| import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'; |
| import fs from 'fs'; |
| import os from 'os'; |
| import path from 'path'; |
|
|
| const ORIGINAL_NODE_ENV = process.env.NODE_ENV; |
| const ORIGINAL_ENCRYPTION_KEY = process.env.ENCRYPTION_KEY; |
|
|
| let tempDir: string | undefined; |
|
|
| function restoreEnv() { |
| if (ORIGINAL_NODE_ENV === undefined) delete process.env.NODE_ENV; |
| else process.env.NODE_ENV = ORIGINAL_NODE_ENV; |
|
|
| if (ORIGINAL_ENCRYPTION_KEY === undefined) delete process.env.ENCRYPTION_KEY; |
| else process.env.ENCRYPTION_KEY = ORIGINAL_ENCRYPTION_KEY; |
| } |
|
|
| describe('initDb encryption bootstrapping', () => { |
| beforeEach(() => { |
| tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'freellmapi-db-')); |
| process.env.ENCRYPTION_KEY = 'c'.repeat(64); |
| }); |
|
|
| afterEach(() => { |
| restoreEnv(); |
| vi.resetModules(); |
| if (tempDir) fs.rmSync(tempDir, { recursive: true, force: true }); |
| tempDir = undefined; |
| }); |
|
|
| it('loads the encryption key on dev boot when migrations are already applied', async () => { |
| const dbPath = path.join(tempDir!, 'freeapi.db'); |
|
|
| process.env.NODE_ENV = 'test'; |
| vi.resetModules(); |
| const firstDbModule = await import('../../db/index.js'); |
| const firstCryptoModule = await import('../../lib/crypto.js'); |
| const firstDb = firstDbModule.initDb(dbPath); |
| const encrypted = firstCryptoModule.encrypt('provider-secret'); |
| firstDb.prepare(` |
| INSERT INTO api_keys (platform, label, encrypted_key, iv, auth_tag, status, enabled) |
| VALUES ('google', 'Google', ?, ?, ?, 'healthy', 1) |
| `).run(encrypted.encrypted, encrypted.iv, encrypted.authTag); |
| firstDb.close(); |
|
|
| process.env.NODE_ENV = 'development'; |
| vi.resetModules(); |
| const secondDbModule = await import('../../db/index.js'); |
| const secondCryptoModule = await import('../../lib/crypto.js'); |
| const secondDb = secondDbModule.initDb(dbPath); |
| const row = secondDb.prepare(` |
| SELECT encrypted_key, iv, auth_tag FROM api_keys WHERE platform = 'google' |
| `).get() as { encrypted_key: string; iv: string; auth_tag: string }; |
|
|
| expect(secondCryptoModule.decrypt(row.encrypted_key, row.iv, row.auth_tag)).toBe('provider-secret'); |
| secondDb.close(); |
| }); |
| }); |
|
|
