('totp-seed-12345');
    });
    it('passes plaintext through unchanged when CMS_ENCRYPTION_KEY is unset', async () => {
        delete process.env.CMS_ENCRYPTION_KEY;
        const out = await encryptSecret('plain-secret');
        expect(out).toBe('plain-secret');
        expect(isEncrypted(out)).toBe(false);
        // Reads of plaintext values that were never encrypted return as-is.
        expect(await decryptSecret('plain-secret')).toBe('plain-secret');
    });
    it('encryptStringArray + decryptStringArray round-trip', async () => {
        process.env.CMS_ENCRYPTION_KEY = KEY;
        const codes = ['abc-123', 'def-456', 'ghi-789'];
        const enc = await encryptStringArray(codes);
        expect(enc.every(isEncrypted)).toBe(true);
        expect(await decryptStringArray(enc)).toEqual(codes);
    });
    it('decryptSecret refuses encrypted values without a key', async () => {
        process.env.CMS_ENCRYPTION_KEY = KEY;
        const ciphertext = await encryptSecret('shh');
        delete process.env.CMS_ENCRYPTION_KEY;
        await expect(decryptSecret(ciphertext)).rejects.toThrow(/CMS_ENCRYPTION_KEY/);
    });
    it('round-trip data is non-deterministic (random IV)', async () => {
        process.env.CMS_ENCRYPTION_KEY = KEY;
        const a = await encryptSecret('same');
        const b = await encryptSecret('same');
        expect(a).not.toBe(b);
        expect(await decryptSecret(a)).toBe('same');
        expect(await decryptSecret(b)).toBe('same');
    });
});
//# sourceMappingURL=secret-storage.test.js.map