feat: production-ready domain control dashboard

internal/secure/secure_test.go

@@ -0,0 +1,59 @@
+package secure
+
+import (
+	"encoding/base64"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestCipherRoundTripAndFingerprint(t *testing.T) {
+	t.Parallel()
+	dir := t.TempDir()
+	key := make([]byte, 32)
+	for index := range key {
+		key[index] = byte(index + 1)
+	}
+	path := filepath.Join(dir, "master-key")
+	if err := os.WriteFile(path, []byte(base64.RawStdEncoding.EncodeToString(key)), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	cipher, err := LoadCipher(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	ciphertext, nonce, err := cipher.Encrypt("hetzner-token-value")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(ciphertext) == "hetzner-token-value" {
+		t.Fatal("token was not encrypted")
+	}
+	plaintext, err := cipher.Decrypt(ciphertext, nonce)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if plaintext != "hetzner-token-value" {
+		t.Fatalf("got %q", plaintext)
+	}
+	if cipher.Fingerprint("same") != cipher.Fingerprint("same") || cipher.Fingerprint("same") == cipher.Fingerprint("different") {
+		t.Fatal("fingerprint must be deterministic and token-specific")
+	}
+}
+
+func TestPasswordHash(t *testing.T) {
+	t.Parallel()
+	hash, err := HashPassword("a secure password")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !VerifyPassword(hash, "a secure password") {
+		t.Fatal("expected password verification to succeed")
+	}
+	if VerifyPassword(hash, "wrong password") {
+		t.Fatal("wrong password verified")
+	}
+	if _, err := HashPassword("short"); err == nil {
+		t.Fatal("short password was accepted")
+	}
+}