alkvault 0.1.0

Local key vault: BIP39 mnemonic generation, SLIP-0010 Ed25519 HD key derivation, AES-256-GCM encryption for securing provider keys, credentials, and identity material
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58

//! Integration tests for AES-256-GCM encryption and decryption.
//!
//! These tests verify round-trip encryption, key version handling,
//! and wire format compatibility.

use alkvault::encryption::CURRENT_KEY_VERSION;
use alkvault::service::VaultServiceHandle;

#[test]
fn test_encrypt_decrypt_round_trip_via_service() {
    let service = VaultServiceHandle::new();
    service.unlock_new(24).unwrap();

    let plaintext = "sk-proj-abc123xyz789";

    let encrypted = service.encrypt(plaintext, CURRENT_KEY_VERSION).unwrap();
    let decrypted = service.decrypt(&encrypted).unwrap();

    assert_eq!(decrypted, plaintext);
}

#[test]
fn test_encrypt_produces_different_ciphertext_each_time() {
    let service = VaultServiceHandle::new();
    service.unlock_new(24).unwrap();

    let plaintext = "same input different ciphertexts";

    let encrypted1 = service.encrypt(plaintext, CURRENT_KEY_VERSION).unwrap();
    let encrypted2 = service.encrypt(plaintext, CURRENT_KEY_VERSION).unwrap();

    // Different IVs mean different ciphertexts
    assert_ne!(encrypted1.iv, encrypted2.iv);
    assert_ne!(encrypted1.data, encrypted2.data);
    // But same key version
    assert_eq!(encrypted1.key_version, encrypted2.key_version);
}

#[test]
fn test_encrypted_data_serialization() {
    let service = VaultServiceHandle::new();
    service.unlock_new(24).unwrap();

    let plaintext = "test serialization";
    let encrypted = service.encrypt(plaintext, CURRENT_KEY_VERSION).unwrap();

    // Verify EncryptedData serializes to JSON
    let json = serde_json::to_string(&encrypted).unwrap();
    assert!(json.contains("key_version"));
    assert!(json.contains("salt"));
    assert!(json.contains("iv"));
    assert!(json.contains("data"));

    // Verify round-trip through JSON
    let deserialized: alkvault::encryption::EncryptedData =
        serde_json::from_str(&json).unwrap();
    assert_eq!(deserialized, encrypted);
}