sz_orm_crypto/
lib.rs

1//! # SZ-ORM Crypto — 加密工具
2//!
3//! 提供常用密码学原语：AES-256-GCM 对称加密、HMAC-SHA256 消息认证码、
4//! PBKDF2 密钥派生与 SHA-256 哈希，所有实现基于 RustCrypto，保证常数时间比较。
5//!
6//! ## 主要函数
7//!
8//! - [`sha256`] / [`sha256_hex`] — SHA-256 哈希
9//! - AES-256-GCM 加解密
10//! - HMAC-SHA256 与 PBKDF2
11
12use std::collections::HashMap;
13
14use aes_gcm::aead::{Aead, KeyInit};
15use aes_gcm::{Aes256Gcm, Key, Nonce};
16use hmac::{Hmac, Mac};
17use pbkdf2::pbkdf2_hmac;
18use rand::rngs::OsRng;
19use rand::RngCore;
20use sha2::{Digest, Sha256};
21use subtle::ConstantTimeEq;
22
23type HmacSha256 = Hmac<Sha256>;
24
25// ============================================================================
26// SHA-256 (基于 RustCrypto sha2 crate, FIPS 180-4)
27// ============================================================================
28
29/// 计算 SHA-256 哈希（基于 RustCrypto sha2）
30pub fn sha256(data: &[u8]) -> [u8; 32] {
31    let mut hasher = Sha256::new();
32    hasher.update(data);
33    let result = hasher.finalize();
34    let mut out = [0u8; 32];
35    out.copy_from_slice(&result);
36    out
37}
38
39/// 计算 SHA-256 并返回十六进制字符串
40pub fn sha256_hex(data: &[u8]) -> String {
41    sha256(data).iter().map(|b| format!("{:02x}", b)).collect()
42}
43
44/// HMAC-SHA256 (RFC 2104, 基于 RustCrypto hmac crate)
45pub fn hmac_sha256(key: &[u8], message: &[u8]) -> [u8; 32] {
46    // HMAC-SHA256 按 RFC 2104 接受任意长度 key，RustCrypto 的 new_from_slice 对 HMAC 永远返回 Ok。
47    // 用 match 处理避免 panic，虽然 Err 分支不可达（RustCrypto 不变量保证）。
48    let mut mac = match <HmacSha256 as Mac>::new_from_slice(key) {
49        Ok(m) => m,
50        Err(_) => {
51            // 不可达分支：HMAC 规范允许任意 key 长度，RustCrypto 内部会先 hash 过长 key。
52            // 为安全起见返回全零（调用方在正常路径下永远不会命中此分支）。
53            return [0u8; 32];
54        }
55    };
56    mac.update(message);
57    let result = mac.finalize().into_bytes();
58    let mut out = [0u8; 32];
59    out.copy_from_slice(&result);
60    out
61}
62
63/// HMAC-SHA256 十六进制字符串
64pub fn hmac_sha256_hex(key: &[u8], message: &[u8]) -> String {
65    hmac_sha256(key, message)
66        .iter()
67        .map(|b| format!("{:02x}", b))
68        .collect()
69}
70
71/// 常量时间比较（基于 subtle crate），避免时序攻击
72fn constant_time_eq(a: &[u8], b: &[u8]) -> bool {
73    a.ct_eq(b).into()
74}
75
76// ============================================================================
77// 加密器
78// ============================================================================
79
80pub trait Crypter: Send + Sync {
81    fn encrypt(&self, plaintext: &[u8]) -> Result<Vec<u8>, CryptoError>;
82    fn decrypt(&self, ciphertext: &[u8]) -> Result<Vec<u8>, CryptoError>;
83}
84
85/// AES-256-GCM 加密器（密码学安全）
86///
87/// 使用 AES-256-GCM AEAD 算法，每次加密生成随机 12 字节 nonce。
88/// 密文格式：`nonce(12) || ciphertext || tag(16)`（由 aes-gcm crate 内部处理）。
89pub struct AesGcmCrypter {
90    cipher: Aes256Gcm,
91}
92
93impl AesGcmCrypter {
94    /// 从 32 字节密钥创建
95    pub fn new(key: &[u8; 32]) -> Self {
96        let key = Key::<Aes256Gcm>::from_slice(key);
97        Self {
98            cipher: Aes256Gcm::new(key),
99        }
100    }
101
102    /// 从任意长度密钥字符串创建（SHA-256 派生 32 字节密钥）
103    pub fn from_key_str(key: &str) -> Self {
104        let hash = sha256(key.as_bytes());
105        Self::new(&hash)
106    }
107
108    fn random_nonce() -> [u8; 12] {
109        let mut nonce = [0u8; 12];
110        OsRng.fill_bytes(&mut nonce);
111        nonce
112    }
113}
114
115impl Crypter for AesGcmCrypter {
116    fn encrypt(&self, plaintext: &[u8]) -> Result<Vec<u8>, CryptoError> {
117        self.encrypt_with_aad(plaintext, &[])
118    }
119
120    fn decrypt(&self, ciphertext: &[u8]) -> Result<Vec<u8>, CryptoError> {
121        self.decrypt_with_aad(ciphertext, &[])
122    }
123}
124
125impl AesGcmCrypter {
126    /// AES-GCM 认证加密（带附加认证数据 AAD）
127    ///
128    /// 密文格式：`nonce(12) || ciphertext || tag(16)`
129    /// AAD（Additional Authenticated Data）不包含在密文中，但参与认证标签计算，
130    /// 解密时必须提供相同的 AAD 才能成功。
131    pub fn encrypt_with_aad(&self, plaintext: &[u8], aad: &[u8]) -> Result<Vec<u8>, CryptoError> {
132        let nonce_bytes = Self::random_nonce();
133        let nonce = Nonce::from_slice(&nonce_bytes);
134        let payload = aes_gcm::aead::Payload {
135            msg: plaintext,
136            aad,
137        };
138        let ciphertext = self
139            .cipher
140            .encrypt(nonce, payload)
141            .map_err(|e| CryptoError::EncryptionFailed(e.to_string()))?;
142        let mut result = Vec::with_capacity(12 + ciphertext.len());
143        result.extend_from_slice(&nonce_bytes);
144        result.extend_from_slice(&ciphertext);
145        Ok(result)
146    }
147
148    /// AES-GCM 认证解密（带附加认证数据 AAD）
149    ///
150    /// 必须提供与加密时相同的 AAD，否则认证标签校验失败。
151    pub fn decrypt_with_aad(&self, ciphertext: &[u8], aad: &[u8]) -> Result<Vec<u8>, CryptoError> {
152        if ciphertext.len() < 12 {
153            return Err(CryptoError::DecryptionFailed(
154                "Ciphertext too short".to_string(),
155            ));
156        }
157        let nonce = Nonce::from_slice(&ciphertext[..12]);
158        let encrypted = &ciphertext[12..];
159        let payload = aes_gcm::aead::Payload {
160            msg: encrypted,
161            aad,
162        };
163        self.cipher
164            .decrypt(nonce, payload)
165            .map_err(|e| CryptoError::DecryptionFailed(e.to_string()))
166    }
167}
168
169// ============================================================================
170// 密码哈希
171// ============================================================================
172
173pub trait PasswordHasher: Send + Sync {
174    fn hash(&self, password: &str) -> Result<String, CryptoError>;
175    fn verify(&self, password: &str, hash: &str) -> Result<bool, CryptoError>;
176}
177
178/// PBKDF2-HMAC-SHA256 密码哈希器（基于 RustCrypto pbkdf2 crate）
179///
180/// 使用 PBKDF2-HMAC-SHA256 算法（RFC 8018）。
181/// 哈希格式：`$<iterations>$<salt_hex>$<hash_hex>`
182pub struct Pbkdf2Hasher {
183    iterations: u32,
184}
185
186impl Pbkdf2Hasher {
187    const DEFAULT_ITERATIONS: u32 = 100_000;
188    const SALT_LEN: usize = 16;
189    const HASH_LEN: usize = 32;
190
191    pub fn new() -> Self {
192        Self {
193            iterations: Self::DEFAULT_ITERATIONS,
194        }
195    }
196
197    pub fn with_iterations(iterations: u32) -> Self {
198        Self {
199            iterations: iterations.max(1),
200        }
201    }
202
203    fn compute_hash(password: &str, salt: &[u8], iterations: u32) -> [u8; Self::HASH_LEN] {
204        let mut out = [0u8; Self::HASH_LEN];
205        pbkdf2_hmac::<Sha256>(password.as_bytes(), salt, iterations, &mut out);
206        out
207    }
208}
209
210impl Default for Pbkdf2Hasher {
211    fn default() -> Self {
212        Self::new()
213    }
214}
215
216impl PasswordHasher for Pbkdf2Hasher {
217    fn hash(&self, password: &str) -> Result<String, CryptoError> {
218        if password.is_empty() {
219            return Err(CryptoError::InvalidHash(
220                "Password cannot be empty".to_string(),
221            ));
222        }
223        let salt = random_bytes(Self::SALT_LEN);
224        let hash = Self::compute_hash(password, &salt, self.iterations);
225        Ok(format!(
226            "${}${}${}",
227            self.iterations,
228            hex_encode(&salt),
229            hex_encode(&hash)
230        ))
231    }
232
233    fn verify(&self, password: &str, hash: &str) -> Result<bool, CryptoError> {
234        if !hash.starts_with('$') {
235            return Err(CryptoError::InvalidHash("Invalid hash format".to_string()));
236        }
237        let parts: Vec<&str> = hash[1..].splitn(3, '$').collect();
238        if parts.len() != 3 {
239            return Err(CryptoError::InvalidHash("Invalid hash format".to_string()));
240        }
241        let iterations: u32 = parts[0]
242            .parse()
243            .map_err(|_| CryptoError::InvalidHash("Invalid iterations".to_string()))?;
244        let salt = hex_decode(parts[1])
245            .map_err(|_| CryptoError::InvalidHash("Invalid salt hex".to_string()))?;
246        let expected_hash = hex_decode(parts[2])
247            .map_err(|_| CryptoError::InvalidHash("Invalid hash hex".to_string()))?;
248        let computed = Self::compute_hash(password, &salt, iterations);
249        Ok(constant_time_eq(&computed, &expected_hash))
250    }
251}
252
253// ============================================================================
254// API 签名
255// ============================================================================
256
257pub trait ApiSigner: Send + Sync {
258    fn sign(&self, params: &HashMap<String, String>, secret: &str) -> String;
259    fn verify(&self, params: &HashMap<String, String>, secret: &str, signature: &str) -> bool;
260}
261
262/// HMAC-SHA256 API 签名器
263///
264/// 对参数按字典序排序后拼接成 query string，再用 HMAC-SHA256 签名。
265pub struct HmacSigner;
266
267impl HmacSigner {
268    pub fn new() -> Self {
269        Self
270    }
271
272    fn compute_signature(params: &HashMap<String, String>, secret: &str) -> String {
273        let mut sorted: Vec<_> = params.iter().collect();
274        sorted.sort_by(|a, b| a.0.cmp(b.0));
275
276        let query_string: String = sorted
277            .iter()
278            .map(|(k, v)| format!("{}={}", k, v))
279            .collect::<Vec<_>>()
280            .join("&");
281
282        hmac_sha256_hex(secret.as_bytes(), query_string.as_bytes())
283    }
284}
285
286impl Default for HmacSigner {
287    fn default() -> Self {
288        Self::new()
289    }
290}
291
292impl ApiSigner for HmacSigner {
293    fn sign(&self, params: &HashMap<String, String>, secret: &str) -> String {
294        Self::compute_signature(params, secret)
295    }
296
297    fn verify(&self, params: &HashMap<String, String>, secret: &str, signature: &str) -> bool {
298        let computed = Self::compute_signature(params, secret);
299        constant_time_eq(computed.as_bytes(), signature.as_bytes())
300    }
301}
302
303// ============================================================================
304// RSA-OAEP 非对称加密
305// ============================================================================
306
307use rsa::oaep::Oaep;
308use rsa::{RsaPrivateKey, RsaPublicKey};
309use sha2::Sha256 as RsaSha256;
310
311/// RSA-OAEP 非对称加密器（基于 RustCrypto `rsa` crate）
312///
313/// 使用 RSA-OAEP with SHA-256 和 MGF1-SHA256 填充方案。
314/// 公钥加密，私钥解密，适用于小数据（如密钥交换、短消息加密）。
315pub struct RsaOaepCrypter {
316    public_key: RsaPublicKey,
317    private_key: RsaPrivateKey,
318}
319
320impl RsaOaepCrypter {
321    /// 生成新的 RSA 密钥对（指定位数，推荐 2048 或 3072）
322    pub fn generate(key_bits: usize) -> Result<Self, CryptoError> {
323        let mut rng = OsRng;
324        let private_key = RsaPrivateKey::new(&mut rng, key_bits)
325            .map_err(|e| CryptoError::InvalidKey(e.to_string()))?;
326        let public_key = RsaPublicKey::from(&private_key);
327        Ok(Self {
328            public_key,
329            private_key,
330        })
331    }
332
333    /// 从已有密钥对创建
334    pub fn from_keys(public_key: RsaPublicKey, private_key: RsaPrivateKey) -> Self {
335        Self {
336            public_key,
337            private_key,
338        }
339    }
340
341    /// 返回公钥引用
342    pub fn public_key(&self) -> &RsaPublicKey {
343        &self.public_key
344    }
345
346    /// 返回私钥引用
347    pub fn private_key(&self) -> &RsaPrivateKey {
348        &self.private_key
349    }
350
351    /// 使用公钥加密数据（RSA-OAEP with SHA-256）
352    pub fn encrypt(&self, plaintext: &[u8]) -> Result<Vec<u8>, CryptoError> {
353        let mut rng = OsRng;
354        let padding = Oaep::new::<RsaSha256>();
355        self.public_key
356            .encrypt(&mut rng, padding, plaintext)
357            .map_err(|e| CryptoError::EncryptionFailed(e.to_string()))
358    }
359
360    /// 使用私钥解密数据（RSA-OAEP with SHA-256）
361    pub fn decrypt(&self, ciphertext: &[u8]) -> Result<Vec<u8>, CryptoError> {
362        let padding = Oaep::new::<RsaSha256>();
363        self.private_key
364            .decrypt(padding, ciphertext)
365            .map_err(|e| CryptoError::DecryptionFailed(e.to_string()))
366    }
367}
368
369impl Crypter for RsaOaepCrypter {
370    fn encrypt(&self, plaintext: &[u8]) -> Result<Vec<u8>, CryptoError> {
371        self.encrypt(plaintext)
372    }
373
374    fn decrypt(&self, ciphertext: &[u8]) -> Result<Vec<u8>, CryptoError> {
375        self.decrypt(ciphertext)
376    }
377}
378
379// ============================================================================
380// HMAC-SHA256 签名验证器
381// ============================================================================
382
383/// 签名验证器 trait：提供消息签名与验证接口
384pub trait SignatureVerifier: Send + Sync {
385    /// 对消息生成签名
386    fn sign(&self, message: &[u8]) -> Vec<u8>;
387    /// 验证消息签名（常量时间比较）
388    fn verify(&self, message: &[u8], signature: &[u8]) -> bool;
389}
390
391/// HMAC-SHA256 签名验证器
392///
393/// 使用 HMAC-SHA256 算法对消息签名，验证时采用常量时间比较防止时序攻击。
394pub struct HmacSignatureVerifier {
395    key: Vec<u8>,
396}
397
398impl HmacSignatureVerifier {
399    /// 创建签名验证器，从任意长度密钥派生
400    pub fn new(key: &[u8]) -> Self {
401        Self { key: key.to_vec() }
402    }
403
404    /// 从字符串密钥创建
405    pub fn from_key_str(key: &str) -> Self {
406        Self::new(key.as_bytes())
407    }
408}
409
410impl SignatureVerifier for HmacSignatureVerifier {
411    fn sign(&self, message: &[u8]) -> Vec<u8> {
412        hmac_sha256(&self.key, message).to_vec()
413    }
414
415    fn verify(&self, message: &[u8], signature: &[u8]) -> bool {
416        let expected = self.sign(message);
417        constant_time_eq(&expected, signature)
418    }
419}
420
421// ============================================================================
422// 密钥轮换（Key Rotation）
423// ============================================================================
424
425/// 密钥版本：保存密钥及其版本号和创建时间
426#[derive(Clone)]
427struct KeyVersion {
428    version: u32,
429    key: Vec<u8>,
430    created_at: u64,
431}
432
433/// 密钥轮换管理器
434///
435/// 管理多个版本的密钥，支持：
436/// - 轮换生成新版本密钥
437/// - 用最新密钥签名
438/// - 用任意历史密钥验证（向后兼容）
439/// - 自动淘汰过期密钥
440pub struct KeyRotationManager {
441    keys: Vec<KeyVersion>,
442    current_version: u32,
443    max_versions: usize,
444}
445
446impl KeyRotationManager {
447    /// 创建密钥轮换管理器，指定最大保留版本数
448    pub fn new(max_versions: usize) -> Self {
449        Self {
450            keys: vec![],
451            current_version: 0,
452            max_versions: max_versions.max(1),
453        }
454    }
455
456    /// 初始化首个密钥版本
457    pub fn with_initial_key(key: Vec<u8>) -> Self {
458        let mut mgr = Self::new(3);
459        mgr.rotate_key(key);
460        mgr
461    }
462
463    /// 轮换到新密钥，返回新版本号
464    pub fn rotate_key(&mut self, new_key: Vec<u8>) -> u32 {
465        self.current_version += 1;
466        let now = current_timestamp_secs();
467        self.keys.push(KeyVersion {
468            version: self.current_version,
469            key: new_key,
470            created_at: now,
471        });
472        // 淘汰过期版本
473        while self.keys.len() > self.max_versions {
474            self.keys.remove(0);
475        }
476        self.current_version
477    }
478
479    /// 使用当前（最新）密钥签名
480    pub fn sign(&self, message: &[u8]) -> (u32, Vec<u8>) {
481        if let Some(kv) = self.keys.last() {
482            let sig = hmac_sha256(&kv.key, message).to_vec();
483            (kv.version, sig)
484        } else {
485            (0, vec![])
486        }
487    }
488
489    /// 验证签名（尝试所有保留的密钥版本）
490    pub fn verify(&self, message: &[u8], version: u32, signature: &[u8]) -> bool {
491        for kv in &self.keys {
492            if kv.version == version {
493                let expected = hmac_sha256(&kv.key, message);
494                return constant_time_eq(&expected, signature);
495            }
496        }
497        false
498    }
499
500    /// 返回当前密钥版本号
501    pub fn current_version(&self) -> u32 {
502        self.current_version
503    }
504
505    /// 返回保留的密钥版本数量
506    pub fn version_count(&self) -> usize {
507        self.keys.len()
508    }
509
510    /// 返回所有保留的版本号
511    pub fn versions(&self) -> Vec<u32> {
512        self.keys.iter().map(|kv| kv.version).collect()
513    }
514
515    /// 返回指定版本密钥的创建时间（Unix 秒），不存在返回 None
516    pub fn key_created_at(&self, version: u32) -> Option<u64> {
517        self.keys
518            .iter()
519            .find(|kv| kv.version == version)
520            .map(|kv| kv.created_at)
521    }
522}
523
524fn current_timestamp_secs() -> u64 {
525    use std::time::{SystemTime, UNIX_EPOCH};
526    SystemTime::now()
527        .duration_since(UNIX_EPOCH)
528        .unwrap_or_default()
529        .as_secs()
530}
531
532// ============================================================================
533// 密钥版本管理与轮换（并发安全）
534// ============================================================================
535
536use std::sync::RwLock;
537use std::time::Duration;
538
539/// 默认密钥轮换间隔：90 天
540const DEFAULT_ROTATION_INTERVAL_SECS: u64 = 90 * 24 * 60 * 60;
541
542/// 带版本的密钥
543#[derive(Debug, Clone)]
544pub struct VersionedKey {
545    /// 密钥版本
546    pub version: u32,
547    /// 密钥字节
548    pub key: Vec<u8>,
549    /// 创建时间
550    pub created_at: std::time::SystemTime,
551}
552
553/// 密钥管理器（支持轮换）
554///
555/// 维护一个当前活跃密钥和最多 3 个历史密钥（用于解密过渡期），
556/// 支持按时间间隔自动轮换检查。所有字段使用 `RwLock` 保护，可安全跨线程共享。
557pub struct KeyManager {
558    /// 当前活跃密钥
559    current: RwLock<VersionedKey>,
560    /// 旧密钥列表（用于解密过渡期）
561    previous: RwLock<Vec<VersionedKey>>,
562    /// 密钥轮换间隔
563    rotation_interval: Duration,
564    /// 上次轮换时间
565    last_rotation: RwLock<std::time::SystemTime>,
566}
567
568impl KeyManager {
569    /// 创建密钥管理器，使用给定的初始密钥（版本号从 1 开始）
570    pub fn new(initial_key: Vec<u8>) -> Self {
571        let now = std::time::SystemTime::now();
572        Self {
573            current: RwLock::new(VersionedKey {
574                version: 1,
575                key: initial_key,
576                created_at: now,
577            }),
578            previous: RwLock::new(Vec::new()),
579            rotation_interval: Duration::from_secs(DEFAULT_ROTATION_INTERVAL_SECS),
580            last_rotation: RwLock::new(now),
581        }
582    }
583
584    /// 设置轮换间隔
585    pub fn with_rotation_interval(mut self, interval: Duration) -> Self {
586        self.rotation_interval = interval;
587        self
588    }
589
590    /// 轮换密钥
591    pub fn rotate(&self, new_key: Vec<u8>) -> Result<(), CryptoError> {
592        let mut current = self.current.write().expect("KeyManager lock poisoned");
593        let mut previous = self.previous.write().expect("KeyManager lock poisoned");
594
595        // 将当前密钥移入旧密钥列表
596        previous.push(current.clone());
597
598        // 保留最近 3 个旧密钥
599        if previous.len() > 3 {
600            previous.remove(0);
601        }
602
603        // 设置新密钥
604        *current = VersionedKey {
605            version: current.version + 1,
606            key: new_key,
607            created_at: std::time::SystemTime::now(),
608        };
609
610        *self.last_rotation.write().unwrap() = std::time::SystemTime::now();
611        Ok(())
612    }
613
614    /// 检查是否需要轮换
615    pub fn needs_rotation(&self) -> bool {
616        let last = *self.last_rotation.read().unwrap();
617        std::time::SystemTime::now()
618            .duration_since(last)
619            .map(|d| d >= self.rotation_interval)
620            .unwrap_or(false)
621    }
622
623    /// 获取当前密钥
624    pub fn current_key(&self) -> VersionedKey {
625        self.current.read().unwrap().clone()
626    }
627
628    /// 按版本查找密钥
629    pub fn key_by_version(&self, version: u32) -> Option<VersionedKey> {
630        if self.current.read().unwrap().version == version {
631            return Some(self.current.read().unwrap().clone());
632        }
633        self.previous
634            .read()
635            .unwrap()
636            .iter()
637            .find(|k| k.version == version)
638            .cloned()
639    }
640
641    /// 返回保留的旧密钥数量
642    pub fn previous_count(&self) -> usize {
643        self.previous.read().unwrap().len()
644    }
645}
646
647// ============================================================================
648// 辅助函数
649// ============================================================================
650
651fn hex_encode(bytes: &[u8]) -> String {
652    bytes.iter().map(|b| format!("{:02x}", b)).collect()
653}
654
655fn hex_decode(hex: &str) -> Result<Vec<u8>, ()> {
656    if !hex.len().is_multiple_of(2) {
657        return Err(());
658    }
659    (0..hex.len())
660        .step_by(2)
661        .map(|i| u8::from_str_radix(&hex[i..i + 2], 16).map_err(|_| ()))
662        .collect()
663}
664
665fn random_bytes(len: usize) -> Vec<u8> {
666    let mut result = vec![0u8; len];
667    OsRng.fill_bytes(&mut result);
668    result
669}
670
671// ============================================================================
672// 错误类型
673// ============================================================================
674
675#[derive(Debug)]
676pub enum CryptoError {
677    EncryptionFailed(String),
678    DecryptionFailed(String),
679    InvalidKey(String),
680    InvalidNonce(String),
681    InvalidHash(String),
682    SigningFailed(String),
683}
684
685impl std::fmt::Display for CryptoError {
686    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
687        match self {
688            CryptoError::EncryptionFailed(msg) => write!(f, "Encryption failed: {}", msg),
689            CryptoError::DecryptionFailed(msg) => write!(f, "Decryption failed: {}", msg),
690            CryptoError::InvalidKey(msg) => write!(f, "Invalid key: {}", msg),
691            CryptoError::InvalidNonce(msg) => write!(f, "Invalid nonce: {}", msg),
692            CryptoError::InvalidHash(msg) => write!(f, "Invalid hash: {}", msg),
693            CryptoError::SigningFailed(msg) => write!(f, "Signing failed: {}", msg),
694        }
695    }
696}
697
698impl std::error::Error for CryptoError {}
699
700impl serde::Serialize for CryptoError {
701    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
702    where
703        S: serde::Serializer,
704    {
705        serializer.serialize_str(&self.to_string())
706    }
707}
708
709// ============================================================================
710// 测试
711// ============================================================================
712
713#[cfg(test)]
714mod tests {
715    use super::*;
716
717    // --- SHA-256 标准测试向量 (FIPS 180-2 / NIST) ---
718
719    #[test]
720    fn test_sha256_empty() {
721        assert_eq!(
722            sha256_hex(b""),
723            "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
724        );
725    }
726
727    #[test]
728    fn test_sha256_abc() {
729        assert_eq!(
730            sha256_hex(b"abc"),
731            "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad"
732        );
733    }
734
735    #[test]
736    fn test_sha256_hello() {
737        assert_eq!(
738            sha256_hex(b"hello"),
739            "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
740        );
741    }
742
743    #[test]
744    fn test_sha256_long_message() {
745        assert_eq!(
746            sha256_hex(b"abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq"),
747            "248d6a61d20638b8e5c026930c3e6039a33ce45964ff2167f6ecedd419db06c1"
748        );
749    }
750
751    #[test]
752    fn test_sha256_deterministic() {
753        assert_eq!(sha256_hex(b"test"), sha256_hex(b"test"));
754        assert_ne!(sha256_hex(b"test"), sha256_hex(b"Test"));
755    }
756
757    // --- HMAC-SHA256 测试向量 (RFC 4231) ---
758
759    #[test]
760    fn test_hmac_sha256_rfc4231_case1() {
761        let key = vec![0x0bu8; 20];
762        let result = hmac_sha256_hex(&key, b"Hi There");
763        assert_eq!(
764            result,
765            "b0344c61d8db38535ca8afceaf0bf12b881dc200c9833da726e9376c2e32cff7"
766        );
767    }
768
769    #[test]
770    fn test_hmac_sha256_rfc4231_case2() {
771        let result = hmac_sha256_hex(b"Jefe", b"what do ya want for nothing?");
772        assert_eq!(
773            result,
774            "5bdcc146bf60754e6a042426089575c75a003f089d2739839dec58b964ec3843"
775        );
776    }
777
778    #[test]
779    fn test_hmac_sha256_long_key() {
780        let key = vec![0xaau8; 130];
781        let result = hmac_sha256_hex(&key, b"test message");
782        assert_eq!(result.len(), 64);
783        let short_key = vec![0xaau8; 32];
784        let result_short = hmac_sha256_hex(&short_key, b"test message");
785        assert_ne!(result, result_short);
786    }
787
788    #[test]
789    fn test_hmac_sha256_different_messages() {
790        let key = b"secret";
791        assert_ne!(hmac_sha256_hex(key, b"msg1"), hmac_sha256_hex(key, b"msg2"));
792    }
793
794    // --- AesGcmCrypter 测试 ---
795
796    #[test]
797    fn test_aes_gcm_roundtrip() {
798        let key = [0x42u8; 32];
799        let crypter = AesGcmCrypter::new(&key);
800        let plaintext = b"Hello, World!";
801        let encrypted = crypter.encrypt(plaintext).unwrap();
802        let decrypted = crypter.decrypt(&encrypted).unwrap();
803        assert_eq!(decrypted, plaintext);
804    }
805
806    #[test]
807    fn test_aes_gcm_random_nonce_per_encryption() {
808        let key = [0x42u8; 32];
809        let crypter = AesGcmCrypter::new(&key);
810        let plaintext = b"same plaintext";
811        let encrypted1 = crypter.encrypt(plaintext).unwrap();
812        let encrypted2 = crypter.encrypt(plaintext).unwrap();
813        assert_ne!(encrypted1, encrypted2, "随机 nonce 应使密文不同");
814        assert_eq!(crypter.decrypt(&encrypted1).unwrap(), plaintext);
815        assert_eq!(crypter.decrypt(&encrypted2).unwrap(), plaintext);
816    }
817
818    #[test]
819    fn test_aes_gcm_from_key_str() {
820        let crypter = AesGcmCrypter::from_key_str("my-secret-key");
821        let plaintext = b"data to encrypt";
822        let encrypted = crypter.encrypt(plaintext).unwrap();
823        let decrypted = crypter.decrypt(&encrypted).unwrap();
824        assert_eq!(decrypted, plaintext);
825    }
826
827    #[test]
828    fn test_aes_gcm_short_ciphertext() {
829        let key = [0x42u8; 32];
830        let crypter = AesGcmCrypter::new(&key);
831        assert!(crypter.decrypt(&[0u8; 8]).is_err());
832    }
833
834    #[test]
835    fn test_aes_gcm_empty_plaintext() {
836        let key = [0x42u8; 32];
837        let crypter = AesGcmCrypter::new(&key);
838        let encrypted = crypter.encrypt(b"").unwrap();
839        // nonce(12) + tag(16) = 28
840        assert_eq!(encrypted.len(), 28);
841        let decrypted = crypter.decrypt(&encrypted).unwrap();
842        assert_eq!(decrypted, b"");
843    }
844
845    #[test]
846    fn test_aes_gcm_tampered_ciphertext() {
847        let key = [0x42u8; 32];
848        let crypter = AesGcmCrypter::new(&key);
849        let encrypted = crypter.encrypt(b"sensitive data").unwrap();
850        let mut tampered = encrypted.clone();
851        tampered[15] ^= 0x01;
852        assert!(crypter.decrypt(&tampered).is_err());
853    }
854
855    // --- Pbkdf2Hasher 测试 ---
856
857    #[test]
858    fn test_pbkdf2_hasher_hash_format() {
859        let hasher = Pbkdf2Hasher::new();
860        let hash = hasher.hash("password123").unwrap();
861        assert!(hash.starts_with('$'));
862        let parts: Vec<&str> = hash[1..].splitn(3, '$').collect();
863        assert_eq!(parts.len(), 3);
864        assert_eq!(parts[0].parse::<u32>().unwrap(), 100_000);
865        // salt 32 hex chars (16 bytes)
866        assert_eq!(parts[1].len(), 32);
867        // hash 64 hex chars (32 bytes)
868        assert_eq!(parts[2].len(), 64);
869    }
870
871    #[test]
872    fn test_pbkdf2_hasher_verify_correct() {
873        let hasher = Pbkdf2Hasher::new();
874        let hash = hasher.hash("password123").unwrap();
875        assert!(hasher.verify("password123", &hash).unwrap());
876    }
877
878    #[test]
879    fn test_pbkdf2_hasher_verify_wrong() {
880        let hasher = Pbkdf2Hasher::new();
881        let hash = hasher.hash("password123").unwrap();
882        assert!(!hasher.verify("wrongpassword", &hash).unwrap());
883    }
884
885    #[test]
886    fn test_pbkdf2_hasher_different_passwords_different_hashes() {
887        let hasher = Pbkdf2Hasher::new();
888        let h1 = hasher.hash("pass1").unwrap();
889        let h2 = hasher.hash("pass2").unwrap();
890        assert_ne!(h1, h2);
891    }
892
893    #[test]
894    fn test_pbkdf2_hasher_same_password_different_salts() {
895        let hasher = Pbkdf2Hasher::new();
896        let h1 = hasher.hash("same").unwrap();
897        let h2 = hasher.hash("same").unwrap();
898        assert_ne!(h1, h2);
899        assert!(hasher.verify("same", &h1).unwrap());
900        assert!(hasher.verify("same", &h2).unwrap());
901    }
902
903    #[test]
904    fn test_pbkdf2_hasher_invalid_format() {
905        let hasher = Pbkdf2Hasher::new();
906        assert!(hasher.verify("password", "invalid-hash").is_err());
907        assert!(hasher.verify("password", "$abc").is_err());
908        assert!(hasher.verify("password", "$abc$def").is_err());
909    }
910
911    #[test]
912    fn test_pbkdf2_hasher_with_iterations() {
913        let hasher = Pbkdf2Hasher::with_iterations(1000);
914        let hash = hasher.hash("secret").unwrap();
915        let parts: Vec<&str> = hash[1..].splitn(3, '$').collect();
916        assert_eq!(parts[0], "1000");
917        assert!(hasher.verify("secret", &hash).unwrap());
918    }
919
920    #[test]
921    fn test_pbkdf2_hasher_empty_password() {
922        let hasher = Pbkdf2Hasher::new();
923        assert!(hasher.hash("").is_err());
924    }
925
926    // --- HmacSigner 测试 ---
927
928    #[test]
929    fn test_hmac_signer_sign_not_empty() {
930        let signer = HmacSigner::new();
931        let mut params = HashMap::new();
932        params.insert("name".to_string(), "test".to_string());
933        let signature = signer.sign(&params, "secret123");
934        assert_eq!(signature.len(), 64);
935    }
936
937    #[test]
938    fn test_hmac_signer_verify_correct() {
939        let signer = HmacSigner::new();
940        let mut params = HashMap::new();
941        params.insert("name".to_string(), "test".to_string());
942        params.insert("age".to_string(), "25".to_string());
943
944        let signature = signer.sign(&params, "mysecret");
945        assert!(signer.verify(&params, "mysecret", &signature));
946    }
947
948    #[test]
949    fn test_hmac_signer_verify_wrong_secret() {
950        let signer = HmacSigner::new();
951        let mut params = HashMap::new();
952        params.insert("name".to_string(), "test".to_string());
953        let signature = signer.sign(&params, "correctsecret");
954        assert!(!signer.verify(&params, "wrongsecret", &signature));
955    }
956
957    #[test]
958    fn test_hmac_signer_verify_wrong_signature() {
959        let signer = HmacSigner::new();
960        let mut params = HashMap::new();
961        params.insert("name".to_string(), "test".to_string());
962        let valid_sig = signer.sign(&params, "secret");
963        let tampered = if let Some(stripped) = valid_sig.strip_prefix('0') {
964            format!("1{}", stripped)
965        } else {
966            format!("0{}", &valid_sig[1..])
967        };
968        assert!(!signer.verify(&params, "secret", &tampered));
969    }
970
971    #[test]
972    fn test_hmac_signer_different_params_different_signatures() {
973        let signer = HmacSigner::new();
974        let mut params1 = HashMap::new();
975        params1.insert("a".to_string(), "1".to_string());
976
977        let mut params2 = HashMap::new();
978        params2.insert("b".to_string(), "2".to_string());
979
980        let sig1 = signer.sign(&params1, "secret");
981        let sig2 = signer.sign(&params2, "secret");
982        assert_ne!(sig1, sig2);
983    }
984
985    #[test]
986    fn test_hmac_signer_param_order_independent() {
987        let signer = HmacSigner::new();
988        let mut params1 = HashMap::new();
989        params1.insert("b".to_string(), "2".to_string());
990        params1.insert("a".to_string(), "1".to_string());
991
992        let mut params2 = HashMap::new();
993        params2.insert("a".to_string(), "1".to_string());
994        params2.insert("b".to_string(), "2".to_string());
995
996        let sig1 = signer.sign(&params1, "secret");
997        let sig2 = signer.sign(&params2, "secret");
998        assert_eq!(sig1, sig2);
999    }
1000
1001    #[test]
1002    fn test_hmac_signer_empty_params() {
1003        let signer = HmacSigner::new();
1004        let params = HashMap::new();
1005        let sig = signer.sign(&params, "secret");
1006        assert_eq!(sig.len(), 64);
1007        assert!(signer.verify(&params, "secret", &sig));
1008    }
1009
1010    // --- 辅助函数测试 ---
1011
1012    #[test]
1013    fn test_random_bytes_length() {
1014        assert_eq!(random_bytes(0).len(), 0);
1015        assert_eq!(random_bytes(16).len(), 16);
1016        assert_eq!(random_bytes(100).len(), 100);
1017    }
1018
1019    #[test]
1020    fn test_random_bytes_random() {
1021        let a = random_bytes(32);
1022        let b = random_bytes(32);
1023        assert_ne!(a, b, "随机字节序列应不同");
1024    }
1025
1026    #[test]
1027    fn test_constant_time_eq() {
1028        assert!(constant_time_eq(b"abc", b"abc"));
1029        assert!(!constant_time_eq(b"abc", b"abd"));
1030        assert!(!constant_time_eq(b"abc", b"ab"));
1031        assert!(!constant_time_eq(b"abc", b"abcd"));
1032        assert!(constant_time_eq(b"", b""));
1033    }
1034
1035    #[test]
1036    fn test_hex_encode_decode_roundtrip() {
1037        let original = vec![0x00, 0xff, 0xab, 0x42];
1038        let encoded = hex_encode(&original);
1039        let decoded = hex_decode(&encoded).unwrap();
1040        assert_eq!(decoded, original);
1041    }
1042
1043    #[test]
1044    fn test_hex_decode_invalid() {
1045        assert!(hex_decode("abc").is_err());
1046        assert!(hex_decode("xy").is_err());
1047    }
1048
1049    // ===== AES-GCM AAD 测试 =====
1050
1051    #[test]
1052    fn test_aes_gcm_aad_roundtrip() {
1053        let key = [0x42u8; 32];
1054        let crypter = AesGcmCrypter::new(&key);
1055        let plaintext = b"sensitive data";
1056        let aad = b"associated metadata";
1057        let encrypted = crypter.encrypt_with_aad(plaintext, aad).unwrap();
1058        let decrypted = crypter.decrypt_with_aad(&encrypted, aad).unwrap();
1059        assert_eq!(decrypted, plaintext);
1060    }
1061
1062    #[test]
1063    fn test_aes_gcm_aad_wrong_aad_fails() {
1064        let key = [0x42u8; 32];
1065        let crypter = AesGcmCrypter::new(&key);
1066        let plaintext = b"sensitive data";
1067        let aad = b"correct aad";
1068        let encrypted = crypter.encrypt_with_aad(plaintext, aad).unwrap();
1069        // 使用错误的 AAD 解密应失败
1070        let result = crypter.decrypt_with_aad(&encrypted, b"wrong aad");
1071        assert!(result.is_err());
1072    }
1073
1074    #[test]
1075    fn test_aes_gcm_aad_empty_aad_equivalent_to_no_aad() {
1076        let key = [0x42u8; 32];
1077        let crypter = AesGcmCrypter::new(&key);
1078        let plaintext = b"test data";
1079        // 空 AAD 等价于无 AAD
1080        let encrypted_no_aad = crypter.encrypt(plaintext).unwrap();
1081        let encrypted_empty_aad = crypter.encrypt_with_aad(plaintext, b"").unwrap();
1082        // 两者都应能解密
1083        assert_eq!(crypter.decrypt(&encrypted_no_aad).unwrap(), plaintext);
1084        assert_eq!(
1085            crypter.decrypt_with_aad(&encrypted_empty_aad, b"").unwrap(),
1086            plaintext
1087        );
1088    }
1089
1090    #[test]
1091    fn test_aes_gcm_aad_tampered_ciphertext_fails() {
1092        let key = [0x42u8; 32];
1093        let crypter = AesGcmCrypter::new(&key);
1094        let encrypted = crypter.encrypt_with_aad(b"data", b"aad").unwrap();
1095        let mut tampered = encrypted.clone();
1096        tampered[15] ^= 0x01;
1097        assert!(crypter.decrypt_with_aad(&tampered, b"aad").is_err());
1098    }
1099
1100    #[test]
1101    fn test_aes_gcm_aad_empty_plaintext() {
1102        let key = [0x42u8; 32];
1103        let crypter = AesGcmCrypter::new(&key);
1104        let encrypted = crypter.encrypt_with_aad(b"", b"aad").unwrap();
1105        // nonce(12) + tag(16) = 28
1106        assert_eq!(encrypted.len(), 28);
1107        let decrypted = crypter.decrypt_with_aad(&encrypted, b"aad").unwrap();
1108        assert_eq!(decrypted, b"");
1109    }
1110
1111    // ===== RSA-OAEP 测试 =====
1112
1113    #[test]
1114    fn test_rsa_oaep_roundtrip() {
1115        let crypter = RsaOaepCrypter::generate(2048).expect("RSA key generation");
1116        let plaintext = b"Hello, RSA-OAEP!";
1117        let encrypted = crypter.encrypt(plaintext).unwrap();
1118        let decrypted = crypter.decrypt(&encrypted).unwrap();
1119        assert_eq!(decrypted, plaintext);
1120    }
1121
1122    #[test]
1123    fn test_rsa_oaep_different_ciphertexts_same_plaintext() {
1124        let crypter = RsaOaepCrypter::generate(2048).unwrap();
1125        let plaintext = b"same message";
1126        let enc1 = crypter.encrypt(plaintext).unwrap();
1127        let enc2 = crypter.encrypt(plaintext).unwrap();
1128        // OAEP 使用随机填充，相同明文应产生不同密文
1129        assert_ne!(enc1, enc2);
1130        // 但两者都能正确解密
1131        assert_eq!(crypter.decrypt(&enc1).unwrap(), plaintext);
1132        assert_eq!(crypter.decrypt(&enc2).unwrap(), plaintext);
1133    }
1134
1135    #[test]
1136    fn test_rsa_oaep_empty_plaintext() {
1137        let crypter = RsaOaepCrypter::generate(2048).unwrap();
1138        let encrypted = crypter.encrypt(b"").unwrap();
1139        let decrypted = crypter.decrypt(&encrypted).unwrap();
1140        assert_eq!(decrypted, b"");
1141    }
1142
1143    #[test]
1144    fn test_rsa_oaep_tampered_ciphertext_fails() {
1145        let crypter = RsaOaepCrypter::generate(2048).unwrap();
1146        let encrypted = crypter.encrypt(b"secret").unwrap();
1147        let mut tampered = encrypted.clone();
1148        tampered[0] ^= 0x01;
1149        assert!(crypter.decrypt(&tampered).is_err());
1150    }
1151
1152    #[test]
1153    fn test_rsa_oaep_max_message_length() {
1154        // 2048-bit RSA-OAEP with SHA-256: max message = 2048/8 - 2*32 - 2 = 190 bytes
1155        let crypter = RsaOaepCrypter::generate(2048).unwrap();
1156        let plaintext = vec![0xABu8; 190];
1157        let encrypted = crypter.encrypt(&plaintext).unwrap();
1158        let decrypted = crypter.decrypt(&encrypted).unwrap();
1159        assert_eq!(decrypted, plaintext);
1160    }
1161
1162    #[test]
1163    fn test_rsa_oaep_oversized_message_fails() {
1164        let crypter = RsaOaepCrypter::generate(2048).unwrap();
1165        // 超过最大消息长度（190 字节 + 1）
1166        let plaintext = vec![0xABu8; 191];
1167        assert!(crypter.encrypt(&plaintext).is_err());
1168    }
1169
1170    #[test]
1171    fn test_rsa_oaep_from_keys() {
1172        let crypter1 = RsaOaepCrypter::generate(2048).unwrap();
1173        let crypter2 = RsaOaepCrypter::from_keys(
1174            crypter1.public_key().clone(),
1175            crypter1.private_key().clone(),
1176        );
1177        let plaintext = b"test from_keys";
1178        let encrypted = crypter2.encrypt(plaintext).unwrap();
1179        let decrypted = crypter2.decrypt(&encrypted).unwrap();
1180        assert_eq!(decrypted, plaintext);
1181    }
1182
1183    #[test]
1184    fn test_rsa_oaep_crypter_trait() {
1185        let crypter = RsaOaepCrypter::generate(2048).unwrap();
1186        let plaintext = b"trait test";
1187        let encrypted = Crypter::encrypt(&crypter, plaintext).unwrap();
1188        let decrypted = Crypter::decrypt(&crypter, &encrypted).unwrap();
1189        assert_eq!(decrypted, plaintext);
1190    }
1191
1192    // ===== HMAC 签名验证器测试 =====
1193
1194    #[test]
1195    fn test_hmac_signature_verifier_sign_verify() {
1196        let verifier = HmacSignatureVerifier::new(b"my-secret-key");
1197        let message = b"important message";
1198        let signature = verifier.sign(message);
1199        assert_eq!(signature.len(), 32);
1200        assert!(verifier.verify(message, &signature));
1201    }
1202
1203    #[test]
1204    fn test_hmac_signature_verifier_wrong_message() {
1205        let verifier = HmacSignatureVerifier::new(b"key");
1206        let signature = verifier.sign(b"message1");
1207        assert!(!verifier.verify(b"message2", &signature));
1208    }
1209
1210    #[test]
1211    fn test_hmac_signature_verifier_wrong_signature() {
1212        let verifier = HmacSignatureVerifier::new(b"key");
1213        let signature = verifier.sign(b"message");
1214        let mut tampered = signature.clone();
1215        tampered[0] ^= 0x01;
1216        assert!(!verifier.verify(b"message", &tampered));
1217    }
1218
1219    #[test]
1220    fn test_hmac_signature_verifier_from_key_str() {
1221        let verifier = HmacSignatureVerifier::from_key_str("string-key");
1222        let message = b"test";
1223        let sig = verifier.sign(message);
1224        assert!(verifier.verify(message, &sig));
1225    }
1226
1227    #[test]
1228    fn test_hmac_signature_verifier_different_keys_different_signatures() {
1229        let v1 = HmacSignatureVerifier::new(b"key1");
1230        let v2 = HmacSignatureVerifier::new(b"key2");
1231        let message = b"same message";
1232        let sig1 = v1.sign(message);
1233        let sig2 = v2.sign(message);
1234        assert_ne!(sig1, sig2);
1235    }
1236
1237    #[test]
1238    fn test_hmac_signature_verifier_empty_message() {
1239        let verifier = HmacSignatureVerifier::new(b"key");
1240        let sig = verifier.sign(b"");
1241        assert_eq!(sig.len(), 32);
1242        assert!(verifier.verify(b"", &sig));
1243    }
1244
1245    #[test]
1246    fn test_hmac_signature_verifier_wrong_length_signature() {
1247        let verifier = HmacSignatureVerifier::new(b"key");
1248        // 长度不对的签名应验证失败
1249        assert!(!verifier.verify(b"message", b"short"));
1250        assert!(!verifier.verify(b"message", &[]));
1251    }
1252
1253    // ===== 密钥轮换测试 =====
1254
1255    #[test]
1256    fn test_key_rotation_initial_key() {
1257        let mgr = KeyRotationManager::with_initial_key(b"key-v1".to_vec());
1258        assert_eq!(mgr.current_version(), 1);
1259        assert_eq!(mgr.version_count(), 1);
1260        assert_eq!(mgr.versions(), vec![1]);
1261    }
1262
1263    #[test]
1264    fn test_key_rotation_sign_verify_current() {
1265        let mgr = KeyRotationManager::with_initial_key(b"secret-key".to_vec());
1266        let message = b"test message";
1267        let (version, signature) = mgr.sign(message);
1268        assert_eq!(version, 1);
1269        assert!(mgr.verify(message, version, &signature));
1270    }
1271
1272    #[test]
1273    fn test_key_rotation_old_version_still_valid() {
1274        let mut mgr = KeyRotationManager::with_initial_key(b"key-v1".to_vec());
1275        let message = b"persistent message";
1276        let (v1, sig1) = mgr.sign(message);
1277        // 轮换到新密钥
1278        mgr.rotate_key(b"key-v2".to_vec());
1279        let (v2, sig2) = mgr.sign(message);
1280        assert_eq!(v1, 1);
1281        assert_eq!(v2, 2);
1282        // 旧版本签名仍应验证通过
1283        assert!(mgr.verify(message, v1, &sig1));
1284        // 新版本签名也应验证通过
1285        assert!(mgr.verify(message, v2, &sig2));
1286    }
1287
1288    #[test]
1289    fn test_key_rotation_max_versions_evicts_oldest() {
1290        let mut mgr = KeyRotationManager::new(2);
1291        mgr.rotate_key(b"key-v1".to_vec());
1292        mgr.rotate_key(b"key-v2".to_vec());
1293        assert_eq!(mgr.version_count(), 2);
1294        // 第三次轮换应淘汰 v1
1295        mgr.rotate_key(b"key-v3".to_vec());
1296        assert_eq!(mgr.version_count(), 2);
1297        assert_eq!(mgr.versions(), vec![2, 3]);
1298        assert!(!mgr.versions().contains(&1));
1299    }
1300
1301    #[test]
1302    fn test_key_rotation_old_version_evicted_fails_verify() {
1303        let mut mgr = KeyRotationManager::new(2);
1304        mgr.rotate_key(b"key-v1".to_vec());
1305        let message = b"test";
1306        let (v1, sig1) = mgr.sign(message);
1307        mgr.rotate_key(b"key-v2".to_vec());
1308        mgr.rotate_key(b"key-v3".to_vec());
1309        // v1 已被淘汰，验证应失败
1310        assert!(!mgr.verify(message, v1, &sig1));
1311    }
1312
1313    #[test]
1314    fn test_key_rotation_wrong_version_fails() {
1315        let mgr = KeyRotationManager::with_initial_key(b"key".to_vec());
1316        let message = b"test";
1317        let (_, signature) = mgr.sign(message);
1318        // 使用不存在的版本号验证应失败
1319        assert!(!mgr.verify(message, 999, &signature));
1320    }
1321
1322    #[test]
1323    fn test_key_rotation_multiple_rotations() {
1324        let mut mgr = KeyRotationManager::new(5);
1325        for i in 1..=4 {
1326            let key = format!("key-v{}", i);
1327            let version = mgr.rotate_key(key.as_bytes().to_vec());
1328            assert_eq!(version, i as u32);
1329        }
1330        assert_eq!(mgr.current_version(), 4);
1331        assert_eq!(mgr.version_count(), 4);
1332        assert_eq!(mgr.versions(), vec![1, 2, 3, 4]);
1333    }
1334
1335    #[test]
1336    fn test_key_rotation_empty_manager_sign_returns_zero() {
1337        let mgr = KeyRotationManager::new(3);
1338        let (version, sig) = mgr.sign(b"message");
1339        assert_eq!(version, 0);
1340        assert!(sig.is_empty());
1341    }
1342
1343    #[test]
1344    fn test_key_rotation_verify_with_wrong_signature() {
1345        let mgr = KeyRotationManager::with_initial_key(b"key".to_vec());
1346        let message = b"test";
1347        let (version, _) = mgr.sign(message);
1348        let wrong_sig = vec![0u8; 32];
1349        assert!(!mgr.verify(message, version, &wrong_sig));
1350    }
1351
1352    #[test]
1353    fn test_key_rotation_max_versions_min_one() {
1354        // max_versions = 0 应被提升为 1
1355        let mut mgr = KeyRotationManager::new(0);
1356        mgr.rotate_key(b"k1".to_vec());
1357        mgr.rotate_key(b"k2".to_vec());
1358        assert_eq!(mgr.version_count(), 1);
1359        assert_eq!(mgr.versions(), vec![2]);
1360    }
1361
1362    // ===== KeyManager（并发密钥轮换）测试 =====
1363
1364    #[test]
1365    fn test_key_manager_initial_key() {
1366        let mgr = KeyManager::new(b"initial-key".to_vec());
1367        let current = mgr.current_key();
1368        assert_eq!(current.version, 1);
1369        assert_eq!(current.key, b"initial-key");
1370        assert_eq!(mgr.previous_count(), 0);
1371    }
1372
1373    #[test]
1374    fn test_key_manager_rotate_increments_version() {
1375        let mgr = KeyManager::new(b"v1".to_vec());
1376        assert!(mgr.rotate(b"v2".to_vec()).is_ok());
1377        let current = mgr.current_key();
1378        assert_eq!(current.version, 2);
1379        assert_eq!(current.key, b"v2");
1380        assert_eq!(mgr.previous_count(), 1);
1381    }
1382
1383    #[test]
1384    fn test_key_manager_key_by_version_current() {
1385        let mgr = KeyManager::new(b"v1".to_vec());
1386        let found = mgr.key_by_version(1).expect("v1 should exist");
1387        assert_eq!(found.key, b"v1");
1388    }
1389
1390    #[test]
1391    fn test_key_manager_key_by_version_previous() {
1392        let mgr = KeyManager::new(b"v1".to_vec());
1393        mgr.rotate(b"v2".to_vec()).unwrap();
1394        // 旧版本仍可查找
1395        let old = mgr.key_by_version(1).expect("v1 should still be retained");
1396        assert_eq!(old.key, b"v1");
1397        // 新版本也可查找
1398        let new = mgr.key_by_version(2).expect("v2 should exist");
1399        assert_eq!(new.key, b"v2");
1400    }
1401
1402    #[test]
1403    fn test_key_manager_key_by_version_not_found() {
1404        let mgr = KeyManager::new(b"v1".to_vec());
1405        assert!(mgr.key_by_version(999).is_none());
1406    }
1407
1408    #[test]
1409    fn test_key_manager_retains_at_most_three_previous() {
1410        let mgr = KeyManager::new(b"v1".to_vec());
1411        mgr.rotate(b"v2".to_vec()).unwrap();
1412        mgr.rotate(b"v3".to_vec()).unwrap();
1413        mgr.rotate(b"v4".to_vec()).unwrap();
1414        // 3 次轮换后 previous 应有 3 个，再轮换一次应淘汰最早的
1415        assert_eq!(mgr.previous_count(), 3);
1416        mgr.rotate(b"v5".to_vec()).unwrap();
1417        assert_eq!(mgr.previous_count(), 3);
1418        // v1 应已被淘汰
1419        assert!(mgr.key_by_version(1).is_none());
1420        // v2 仍应存在
1421        assert!(mgr.key_by_version(2).is_some());
1422        // 当前版本为 5
1423        assert_eq!(mgr.current_key().version, 5);
1424    }
1425
1426    #[test]
1427    fn test_key_manager_needs_rotation_false_initially() {
1428        let mgr = KeyManager::new(b"k".to_vec());
1429        // 刚创建不应需要轮换
1430        assert!(!mgr.needs_rotation());
1431    }
1432
1433    #[test]
1434    fn test_key_manager_needs_rotation_true_after_interval() {
1435        let mgr = KeyManager::new(b"k".to_vec()).with_rotation_interval(Duration::from_millis(0));
1436        // 间隔为 0，应立即需要轮换
1437        std::thread::sleep(Duration::from_millis(1));
1438        assert!(mgr.needs_rotation());
1439    }
1440
1441    #[test]
1442    fn test_key_manager_with_rotation_interval() {
1443        let mgr = KeyManager::new(b"k".to_vec()).with_rotation_interval(Duration::from_secs(60));
1444        assert!(!mgr.needs_rotation());
1445    }
1446
1447    #[test]
1448    fn test_key_manager_rotate_resets_last_rotation() {
1449        let mgr = KeyManager::new(b"k".to_vec()).with_rotation_interval(Duration::from_millis(1));
1450        std::thread::sleep(Duration::from_millis(5));
1451        assert!(mgr.needs_rotation());
1452        mgr.rotate(b"k2".to_vec()).unwrap();
1453        // 轮换后应不再立即需要轮换
1454        assert!(!mgr.needs_rotation());
1455    }
1456
1457    #[test]
1458    fn test_key_manager_concurrent_access() {
1459        use std::sync::Arc;
1460        use std::thread;
1461        let mgr = Arc::new(KeyManager::new(b"base".to_vec()));
1462        let mut handles = vec![];
1463        // 并发读
1464        for _ in 0..4 {
1465            let m = mgr.clone();
1466            handles.push(thread::spawn(move || {
1467                let _ = m.current_key();
1468                let _ = m.previous_count();
1469            }));
1470        }
1471        for h in handles {
1472            h.join().expect("thread panicked");
1473        }
1474        // 并发读不应改变状态
1475        assert_eq!(mgr.current_key().version, 1);
1476    }
1477}
sz_orm_crypto/lib.rs

sz_orm_crypto/
lib.rs
