sz_orm_crypto/
lib.rs

1//! # SZ-ORM Crypto — 加密工具
2//!
3//! 提供常用密码学原语：AES-256-GCM 对称加密、HMAC-SHA256 消息认证码、
4//! PBKDF2 密钥派生与 SHA-256 哈希，所有实现基于 RustCrypto，保证常数时间比较。
5//!
6//! ## 主要函数
7//!
8//! - [`sha256`] / [`sha256_hex`] — SHA-256 哈希
9//! - AES-256-GCM 加解密
10//! - HMAC-SHA256 与 PBKDF2
11
12use std::collections::HashMap;
13
14use aes_gcm::aead::{Aead, KeyInit};
15use aes_gcm::{Aes256Gcm, Key, Nonce};
16use hmac::{Hmac, Mac};
17use pbkdf2::pbkdf2_hmac;
18use rand::rngs::OsRng;
19use rand::RngCore;
20use sha2::{Digest, Sha256};
21use subtle::ConstantTimeEq;
22
23type HmacSha256 = Hmac<Sha256>;
24
25// ============================================================================
26// SHA-256 (基于 RustCrypto sha2 crate, FIPS 180-4)
27// ============================================================================
28
29/// 计算 SHA-256 哈希（基于 RustCrypto sha2）
30pub fn sha256(data: &[u8]) -> [u8; 32] {
31    let mut hasher = Sha256::new();
32    hasher.update(data);
33    let result = hasher.finalize();
34    let mut out = [0u8; 32];
35    out.copy_from_slice(&result);
36    out
37}
38
39/// 计算 SHA-256 并返回十六进制字符串
40pub fn sha256_hex(data: &[u8]) -> String {
41    sha256(data).iter().map(|b| format!("{:02x}", b)).collect()
42}
43
44/// HMAC-SHA256 (RFC 2104, 基于 RustCrypto hmac crate)
45pub fn hmac_sha256(key: &[u8], message: &[u8]) -> [u8; 32] {
46    // HMAC-SHA256 按 RFC 2104 接受任意长度 key，RustCrypto 的 new_from_slice 对 HMAC 永远返回 Ok。
47    // 用 match 处理避免 panic，虽然 Err 分支不可达（RustCrypto 不变量保证）。
48    let mut mac = match <HmacSha256 as Mac>::new_from_slice(key) {
49        Ok(m) => m,
50        Err(_) => {
51            // 不可达分支：HMAC 规范允许任意 key 长度，RustCrypto 内部会先 hash 过长 key。
52            // 为安全起见返回全零（调用方在正常路径下永远不会命中此分支）。
53            return [0u8; 32];
54        }
55    };
56    mac.update(message);
57    let result = mac.finalize().into_bytes();
58    let mut out = [0u8; 32];
59    out.copy_from_slice(&result);
60    out
61}
62
63/// HMAC-SHA256 十六进制字符串
64pub fn hmac_sha256_hex(key: &[u8], message: &[u8]) -> String {
65    hmac_sha256(key, message)
66        .iter()
67        .map(|b| format!("{:02x}", b))
68        .collect()
69}
70
71/// 常量时间比较（基于 subtle crate），避免时序攻击
72fn constant_time_eq(a: &[u8], b: &[u8]) -> bool {
73    a.ct_eq(b).into()
74}
75
76// ============================================================================
77// 加密器
78// ============================================================================
79
80pub trait Crypter: Send + Sync {
81    fn encrypt(&self, plaintext: &[u8]) -> Result<Vec<u8>, CryptoError>;
82    fn decrypt(&self, ciphertext: &[u8]) -> Result<Vec<u8>, CryptoError>;
83}
84
85/// AES-256-GCM 加密器（密码学安全）
86///
87/// 使用 AES-256-GCM AEAD 算法，每次加密生成随机 12 字节 nonce。
88/// 密文格式：`nonce(12) || ciphertext || tag(16)`（由 aes-gcm crate 内部处理）。
89pub struct AesGcmCrypter {
90    cipher: Aes256Gcm,
91}
92
93impl AesGcmCrypter {
94    /// 从 32 字节密钥创建
95    pub fn new(key: &[u8; 32]) -> Self {
96        let key = Key::<Aes256Gcm>::from_slice(key);
97        Self {
98            cipher: Aes256Gcm::new(key),
99        }
100    }
101
102    /// 从任意长度密钥字符串创建（SHA-256 派生 32 字节密钥）
103    pub fn from_key_str(key: &str) -> Self {
104        let hash = sha256(key.as_bytes());
105        Self::new(&hash)
106    }
107
108    fn random_nonce() -> [u8; 12] {
109        let mut nonce = [0u8; 12];
110        OsRng.fill_bytes(&mut nonce);
111        nonce
112    }
113}
114
115impl Crypter for AesGcmCrypter {
116    fn encrypt(&self, plaintext: &[u8]) -> Result<Vec<u8>, CryptoError> {
117        self.encrypt_with_aad(plaintext, &[])
118    }
119
120    fn decrypt(&self, ciphertext: &[u8]) -> Result<Vec<u8>, CryptoError> {
121        self.decrypt_with_aad(ciphertext, &[])
122    }
123}
124
125impl AesGcmCrypter {
126    /// AES-GCM 认证加密（带附加认证数据 AAD）
127    ///
128    /// 密文格式：`nonce(12) || ciphertext || tag(16)`
129    /// AAD（Additional Authenticated Data）不包含在密文中，但参与认证标签计算，
130    /// 解密时必须提供相同的 AAD 才能成功。
131    pub fn encrypt_with_aad(&self, plaintext: &[u8], aad: &[u8]) -> Result<Vec<u8>, CryptoError> {
132        let nonce_bytes = Self::random_nonce();
133        let nonce = Nonce::from_slice(&nonce_bytes);
134        let payload = aes_gcm::aead::Payload {
135            msg: plaintext,
136            aad,
137        };
138        let ciphertext = self
139            .cipher
140            .encrypt(nonce, payload)
141            .map_err(|e| CryptoError::EncryptionFailed(e.to_string()))?;
142        let mut result = Vec::with_capacity(12 + ciphertext.len());
143        result.extend_from_slice(&nonce_bytes);
144        result.extend_from_slice(&ciphertext);
145        Ok(result)
146    }
147
148    /// AES-GCM 认证解密（带附加认证数据 AAD）
149    ///
150    /// 必须提供与加密时相同的 AAD，否则认证标签校验失败。
151    pub fn decrypt_with_aad(&self, ciphertext: &[u8], aad: &[u8]) -> Result<Vec<u8>, CryptoError> {
152        if ciphertext.len() < 12 {
153            return Err(CryptoError::DecryptionFailed(
154                "Ciphertext too short".to_string(),
155            ));
156        }
157        let nonce = Nonce::from_slice(&ciphertext[..12]);
158        let encrypted = &ciphertext[12..];
159        let payload = aes_gcm::aead::Payload {
160            msg: encrypted,
161            aad,
162        };
163        self.cipher
164            .decrypt(nonce, payload)
165            .map_err(|e| CryptoError::DecryptionFailed(e.to_string()))
166    }
167}
168
169// ============================================================================
170// 密码哈希
171// ============================================================================
172
173pub trait PasswordHasher: Send + Sync {
174    fn hash(&self, password: &str) -> Result<String, CryptoError>;
175    fn verify(&self, password: &str, hash: &str) -> Result<bool, CryptoError>;
176}
177
178/// PBKDF2-HMAC-SHA256 密码哈希器（基于 RustCrypto pbkdf2 crate）
179///
180/// 使用 PBKDF2-HMAC-SHA256 算法（RFC 8018）。
181/// 哈希格式：`$<iterations>$<salt_hex>$<hash_hex>`
182pub struct Pbkdf2Hasher {
183    iterations: u32,
184}
185
186impl Pbkdf2Hasher {
187    const DEFAULT_ITERATIONS: u32 = 100_000;
188    const SALT_LEN: usize = 16;
189    const HASH_LEN: usize = 32;
190
191    pub fn new() -> Self {
192        Self {
193            iterations: Self::DEFAULT_ITERATIONS,
194        }
195    }
196
197    pub fn with_iterations(iterations: u32) -> Self {
198        Self {
199            iterations: iterations.max(1),
200        }
201    }
202
203    fn compute_hash(password: &str, salt: &[u8], iterations: u32) -> [u8; Self::HASH_LEN] {
204        let mut out = [0u8; Self::HASH_LEN];
205        pbkdf2_hmac::<Sha256>(password.as_bytes(), salt, iterations, &mut out);
206        out
207    }
208}
209
210impl Default for Pbkdf2Hasher {
211    fn default() -> Self {
212        Self::new()
213    }
214}
215
216impl PasswordHasher for Pbkdf2Hasher {
217    fn hash(&self, password: &str) -> Result<String, CryptoError> {
218        if password.is_empty() {
219            return Err(CryptoError::InvalidHash(
220                "Password cannot be empty".to_string(),
221            ));
222        }
223        let salt = random_bytes(Self::SALT_LEN);
224        let hash = Self::compute_hash(password, &salt, self.iterations);
225        Ok(format!(
226            "${}${}${}",
227            self.iterations,
228            hex_encode(&salt),
229            hex_encode(&hash)
230        ))
231    }
232
233    fn verify(&self, password: &str, hash: &str) -> Result<bool, CryptoError> {
234        if !hash.starts_with('$') {
235            return Err(CryptoError::InvalidHash("Invalid hash format".to_string()));
236        }
237        let parts: Vec<&str> = hash[1..].splitn(3, '$').collect();
238        if parts.len() != 3 {
239            return Err(CryptoError::InvalidHash("Invalid hash format".to_string()));
240        }
241        let iterations: u32 = parts[0]
242            .parse()
243            .map_err(|_| CryptoError::InvalidHash("Invalid iterations".to_string()))?;
244        let salt = hex_decode(parts[1])
245            .map_err(|_| CryptoError::InvalidHash("Invalid salt hex".to_string()))?;
246        let expected_hash = hex_decode(parts[2])
247            .map_err(|_| CryptoError::InvalidHash("Invalid hash hex".to_string()))?;
248        let computed = Self::compute_hash(password, &salt, iterations);
249        Ok(constant_time_eq(&computed, &expected_hash))
250    }
251}
252
253// ============================================================================
254// API 签名
255// ============================================================================
256
257pub trait ApiSigner: Send + Sync {
258    fn sign(&self, params: &HashMap<String, String>, secret: &str) -> String;
259    fn verify(&self, params: &HashMap<String, String>, secret: &str, signature: &str) -> bool;
260}
261
262/// HMAC-SHA256 API 签名器
263///
264/// 对参数按字典序排序后拼接成 query string，再用 HMAC-SHA256 签名。
265pub struct HmacSigner;
266
267impl HmacSigner {
268    pub fn new() -> Self {
269        Self
270    }
271
272    fn compute_signature(params: &HashMap<String, String>, secret: &str) -> String {
273        let mut sorted: Vec<_> = params.iter().collect();
274        sorted.sort_by(|a, b| a.0.cmp(b.0));
275
276        let query_string: String = sorted
277            .iter()
278            .map(|(k, v)| format!("{}={}", k, v))
279            .collect::<Vec<_>>()
280            .join("&");
281
282        hmac_sha256_hex(secret.as_bytes(), query_string.as_bytes())
283    }
284}
285
286impl Default for HmacSigner {
287    fn default() -> Self {
288        Self::new()
289    }
290}
291
292impl ApiSigner for HmacSigner {
293    fn sign(&self, params: &HashMap<String, String>, secret: &str) -> String {
294        Self::compute_signature(params, secret)
295    }
296
297    fn verify(&self, params: &HashMap<String, String>, secret: &str, signature: &str) -> bool {
298        let computed = Self::compute_signature(params, secret);
299        constant_time_eq(computed.as_bytes(), signature.as_bytes())
300    }
301}
302
303// ============================================================================
304// RSA-OAEP 非对称加密
305// ============================================================================
306
307use rsa::oaep::Oaep;
308use rsa::{RsaPrivateKey, RsaPublicKey};
309use sha2::Sha256 as RsaSha256;
310
311/// RSA-OAEP 非对称加密器（基于 RustCrypto `rsa` crate）
312///
313/// 使用 RSA-OAEP with SHA-256 和 MGF1-SHA256 填充方案。
314/// 公钥加密，私钥解密，适用于小数据（如密钥交换、短消息加密）。
315pub struct RsaOaepCrypter {
316    public_key: RsaPublicKey,
317    private_key: RsaPrivateKey,
318}
319
320impl RsaOaepCrypter {
321    /// 生成新的 RSA 密钥对（指定位数，推荐 2048 或 3072）
322    pub fn generate(key_bits: usize) -> Result<Self, CryptoError> {
323        let mut rng = OsRng;
324        let private_key = RsaPrivateKey::new(&mut rng, key_bits)
325            .map_err(|e| CryptoError::InvalidKey(e.to_string()))?;
326        let public_key = RsaPublicKey::from(&private_key);
327        Ok(Self {
328            public_key,
329            private_key,
330        })
331    }
332
333    /// 从已有密钥对创建
334    pub fn from_keys(public_key: RsaPublicKey, private_key: RsaPrivateKey) -> Self {
335        Self {
336            public_key,
337            private_key,
338        }
339    }
340
341    /// 返回公钥引用
342    pub fn public_key(&self) -> &RsaPublicKey {
343        &self.public_key
344    }
345
346    /// 返回私钥引用
347    pub fn private_key(&self) -> &RsaPrivateKey {
348        &self.private_key
349    }
350
351    /// 使用公钥加密数据（RSA-OAEP with SHA-256）
352    pub fn encrypt(&self, plaintext: &[u8]) -> Result<Vec<u8>, CryptoError> {
353        let mut rng = OsRng;
354        let padding = Oaep::new::<RsaSha256>();
355        self.public_key
356            .encrypt(&mut rng, padding, plaintext)
357            .map_err(|e| CryptoError::EncryptionFailed(e.to_string()))
358    }
359
360    /// 使用私钥解密数据（RSA-OAEP with SHA-256）
361    pub fn decrypt(&self, ciphertext: &[u8]) -> Result<Vec<u8>, CryptoError> {
362        let padding = Oaep::new::<RsaSha256>();
363        self.private_key
364            .decrypt(padding, ciphertext)
365            .map_err(|e| CryptoError::DecryptionFailed(e.to_string()))
366    }
367}
368
369impl Crypter for RsaOaepCrypter {
370    fn encrypt(&self, plaintext: &[u8]) -> Result<Vec<u8>, CryptoError> {
371        self.encrypt(plaintext)
372    }
373
374    fn decrypt(&self, ciphertext: &[u8]) -> Result<Vec<u8>, CryptoError> {
375        self.decrypt(ciphertext)
376    }
377}
378
379// ============================================================================
380// HMAC-SHA256 签名验证器
381// ============================================================================
382
383/// 签名验证器 trait：提供消息签名与验证接口
384pub trait SignatureVerifier: Send + Sync {
385    /// 对消息生成签名
386    fn sign(&self, message: &[u8]) -> Vec<u8>;
387    /// 验证消息签名（常量时间比较）
388    fn verify(&self, message: &[u8], signature: &[u8]) -> bool;
389}
390
391/// HMAC-SHA256 签名验证器
392///
393/// 使用 HMAC-SHA256 算法对消息签名，验证时采用常量时间比较防止时序攻击。
394pub struct HmacSignatureVerifier {
395    key: Vec<u8>,
396}
397
398impl HmacSignatureVerifier {
399    /// 创建签名验证器，从任意长度密钥派生
400    pub fn new(key: &[u8]) -> Self {
401        Self { key: key.to_vec() }
402    }
403
404    /// 从字符串密钥创建
405    pub fn from_key_str(key: &str) -> Self {
406        Self::new(key.as_bytes())
407    }
408}
409
410impl SignatureVerifier for HmacSignatureVerifier {
411    fn sign(&self, message: &[u8]) -> Vec<u8> {
412        hmac_sha256(&self.key, message).to_vec()
413    }
414
415    fn verify(&self, message: &[u8], signature: &[u8]) -> bool {
416        let expected = self.sign(message);
417        constant_time_eq(&expected, signature)
418    }
419}
420
421// ============================================================================
422// 密钥轮换（Key Rotation）
423// ============================================================================
424
425/// 密钥版本：保存密钥及其版本号和创建时间
426#[derive(Clone)]
427struct KeyVersion {
428    version: u32,
429    key: Vec<u8>,
430    created_at: u64,
431}
432
433/// 密钥轮换管理器
434///
435/// 管理多个版本的密钥，支持：
436/// - 轮换生成新版本密钥
437/// - 用最新密钥签名
438/// - 用任意历史密钥验证（向后兼容）
439/// - 自动淘汰过期密钥
440pub struct KeyRotationManager {
441    keys: Vec<KeyVersion>,
442    current_version: u32,
443    max_versions: usize,
444}
445
446impl KeyRotationManager {
447    /// 创建密钥轮换管理器，指定最大保留版本数
448    pub fn new(max_versions: usize) -> Self {
449        Self {
450            keys: vec![],
451            current_version: 0,
452            max_versions: max_versions.max(1),
453        }
454    }
455
456    /// 初始化首个密钥版本
457    pub fn with_initial_key(key: Vec<u8>) -> Self {
458        let mut mgr = Self::new(3);
459        mgr.rotate_key(key);
460        mgr
461    }
462
463    /// 轮换到新密钥，返回新版本号
464    pub fn rotate_key(&mut self, new_key: Vec<u8>) -> u32 {
465        self.current_version += 1;
466        let now = current_timestamp_secs();
467        self.keys.push(KeyVersion {
468            version: self.current_version,
469            key: new_key,
470            created_at: now,
471        });
472        // 淘汰过期版本
473        while self.keys.len() > self.max_versions {
474            self.keys.remove(0);
475        }
476        self.current_version
477    }
478
479    /// 使用当前（最新）密钥签名
480    pub fn sign(&self, message: &[u8]) -> (u32, Vec<u8>) {
481        if let Some(kv) = self.keys.last() {
482            let sig = hmac_sha256(&kv.key, message).to_vec();
483            (kv.version, sig)
484        } else {
485            (0, vec![])
486        }
487    }
488
489    /// 验证签名（尝试所有保留的密钥版本）
490    pub fn verify(&self, message: &[u8], version: u32, signature: &[u8]) -> bool {
491        for kv in &self.keys {
492            if kv.version == version {
493                let expected = hmac_sha256(&kv.key, message);
494                return constant_time_eq(&expected, signature);
495            }
496        }
497        false
498    }
499
500    /// 返回当前密钥版本号
501    pub fn current_version(&self) -> u32 {
502        self.current_version
503    }
504
505    /// 返回保留的密钥版本数量
506    pub fn version_count(&self) -> usize {
507        self.keys.len()
508    }
509
510    /// 返回所有保留的版本号
511    pub fn versions(&self) -> Vec<u32> {
512        self.keys.iter().map(|kv| kv.version).collect()
513    }
514
515    /// 返回指定版本密钥的创建时间（Unix 秒），不存在返回 None
516    pub fn key_created_at(&self, version: u32) -> Option<u64> {
517        self.keys
518            .iter()
519            .find(|kv| kv.version == version)
520            .map(|kv| kv.created_at)
521    }
522}
523
524fn current_timestamp_secs() -> u64 {
525    use std::time::{SystemTime, UNIX_EPOCH};
526    SystemTime::now()
527        .duration_since(UNIX_EPOCH)
528        .unwrap_or_default()
529        .as_secs()
530}
531
532// ============================================================================
533// 密钥版本管理与轮换（并发安全）
534// ============================================================================
535
536use std::sync::RwLock;
537use std::time::Duration;
538
539/// 默认密钥轮换间隔：90 天
540const DEFAULT_ROTATION_INTERVAL_SECS: u64 = 90 * 24 * 60 * 60;
541
542/// 带版本的密钥
543#[derive(Debug, Clone)]
544pub struct VersionedKey {
545    /// 密钥版本
546    pub version: u32,
547    /// 密钥字节
548    pub key: Vec<u8>,
549    /// 创建时间
550    pub created_at: std::time::SystemTime,
551}
552
553/// 密钥管理器（支持轮换）
554///
555/// 维护一个当前活跃密钥和最多 3 个历史密钥（用于解密过渡期），
556/// 支持按时间间隔自动轮换检查。所有字段使用 `RwLock` 保护，可安全跨线程共享。
557pub struct KeyManager {
558    /// 当前活跃密钥
559    current: RwLock<VersionedKey>,
560    /// 旧密钥列表（用于解密过渡期）
561    previous: RwLock<Vec<VersionedKey>>,
562    /// 密钥轮换间隔
563    rotation_interval: Duration,
564    /// 上次轮换时间
565    last_rotation: RwLock<std::time::SystemTime>,
566}
567
568impl KeyManager {
569    /// 创建密钥管理器，使用给定的初始密钥（版本号从 1 开始）
570    pub fn new(initial_key: Vec<u8>) -> Self {
571        let now = std::time::SystemTime::now();
572        Self {
573            current: RwLock::new(VersionedKey {
574                version: 1,
575                key: initial_key,
576                created_at: now,
577            }),
578            previous: RwLock::new(Vec::new()),
579            rotation_interval: Duration::from_secs(DEFAULT_ROTATION_INTERVAL_SECS),
580            last_rotation: RwLock::new(now),
581        }
582    }
583
584    /// 设置轮换间隔
585    pub fn with_rotation_interval(mut self, interval: Duration) -> Self {
586        self.rotation_interval = interval;
587        self
588    }
589
590    /// 轮换密钥
591    pub fn rotate(&self, new_key: Vec<u8>) -> Result<(), CryptoError> {
592        let mut current = self.current.write().expect("KeyManager lock poisoned");
593        let mut previous = self.previous.write().expect("KeyManager lock poisoned");
594
595        // 将当前密钥移入旧密钥列表
596        previous.push(current.clone());
597
598        // 保留最近 3 个旧密钥
599        if previous.len() > 3 {
600            previous.remove(0);
601        }
602
603        // 设置新密钥
604        *current = VersionedKey {
605            version: current.version + 1,
606            key: new_key,
607            created_at: std::time::SystemTime::now(),
608        };
609
610        *self.last_rotation.write().expect("KeyManager last_rotation lock poisoned") = std::time::SystemTime::now();
611        Ok(())
612    }
613
614    /// 检查是否需要轮换
615    pub fn needs_rotation(&self) -> bool {
616        let last = *self.last_rotation.read().expect("KeyManager last_rotation lock poisoned");
617        std::time::SystemTime::now()
618            .duration_since(last)
619            .map(|d| d >= self.rotation_interval)
620            .unwrap_or(false)
621    }
622
623    /// 获取当前密钥
624    pub fn current_key(&self) -> VersionedKey {
625        self.current.read().expect("KeyManager current lock poisoned").clone()
626    }
627
628    /// 按版本查找密钥
629    pub fn key_by_version(&self, version: u32) -> Option<VersionedKey> {
630        if self.current.read().expect("KeyManager current lock poisoned").version == version {
631            return Some(self.current.read().expect("KeyManager current lock poisoned").clone());
632        }
633        self.previous
634            .read()
635            .expect("KeyManager previous lock poisoned")
636            .iter()
637            .find(|k| k.version == version)
638            .cloned()
639    }
640
641    /// 返回保留的旧密钥数量
642    pub fn previous_count(&self) -> usize {
643        self.previous
644            .read()
645            .expect("KeyManager previous lock poisoned")
646            .len()
647    }
648}
649
650// ============================================================================
651// 辅助函数
652// ============================================================================
653
654fn hex_encode(bytes: &[u8]) -> String {
655    bytes.iter().map(|b| format!("{:02x}", b)).collect()
656}
657
658fn hex_decode(hex: &str) -> Result<Vec<u8>, ()> {
659    if !hex.len().is_multiple_of(2) {
660        return Err(());
661    }
662    (0..hex.len())
663        .step_by(2)
664        .map(|i| u8::from_str_radix(&hex[i..i + 2], 16).map_err(|_| ()))
665        .collect()
666}
667
668fn random_bytes(len: usize) -> Vec<u8> {
669    let mut result = vec![0u8; len];
670    OsRng.fill_bytes(&mut result);
671    result
672}
673
674// ============================================================================
675// 错误类型
676// ============================================================================
677
678#[derive(Debug)]
679pub enum CryptoError {
680    EncryptionFailed(String),
681    DecryptionFailed(String),
682    InvalidKey(String),
683    InvalidNonce(String),
684    InvalidHash(String),
685    SigningFailed(String),
686}
687
688impl std::fmt::Display for CryptoError {
689    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
690        match self {
691            CryptoError::EncryptionFailed(msg) => write!(f, "Encryption failed: {}", msg),
692            CryptoError::DecryptionFailed(msg) => write!(f, "Decryption failed: {}", msg),
693            CryptoError::InvalidKey(msg) => write!(f, "Invalid key: {}", msg),
694            CryptoError::InvalidNonce(msg) => write!(f, "Invalid nonce: {}", msg),
695            CryptoError::InvalidHash(msg) => write!(f, "Invalid hash: {}", msg),
696            CryptoError::SigningFailed(msg) => write!(f, "Signing failed: {}", msg),
697        }
698    }
699}
700
701impl std::error::Error for CryptoError {}
702
703impl serde::Serialize for CryptoError {
704    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
705    where
706        S: serde::Serializer,
707    {
708        serializer.serialize_str(&self.to_string())
709    }
710}
711
712// ============================================================================
713// 测试
714// ============================================================================
715
716#[cfg(test)]
717mod tests {
718    use super::*;
719
720    // --- SHA-256 标准测试向量 (FIPS 180-2 / NIST) ---
721
722    #[test]
723    fn test_sha256_empty() {
724        assert_eq!(
725            sha256_hex(b""),
726            "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
727        );
728    }
729
730    #[test]
731    fn test_sha256_abc() {
732        assert_eq!(
733            sha256_hex(b"abc"),
734            "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad"
735        );
736    }
737
738    #[test]
739    fn test_sha256_hello() {
740        assert_eq!(
741            sha256_hex(b"hello"),
742            "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
743        );
744    }
745
746    #[test]
747    fn test_sha256_long_message() {
748        assert_eq!(
749            sha256_hex(b"abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq"),
750            "248d6a61d20638b8e5c026930c3e6039a33ce45964ff2167f6ecedd419db06c1"
751        );
752    }
753
754    #[test]
755    fn test_sha256_deterministic() {
756        assert_eq!(sha256_hex(b"test"), sha256_hex(b"test"));
757        assert_ne!(sha256_hex(b"test"), sha256_hex(b"Test"));
758    }
759
760    // --- HMAC-SHA256 测试向量 (RFC 4231) ---
761
762    #[test]
763    fn test_hmac_sha256_rfc4231_case1() {
764        let key = vec![0x0bu8; 20];
765        let result = hmac_sha256_hex(&key, b"Hi There");
766        assert_eq!(
767            result,
768            "b0344c61d8db38535ca8afceaf0bf12b881dc200c9833da726e9376c2e32cff7"
769        );
770    }
771
772    #[test]
773    fn test_hmac_sha256_rfc4231_case2() {
774        let result = hmac_sha256_hex(b"Jefe", b"what do ya want for nothing?");
775        assert_eq!(
776            result,
777            "5bdcc146bf60754e6a042426089575c75a003f089d2739839dec58b964ec3843"
778        );
779    }
780
781    #[test]
782    fn test_hmac_sha256_long_key() {
783        let key = vec![0xaau8; 130];
784        let result = hmac_sha256_hex(&key, b"test message");
785        assert_eq!(result.len(), 64);
786        let short_key = vec![0xaau8; 32];
787        let result_short = hmac_sha256_hex(&short_key, b"test message");
788        assert_ne!(result, result_short);
789    }
790
791    #[test]
792    fn test_hmac_sha256_different_messages() {
793        let key = b"secret";
794        assert_ne!(hmac_sha256_hex(key, b"msg1"), hmac_sha256_hex(key, b"msg2"));
795    }
796
797    // --- AesGcmCrypter 测试 ---
798
799    #[test]
800    fn test_aes_gcm_roundtrip() {
801        let key = [0x42u8; 32];
802        let crypter = AesGcmCrypter::new(&key);
803        let plaintext = b"Hello, World!";
804        let encrypted = crypter.encrypt(plaintext).unwrap();
805        let decrypted = crypter.decrypt(&encrypted).unwrap();
806        assert_eq!(decrypted, plaintext);
807    }
808
809    #[test]
810    fn test_aes_gcm_random_nonce_per_encryption() {
811        let key = [0x42u8; 32];
812        let crypter = AesGcmCrypter::new(&key);
813        let plaintext = b"same plaintext";
814        let encrypted1 = crypter.encrypt(plaintext).unwrap();
815        let encrypted2 = crypter.encrypt(plaintext).unwrap();
816        assert_ne!(encrypted1, encrypted2, "随机 nonce 应使密文不同");
817        assert_eq!(crypter.decrypt(&encrypted1).unwrap(), plaintext);
818        assert_eq!(crypter.decrypt(&encrypted2).unwrap(), plaintext);
819    }
820
821    #[test]
822    fn test_aes_gcm_from_key_str() {
823        let crypter = AesGcmCrypter::from_key_str("my-secret-key");
824        let plaintext = b"data to encrypt";
825        let encrypted = crypter.encrypt(plaintext).unwrap();
826        let decrypted = crypter.decrypt(&encrypted).unwrap();
827        assert_eq!(decrypted, plaintext);
828    }
829
830    #[test]
831    fn test_aes_gcm_short_ciphertext() {
832        let key = [0x42u8; 32];
833        let crypter = AesGcmCrypter::new(&key);
834        assert!(crypter.decrypt(&[0u8; 8]).is_err());
835    }
836
837    #[test]
838    fn test_aes_gcm_empty_plaintext() {
839        let key = [0x42u8; 32];
840        let crypter = AesGcmCrypter::new(&key);
841        let encrypted = crypter.encrypt(b"").unwrap();
842        // nonce(12) + tag(16) = 28
843        assert_eq!(encrypted.len(), 28);
844        let decrypted = crypter.decrypt(&encrypted).unwrap();
845        assert_eq!(decrypted, b"");
846    }
847
848    #[test]
849    fn test_aes_gcm_tampered_ciphertext() {
850        let key = [0x42u8; 32];
851        let crypter = AesGcmCrypter::new(&key);
852        let encrypted = crypter.encrypt(b"sensitive data").unwrap();
853        let mut tampered = encrypted.clone();
854        tampered[15] ^= 0x01;
855        assert!(crypter.decrypt(&tampered).is_err());
856    }
857
858    // --- Pbkdf2Hasher 测试 ---
859
860    #[test]
861    fn test_pbkdf2_hasher_hash_format() {
862        let hasher = Pbkdf2Hasher::new();
863        let hash = hasher.hash("password123").unwrap();
864        assert!(hash.starts_with('$'));
865        let parts: Vec<&str> = hash[1..].splitn(3, '$').collect();
866        assert_eq!(parts.len(), 3);
867        assert_eq!(parts[0].parse::<u32>().unwrap(), 100_000);
868        // salt 32 hex chars (16 bytes)
869        assert_eq!(parts[1].len(), 32);
870        // hash 64 hex chars (32 bytes)
871        assert_eq!(parts[2].len(), 64);
872    }
873
874    #[test]
875    fn test_pbkdf2_hasher_verify_correct() {
876        let hasher = Pbkdf2Hasher::new();
877        let hash = hasher.hash("password123").unwrap();
878        assert!(hasher.verify("password123", &hash).unwrap());
879    }
880
881    #[test]
882    fn test_pbkdf2_hasher_verify_wrong() {
883        let hasher = Pbkdf2Hasher::new();
884        let hash = hasher.hash("password123").unwrap();
885        assert!(!hasher.verify("wrongpassword", &hash).unwrap());
886    }
887
888    #[test]
889    fn test_pbkdf2_hasher_different_passwords_different_hashes() {
890        let hasher = Pbkdf2Hasher::new();
891        let h1 = hasher.hash("pass1").unwrap();
892        let h2 = hasher.hash("pass2").unwrap();
893        assert_ne!(h1, h2);
894    }
895
896    #[test]
897    fn test_pbkdf2_hasher_same_password_different_salts() {
898        let hasher = Pbkdf2Hasher::new();
899        let h1 = hasher.hash("same").unwrap();
900        let h2 = hasher.hash("same").unwrap();
901        assert_ne!(h1, h2);
902        assert!(hasher.verify("same", &h1).unwrap());
903        assert!(hasher.verify("same", &h2).unwrap());
904    }
905
906    #[test]
907    fn test_pbkdf2_hasher_invalid_format() {
908        let hasher = Pbkdf2Hasher::new();
909        assert!(hasher.verify("password", "invalid-hash").is_err());
910        assert!(hasher.verify("password", "$abc").is_err());
911        assert!(hasher.verify("password", "$abc$def").is_err());
912    }
913
914    #[test]
915    fn test_pbkdf2_hasher_with_iterations() {
916        let hasher = Pbkdf2Hasher::with_iterations(1000);
917        let hash = hasher.hash("secret").unwrap();
918        let parts: Vec<&str> = hash[1..].splitn(3, '$').collect();
919        assert_eq!(parts[0], "1000");
920        assert!(hasher.verify("secret", &hash).unwrap());
921    }
922
923    #[test]
924    fn test_pbkdf2_hasher_empty_password() {
925        let hasher = Pbkdf2Hasher::new();
926        assert!(hasher.hash("").is_err());
927    }
928
929    // --- HmacSigner 测试 ---
930
931    #[test]
932    fn test_hmac_signer_sign_not_empty() {
933        let signer = HmacSigner::new();
934        let mut params = HashMap::new();
935        params.insert("name".to_string(), "test".to_string());
936        let signature = signer.sign(&params, "secret123");
937        assert_eq!(signature.len(), 64);
938    }
939
940    #[test]
941    fn test_hmac_signer_verify_correct() {
942        let signer = HmacSigner::new();
943        let mut params = HashMap::new();
944        params.insert("name".to_string(), "test".to_string());
945        params.insert("age".to_string(), "25".to_string());
946
947        let signature = signer.sign(&params, "mysecret");
948        assert!(signer.verify(&params, "mysecret", &signature));
949    }
950
951    #[test]
952    fn test_hmac_signer_verify_wrong_secret() {
953        let signer = HmacSigner::new();
954        let mut params = HashMap::new();
955        params.insert("name".to_string(), "test".to_string());
956        let signature = signer.sign(&params, "correctsecret");
957        assert!(!signer.verify(&params, "wrongsecret", &signature));
958    }
959
960    #[test]
961    fn test_hmac_signer_verify_wrong_signature() {
962        let signer = HmacSigner::new();
963        let mut params = HashMap::new();
964        params.insert("name".to_string(), "test".to_string());
965        let valid_sig = signer.sign(&params, "secret");
966        let tampered = if let Some(stripped) = valid_sig.strip_prefix('0') {
967            format!("1{}", stripped)
968        } else {
969            format!("0{}", &valid_sig[1..])
970        };
971        assert!(!signer.verify(&params, "secret", &tampered));
972    }
973
974    #[test]
975    fn test_hmac_signer_different_params_different_signatures() {
976        let signer = HmacSigner::new();
977        let mut params1 = HashMap::new();
978        params1.insert("a".to_string(), "1".to_string());
979
980        let mut params2 = HashMap::new();
981        params2.insert("b".to_string(), "2".to_string());
982
983        let sig1 = signer.sign(&params1, "secret");
984        let sig2 = signer.sign(&params2, "secret");
985        assert_ne!(sig1, sig2);
986    }
987
988    #[test]
989    fn test_hmac_signer_param_order_independent() {
990        let signer = HmacSigner::new();
991        let mut params1 = HashMap::new();
992        params1.insert("b".to_string(), "2".to_string());
993        params1.insert("a".to_string(), "1".to_string());
994
995        let mut params2 = HashMap::new();
996        params2.insert("a".to_string(), "1".to_string());
997        params2.insert("b".to_string(), "2".to_string());
998
999        let sig1 = signer.sign(&params1, "secret");
1000        let sig2 = signer.sign(&params2, "secret");
1001        assert_eq!(sig1, sig2);
1002    }
1003
1004    #[test]
1005    fn test_hmac_signer_empty_params() {
1006        let signer = HmacSigner::new();
1007        let params = HashMap::new();
1008        let sig = signer.sign(&params, "secret");
1009        assert_eq!(sig.len(), 64);
1010        assert!(signer.verify(&params, "secret", &sig));
1011    }
1012
1013    // --- 辅助函数测试 ---
1014
1015    #[test]
1016    fn test_random_bytes_length() {
1017        assert_eq!(random_bytes(0).len(), 0);
1018        assert_eq!(random_bytes(16).len(), 16);
1019        assert_eq!(random_bytes(100).len(), 100);
1020    }
1021
1022    #[test]
1023    fn test_random_bytes_random() {
1024        let a = random_bytes(32);
1025        let b = random_bytes(32);
1026        assert_ne!(a, b, "随机字节序列应不同");
1027    }
1028
1029    #[test]
1030    fn test_constant_time_eq() {
1031        assert!(constant_time_eq(b"abc", b"abc"));
1032        assert!(!constant_time_eq(b"abc", b"abd"));
1033        assert!(!constant_time_eq(b"abc", b"ab"));
1034        assert!(!constant_time_eq(b"abc", b"abcd"));
1035        assert!(constant_time_eq(b"", b""));
1036    }
1037
1038    #[test]
1039    fn test_hex_encode_decode_roundtrip() {
1040        let original = vec![0x00, 0xff, 0xab, 0x42];
1041        let encoded = hex_encode(&original);
1042        let decoded = hex_decode(&encoded).unwrap();
1043        assert_eq!(decoded, original);
1044    }
1045
1046    #[test]
1047    fn test_hex_decode_invalid() {
1048        assert!(hex_decode("abc").is_err());
1049        assert!(hex_decode("xy").is_err());
1050    }
1051
1052    // ===== AES-GCM AAD 测试 =====
1053
1054    #[test]
1055    fn test_aes_gcm_aad_roundtrip() {
1056        let key = [0x42u8; 32];
1057        let crypter = AesGcmCrypter::new(&key);
1058        let plaintext = b"sensitive data";
1059        let aad = b"associated metadata";
1060        let encrypted = crypter.encrypt_with_aad(plaintext, aad).unwrap();
1061        let decrypted = crypter.decrypt_with_aad(&encrypted, aad).unwrap();
1062        assert_eq!(decrypted, plaintext);
1063    }
1064
1065    #[test]
1066    fn test_aes_gcm_aad_wrong_aad_fails() {
1067        let key = [0x42u8; 32];
1068        let crypter = AesGcmCrypter::new(&key);
1069        let plaintext = b"sensitive data";
1070        let aad = b"correct aad";
1071        let encrypted = crypter.encrypt_with_aad(plaintext, aad).unwrap();
1072        // 使用错误的 AAD 解密应失败
1073        let result = crypter.decrypt_with_aad(&encrypted, b"wrong aad");
1074        assert!(result.is_err());
1075    }
1076
1077    #[test]
1078    fn test_aes_gcm_aad_empty_aad_equivalent_to_no_aad() {
1079        let key = [0x42u8; 32];
1080        let crypter = AesGcmCrypter::new(&key);
1081        let plaintext = b"test data";
1082        // 空 AAD 等价于无 AAD
1083        let encrypted_no_aad = crypter.encrypt(plaintext).unwrap();
1084        let encrypted_empty_aad = crypter.encrypt_with_aad(plaintext, b"").unwrap();
1085        // 两者都应能解密
1086        assert_eq!(crypter.decrypt(&encrypted_no_aad).unwrap(), plaintext);
1087        assert_eq!(
1088            crypter.decrypt_with_aad(&encrypted_empty_aad, b"").unwrap(),
1089            plaintext
1090        );
1091    }
1092
1093    #[test]
1094    fn test_aes_gcm_aad_tampered_ciphertext_fails() {
1095        let key = [0x42u8; 32];
1096        let crypter = AesGcmCrypter::new(&key);
1097        let encrypted = crypter.encrypt_with_aad(b"data", b"aad").unwrap();
1098        let mut tampered = encrypted.clone();
1099        tampered[15] ^= 0x01;
1100        assert!(crypter.decrypt_with_aad(&tampered, b"aad").is_err());
1101    }
1102
1103    #[test]
1104    fn test_aes_gcm_aad_empty_plaintext() {
1105        let key = [0x42u8; 32];
1106        let crypter = AesGcmCrypter::new(&key);
1107        let encrypted = crypter.encrypt_with_aad(b"", b"aad").unwrap();
1108        // nonce(12) + tag(16) = 28
1109        assert_eq!(encrypted.len(), 28);
1110        let decrypted = crypter.decrypt_with_aad(&encrypted, b"aad").unwrap();
1111        assert_eq!(decrypted, b"");
1112    }
1113
1114    // ===== RSA-OAEP 测试 =====
1115
1116    #[test]
1117    fn test_rsa_oaep_roundtrip() {
1118        let crypter = RsaOaepCrypter::generate(2048).expect("RSA key generation");
1119        let plaintext = b"Hello, RSA-OAEP!";
1120        let encrypted = crypter.encrypt(plaintext).unwrap();
1121        let decrypted = crypter.decrypt(&encrypted).unwrap();
1122        assert_eq!(decrypted, plaintext);
1123    }
1124
1125    #[test]
1126    fn test_rsa_oaep_different_ciphertexts_same_plaintext() {
1127        let crypter = RsaOaepCrypter::generate(2048).unwrap();
1128        let plaintext = b"same message";
1129        let enc1 = crypter.encrypt(plaintext).unwrap();
1130        let enc2 = crypter.encrypt(plaintext).unwrap();
1131        // OAEP 使用随机填充，相同明文应产生不同密文
1132        assert_ne!(enc1, enc2);
1133        // 但两者都能正确解密
1134        assert_eq!(crypter.decrypt(&enc1).unwrap(), plaintext);
1135        assert_eq!(crypter.decrypt(&enc2).unwrap(), plaintext);
1136    }
1137
1138    #[test]
1139    fn test_rsa_oaep_empty_plaintext() {
1140        let crypter = RsaOaepCrypter::generate(2048).unwrap();
1141        let encrypted = crypter.encrypt(b"").unwrap();
1142        let decrypted = crypter.decrypt(&encrypted).unwrap();
1143        assert_eq!(decrypted, b"");
1144    }
1145
1146    #[test]
1147    fn test_rsa_oaep_tampered_ciphertext_fails() {
1148        let crypter = RsaOaepCrypter::generate(2048).unwrap();
1149        let encrypted = crypter.encrypt(b"secret").unwrap();
1150        let mut tampered = encrypted.clone();
1151        tampered[0] ^= 0x01;
1152        assert!(crypter.decrypt(&tampered).is_err());
1153    }
1154
1155    #[test]
1156    fn test_rsa_oaep_max_message_length() {
1157        // 2048-bit RSA-OAEP with SHA-256: max message = 2048/8 - 2*32 - 2 = 190 bytes
1158        let crypter = RsaOaepCrypter::generate(2048).unwrap();
1159        let plaintext = vec![0xABu8; 190];
1160        let encrypted = crypter.encrypt(&plaintext).unwrap();
1161        let decrypted = crypter.decrypt(&encrypted).unwrap();
1162        assert_eq!(decrypted, plaintext);
1163    }
1164
1165    #[test]
1166    fn test_rsa_oaep_oversized_message_fails() {
1167        let crypter = RsaOaepCrypter::generate(2048).unwrap();
1168        // 超过最大消息长度（190 字节 + 1）
1169        let plaintext = vec![0xABu8; 191];
1170        assert!(crypter.encrypt(&plaintext).is_err());
1171    }
1172
1173    #[test]
1174    fn test_rsa_oaep_from_keys() {
1175        let crypter1 = RsaOaepCrypter::generate(2048).unwrap();
1176        let crypter2 = RsaOaepCrypter::from_keys(
1177            crypter1.public_key().clone(),
1178            crypter1.private_key().clone(),
1179        );
1180        let plaintext = b"test from_keys";
1181        let encrypted = crypter2.encrypt(plaintext).unwrap();
1182        let decrypted = crypter2.decrypt(&encrypted).unwrap();
1183        assert_eq!(decrypted, plaintext);
1184    }
1185
1186    #[test]
1187    fn test_rsa_oaep_crypter_trait() {
1188        let crypter = RsaOaepCrypter::generate(2048).unwrap();
1189        let plaintext = b"trait test";
1190        let encrypted = Crypter::encrypt(&crypter, plaintext).unwrap();
1191        let decrypted = Crypter::decrypt(&crypter, &encrypted).unwrap();
1192        assert_eq!(decrypted, plaintext);
1193    }
1194
1195    // ===== HMAC 签名验证器测试 =====
1196
1197    #[test]
1198    fn test_hmac_signature_verifier_sign_verify() {
1199        let verifier = HmacSignatureVerifier::new(b"my-secret-key");
1200        let message = b"important message";
1201        let signature = verifier.sign(message);
1202        assert_eq!(signature.len(), 32);
1203        assert!(verifier.verify(message, &signature));
1204    }
1205
1206    #[test]
1207    fn test_hmac_signature_verifier_wrong_message() {
1208        let verifier = HmacSignatureVerifier::new(b"key");
1209        let signature = verifier.sign(b"message1");
1210        assert!(!verifier.verify(b"message2", &signature));
1211    }
1212
1213    #[test]
1214    fn test_hmac_signature_verifier_wrong_signature() {
1215        let verifier = HmacSignatureVerifier::new(b"key");
1216        let signature = verifier.sign(b"message");
1217        let mut tampered = signature.clone();
1218        tampered[0] ^= 0x01;
1219        assert!(!verifier.verify(b"message", &tampered));
1220    }
1221
1222    #[test]
1223    fn test_hmac_signature_verifier_from_key_str() {
1224        let verifier = HmacSignatureVerifier::from_key_str("string-key");
1225        let message = b"test";
1226        let sig = verifier.sign(message);
1227        assert!(verifier.verify(message, &sig));
1228    }
1229
1230    #[test]
1231    fn test_hmac_signature_verifier_different_keys_different_signatures() {
1232        let v1 = HmacSignatureVerifier::new(b"key1");
1233        let v2 = HmacSignatureVerifier::new(b"key2");
1234        let message = b"same message";
1235        let sig1 = v1.sign(message);
1236        let sig2 = v2.sign(message);
1237        assert_ne!(sig1, sig2);
1238    }
1239
1240    #[test]
1241    fn test_hmac_signature_verifier_empty_message() {
1242        let verifier = HmacSignatureVerifier::new(b"key");
1243        let sig = verifier.sign(b"");
1244        assert_eq!(sig.len(), 32);
1245        assert!(verifier.verify(b"", &sig));
1246    }
1247
1248    #[test]
1249    fn test_hmac_signature_verifier_wrong_length_signature() {
1250        let verifier = HmacSignatureVerifier::new(b"key");
1251        // 长度不对的签名应验证失败
1252        assert!(!verifier.verify(b"message", b"short"));
1253        assert!(!verifier.verify(b"message", &[]));
1254    }
1255
1256    // ===== 密钥轮换测试 =====
1257
1258    #[test]
1259    fn test_key_rotation_initial_key() {
1260        let mgr = KeyRotationManager::with_initial_key(b"key-v1".to_vec());
1261        assert_eq!(mgr.current_version(), 1);
1262        assert_eq!(mgr.version_count(), 1);
1263        assert_eq!(mgr.versions(), vec![1]);
1264    }
1265
1266    #[test]
1267    fn test_key_rotation_sign_verify_current() {
1268        let mgr = KeyRotationManager::with_initial_key(b"secret-key".to_vec());
1269        let message = b"test message";
1270        let (version, signature) = mgr.sign(message);
1271        assert_eq!(version, 1);
1272        assert!(mgr.verify(message, version, &signature));
1273    }
1274
1275    #[test]
1276    fn test_key_rotation_old_version_still_valid() {
1277        let mut mgr = KeyRotationManager::with_initial_key(b"key-v1".to_vec());
1278        let message = b"persistent message";
1279        let (v1, sig1) = mgr.sign(message);
1280        // 轮换到新密钥
1281        mgr.rotate_key(b"key-v2".to_vec());
1282        let (v2, sig2) = mgr.sign(message);
1283        assert_eq!(v1, 1);
1284        assert_eq!(v2, 2);
1285        // 旧版本签名仍应验证通过
1286        assert!(mgr.verify(message, v1, &sig1));
1287        // 新版本签名也应验证通过
1288        assert!(mgr.verify(message, v2, &sig2));
1289    }
1290
1291    #[test]
1292    fn test_key_rotation_max_versions_evicts_oldest() {
1293        let mut mgr = KeyRotationManager::new(2);
1294        mgr.rotate_key(b"key-v1".to_vec());
1295        mgr.rotate_key(b"key-v2".to_vec());
1296        assert_eq!(mgr.version_count(), 2);
1297        // 第三次轮换应淘汰 v1
1298        mgr.rotate_key(b"key-v3".to_vec());
1299        assert_eq!(mgr.version_count(), 2);
1300        assert_eq!(mgr.versions(), vec![2, 3]);
1301        assert!(!mgr.versions().contains(&1));
1302    }
1303
1304    #[test]
1305    fn test_key_rotation_old_version_evicted_fails_verify() {
1306        let mut mgr = KeyRotationManager::new(2);
1307        mgr.rotate_key(b"key-v1".to_vec());
1308        let message = b"test";
1309        let (v1, sig1) = mgr.sign(message);
1310        mgr.rotate_key(b"key-v2".to_vec());
1311        mgr.rotate_key(b"key-v3".to_vec());
1312        // v1 已被淘汰，验证应失败
1313        assert!(!mgr.verify(message, v1, &sig1));
1314    }
1315
1316    #[test]
1317    fn test_key_rotation_wrong_version_fails() {
1318        let mgr = KeyRotationManager::with_initial_key(b"key".to_vec());
1319        let message = b"test";
1320        let (_, signature) = mgr.sign(message);
1321        // 使用不存在的版本号验证应失败
1322        assert!(!mgr.verify(message, 999, &signature));
1323    }
1324
1325    #[test]
1326    fn test_key_rotation_multiple_rotations() {
1327        let mut mgr = KeyRotationManager::new(5);
1328        for i in 1..=4 {
1329            let key = format!("key-v{}", i);
1330            let version = mgr.rotate_key(key.as_bytes().to_vec());
1331            assert_eq!(version, i as u32);
1332        }
1333        assert_eq!(mgr.current_version(), 4);
1334        assert_eq!(mgr.version_count(), 4);
1335        assert_eq!(mgr.versions(), vec![1, 2, 3, 4]);
1336    }
1337
1338    #[test]
1339    fn test_key_rotation_empty_manager_sign_returns_zero() {
1340        let mgr = KeyRotationManager::new(3);
1341        let (version, sig) = mgr.sign(b"message");
1342        assert_eq!(version, 0);
1343        assert!(sig.is_empty());
1344    }
1345
1346    #[test]
1347    fn test_key_rotation_verify_with_wrong_signature() {
1348        let mgr = KeyRotationManager::with_initial_key(b"key".to_vec());
1349        let message = b"test";
1350        let (version, _) = mgr.sign(message);
1351        let wrong_sig = vec![0u8; 32];
1352        assert!(!mgr.verify(message, version, &wrong_sig));
1353    }
1354
1355    #[test]
1356    fn test_key_rotation_max_versions_min_one() {
1357        // max_versions = 0 应被提升为 1
1358        let mut mgr = KeyRotationManager::new(0);
1359        mgr.rotate_key(b"k1".to_vec());
1360        mgr.rotate_key(b"k2".to_vec());
1361        assert_eq!(mgr.version_count(), 1);
1362        assert_eq!(mgr.versions(), vec![2]);
1363    }
1364
1365    // ===== KeyManager（并发密钥轮换）测试 =====
1366
1367    #[test]
1368    fn test_key_manager_initial_key() {
1369        let mgr = KeyManager::new(b"initial-key".to_vec());
1370        let current = mgr.current_key();
1371        assert_eq!(current.version, 1);
1372        assert_eq!(current.key, b"initial-key");
1373        assert_eq!(mgr.previous_count(), 0);
1374    }
1375
1376    #[test]
1377    fn test_key_manager_rotate_increments_version() {
1378        let mgr = KeyManager::new(b"v1".to_vec());
1379        assert!(mgr.rotate(b"v2".to_vec()).is_ok());
1380        let current = mgr.current_key();
1381        assert_eq!(current.version, 2);
1382        assert_eq!(current.key, b"v2");
1383        assert_eq!(mgr.previous_count(), 1);
1384    }
1385
1386    #[test]
1387    fn test_key_manager_key_by_version_current() {
1388        let mgr = KeyManager::new(b"v1".to_vec());
1389        let found = mgr.key_by_version(1).expect("v1 should exist");
1390        assert_eq!(found.key, b"v1");
1391    }
1392
1393    #[test]
1394    fn test_key_manager_key_by_version_previous() {
1395        let mgr = KeyManager::new(b"v1".to_vec());
1396        mgr.rotate(b"v2".to_vec()).unwrap();
1397        // 旧版本仍可查找
1398        let old = mgr.key_by_version(1).expect("v1 should still be retained");
1399        assert_eq!(old.key, b"v1");
1400        // 新版本也可查找
1401        let new = mgr.key_by_version(2).expect("v2 should exist");
1402        assert_eq!(new.key, b"v2");
1403    }
1404
1405    #[test]
1406    fn test_key_manager_key_by_version_not_found() {
1407        let mgr = KeyManager::new(b"v1".to_vec());
1408        assert!(mgr.key_by_version(999).is_none());
1409    }
1410
1411    #[test]
1412    fn test_key_manager_retains_at_most_three_previous() {
1413        let mgr = KeyManager::new(b"v1".to_vec());
1414        mgr.rotate(b"v2".to_vec()).unwrap();
1415        mgr.rotate(b"v3".to_vec()).unwrap();
1416        mgr.rotate(b"v4".to_vec()).unwrap();
1417        // 3 次轮换后 previous 应有 3 个，再轮换一次应淘汰最早的
1418        assert_eq!(mgr.previous_count(), 3);
1419        mgr.rotate(b"v5".to_vec()).unwrap();
1420        assert_eq!(mgr.previous_count(), 3);
1421        // v1 应已被淘汰
1422        assert!(mgr.key_by_version(1).is_none());
1423        // v2 仍应存在
1424        assert!(mgr.key_by_version(2).is_some());
1425        // 当前版本为 5
1426        assert_eq!(mgr.current_key().version, 5);
1427    }
1428
1429    #[test]
1430    fn test_key_manager_needs_rotation_false_initially() {
1431        let mgr = KeyManager::new(b"k".to_vec());
1432        // 刚创建不应需要轮换
1433        assert!(!mgr.needs_rotation());
1434    }
1435
1436    #[test]
1437    fn test_key_manager_needs_rotation_true_after_interval() {
1438        let mgr = KeyManager::new(b"k".to_vec()).with_rotation_interval(Duration::from_millis(0));
1439        // 间隔为 0，应立即需要轮换
1440        std::thread::sleep(Duration::from_millis(1));
1441        assert!(mgr.needs_rotation());
1442    }
1443
1444    #[test]
1445    fn test_key_manager_with_rotation_interval() {
1446        let mgr = KeyManager::new(b"k".to_vec()).with_rotation_interval(Duration::from_secs(60));
1447        assert!(!mgr.needs_rotation());
1448    }
1449
1450    #[test]
1451    fn test_key_manager_rotate_resets_last_rotation() {
1452        let mgr = KeyManager::new(b"k".to_vec()).with_rotation_interval(Duration::from_millis(1));
1453        std::thread::sleep(Duration::from_millis(5));
1454        assert!(mgr.needs_rotation());
1455        mgr.rotate(b"k2".to_vec()).unwrap();
1456        // 轮换后应不再立即需要轮换
1457        assert!(!mgr.needs_rotation());
1458    }
1459
1460    #[test]
1461    fn test_key_manager_concurrent_access() {
1462        use std::sync::Arc;
1463        use std::thread;
1464        let mgr = Arc::new(KeyManager::new(b"base".to_vec()));
1465        let mut handles = vec![];
1466        // 并发读
1467        for _ in 0..4 {
1468            let m = mgr.clone();
1469            handles.push(thread::spawn(move || {
1470                let _ = m.current_key();
1471                let _ = m.previous_count();
1472            }));
1473        }
1474        for h in handles {
1475            h.join().expect("thread panicked");
1476        }
1477        // 并发读不应改变状态
1478        assert_eq!(mgr.current_key().version, 1);
1479    }
1480}
sz_orm_crypto/lib.rs

sz_orm_crypto/
lib.rs
