import { describe, expect, it, beforeAll } from 'vitest'; import { setCryptoBackend } from './backend'; import { makeWasmTestBackend } from './testBackend'; import { generateUserKeyPair, sealUserKey, openUserKey, KDF_PRESET } from './userKey'; beforeAll(async () => { setCryptoBackend(await makeWasmTestBackend()); }); describe('userKey', () => { it('generates a 32-byte X25519 keypair', async () => { const kp = await generateUserKeyPair(); expect(kp.publicKey).toHaveLength(32); expect(kp.privateKey).toHaveLength(32); }); it('seals and opens a private key with the same PIN', async () => { const kp = await generateUserKeyPair(); const sealed = await sealUserKey({ privateKey: kp.privateKey, pin: '123456' }); const opened = await openUserKey({ sealed: sealed.sealedPrivateKey, pin: '123456', salt: sealed.salt, kdfParams: sealed.kdfParams, }); expect(Array.from(opened)).toEqual(Array.from(kp.privateKey)); }); it('throws when opening with the wrong PIN', async () => { const kp = await generateUserKeyPair(); const sealed = await sealUserKey({ privateKey: kp.privateKey, pin: '123456' }); await expect( openUserKey({ sealed: sealed.sealedPrivateKey, pin: '654321', salt: sealed.salt, kdfParams: sealed.kdfParams }), ).rejects.toThrow(); }); it('throws when opening with the wrong salt', async () => { const kp = await generateUserKeyPair(); const sealed = await sealUserKey({ privateKey: kp.privateKey, pin: '123456' }); const wrongSalt = new Uint8Array(sealed.salt.length); wrongSalt.fill(7); await expect( openUserKey({ sealed: sealed.sealedPrivateKey, pin: '123456', salt: wrongSalt, kdfParams: sealed.kdfParams }), ).rejects.toThrow(); }); it('emits the documented KDF preset', async () => { const kp = await generateUserKeyPair(); const sealed = await sealUserKey({ privateKey: kp.privateKey, pin: '123456' }); expect(sealed.kdfParams.algo).toBe('argon2id'); expect(sealed.kdfParams.preset).toBe(KDF_PRESET); }); });