@webda/core
Version:
Expose API with Lambda
177 lines • 7.51 kB
JavaScript
var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
return c > 3 && r && Object.defineProperty(target, key, r), r;
};
import { suite, test } from "@testdeck/mocha";
import * as assert from "assert";
import jwt from "jsonwebtoken";
import * as sinon from "sinon";
import { WebdaTest } from "../test.js";
import { JSONUtils } from "../utils/serializers.js";
import CryptoService, { SecretString } from "./cryptoservice.js";
/**
*
*/
let CryptoServiceTest = class CryptoServiceTest extends WebdaTest {
async hmac() {
let hmac = await this.webda.getCrypto().hmac({ test: "plop" });
let hmacString = await this.webda.getCrypto().hmac(JSONUtils.stringify({ test: "plop" }));
assert.strictEqual(hmac, hmacString);
await this.webda.getCrypto().hmacVerify({ test: "plop" }, hmac);
await this.webda.getCrypto().hmacVerify(JSONUtils.stringify({ test: "plop" }), hmac);
}
async encryption() {
let encrypted = await this.webda.getCrypto().encrypt({ test: "plop" });
let decrypted = await this.webda.getCrypto().decrypt(encrypted);
assert.strictEqual(decrypted.test, "plop");
}
async rotate() {
const crypto = this.webda.getCrypto();
let encrypted = await crypto.encrypt({ test: "plop" });
let oldKey = crypto.current;
let hmac = await crypto.hmac({ test: "plop" });
sinon.stub(crypto, "getNextId").callsFake(this.nextIdStub(crypto));
await crypto.rotate();
let decrypted = await crypto.decrypt(encrypted);
assert.strictEqual(decrypted.test, "plop");
await crypto.hmacVerify({ test: "plop" }, hmac);
assert.strictEqual(await crypto.hmac({ test: "plop" }, oldKey), hmac);
}
async failedRotation() {
// Check failed rotate
await this.webda.getRegistry().patch({ uuid: "keys", current: "123" });
await this.webda.getCrypto().rotate();
}
/**
* Increment by one every time
*/
nextIdStub(crypto) {
return () => {
let age = parseInt(crypto.current, 36) + 10;
return {
id: age.toString(36),
age
};
};
}
async jwks() {
const crypto = this.webda.getCrypto();
crypto.getParameters().url = "/jwk";
await crypto.resolve().init();
let ctx = await this.newContext();
await this.execute(ctx, "test.webda.io", "GET", "/jwk");
let body = JSON.parse(ctx.getResponseBody());
sinon.stub(crypto, "getNextId").callsFake(this.nextIdStub(crypto));
assert.strictEqual(body.keys.length, 1);
await crypto.rotate();
await this.execute(ctx, "test.webda.io", "GET", "/jwk");
body = JSON.parse(ctx.getResponseBody());
assert.strictEqual(body.keys.length, 2);
}
async unknownKeys() {
const crypto = this.webda.getCrypto();
// Custom made JWT
let jwtToken = jwt.sign("TEST", "test");
await assert.rejects(() => crypto.jwtVerify(jwtToken), /Unknown key/);
jwtToken = jwt.sign("TEST", "test", { keyid: "B" + crypto.current });
await assert.rejects(() => crypto.jwtVerify(jwtToken), /Unknown key/);
assert.ok(!(await crypto.hmacVerify("mydata", "md.ss")));
let oldKey = crypto.current;
sinon.stub(crypto, "getNextId").callsFake(this.nextIdStub(crypto));
await crypto.rotate();
let encrypted = await this.webda.getCrypto().encrypt({ test: "plop" });
delete crypto.keys[crypto.current];
crypto.current = oldKey;
crypto.age = parseInt(oldKey, 36); // It should be reloaded
assert.strictEqual((await this.webda.getCrypto().decrypt(encrypted)).test, "plop");
// Remove again but remove it from the registry now
await this.webda.getRegistry().removeAttribute("keys", `key_${crypto.current}`);
delete crypto.keys[crypto.current];
crypto.current = oldKey;
crypto.age = parseInt(oldKey, 36);
await assert.rejects(() => this.webda.getCrypto().decrypt(encrypted), /err/);
}
async jwt() {
// Test asymetric JWT
const crypto = this.webda.getCrypto();
let token = await crypto.jwtSign("plop", { algorithm: "PS256" });
assert.strictEqual(await crypto.jwtVerify(token), "plop");
token = await crypto.jwtSign("plop");
assert.strictEqual(await crypto.jwtVerify(token), "plop");
token = await crypto.jwtSign("plop", { algorithm: "HS256" });
assert.strictEqual(await crypto.jwtVerify(token), "plop");
}
async cov() {
this.webda.getCrypto().keys = undefined;
await assert.rejects(() => this.webda.getCrypto().getCurrentKeys(), /not initialized/);
}
};
__decorate([
test
], CryptoServiceTest.prototype, "hmac", null);
__decorate([
test
], CryptoServiceTest.prototype, "encryption", null);
__decorate([
test
], CryptoServiceTest.prototype, "rotate", null);
__decorate([
test
], CryptoServiceTest.prototype, "failedRotation", null);
__decorate([
test
], CryptoServiceTest.prototype, "jwks", null);
__decorate([
test
], CryptoServiceTest.prototype, "unknownKeys", null);
__decorate([
test
], CryptoServiceTest.prototype, "jwt", null);
__decorate([
test
], CryptoServiceTest.prototype, "cov", null);
CryptoServiceTest = __decorate([
suite
], CryptoServiceTest);
let CryptoConfigurationTest = class CryptoConfigurationTest {
async nominal() {
CryptoService.registerEncrypter("test", {
encrypt: async (data) => {
return data;
},
decrypt: async (data) => {
return data;
}
});
let data = {
key: {
secret: "encrypt:local:plop",
port: 21
},
anotherSecret: "encrypt:local:plop2",
notEncrypted: "plop",
alreadyEncrypted: "crypt:test:plop3"
};
await CryptoService.encryptConfiguration(data);
assert.ok(data.key.secret.startsWith("crypt:local:"));
assert.ok(!data.key.secret.includes("plop"));
assert.ok(data.anotherSecret.startsWith("crypt:local:"));
assert.ok(!data.anotherSecret.includes("plop"));
assert.strictEqual(data.alreadyEncrypted, "crypt:test:plop3");
let decrypted = await CryptoService.decryptConfiguration(JSONUtils.duplicate(data));
assert.strictEqual(decrypted.anotherSecret.getValue(), "plop2");
assert.strictEqual(decrypted.anotherSecret.toString(), "********");
assert.strictEqual(SecretString.from(decrypted.alreadyEncrypted), "plop3");
assert.strictEqual(SecretString.from(decrypted.key.secret), "plop");
assert.strictEqual(`Test: ${decrypted.alreadyEncrypted}`, "Test: ********");
}
};
__decorate([
test
], CryptoConfigurationTest.prototype, "nominal", null);
CryptoConfigurationTest = __decorate([
suite
], CryptoConfigurationTest);
//# sourceMappingURL=cryptoservice.spec.js.map