v0.3.2 — adopt estate CI: PHPUnit suite + reusable pipeline + governance workflows
- Convert 17 hand-rolled tests to PHPUnit TestCases (tests: stubs pattern) P0 security tests preserved: key-leak/encryption (KeyStoreTest), capture-allowlist/executor-path sentinel (CaptureWriterTest) - Add phpunit.xml.dist + update tests/bootstrap.php (Composer autoloader first) - Add phpunit/phpunit ^9.6 + yoast/phpunit-polyfills ^2.0 to require-dev - composer test -> vendor/bin/phpunit --configuration phpunit.xml.dist - ci.yml: thin caller of peptide-e2e reusable CI (tests: stubs, has_js: true, workflow_call trigger, permissions: contents: write) - deploy.yml: estate pattern caller of peptide-e2e deploy-app.yml@main (target_path: wp-content/plugins/pr-vision, gated on reusable CI) Pull-deploy on Hostinger stays as break-glass - Add cto-review.yml (Haiku-only, A/B panel dropped 2026-06-12) - Add main-push-audit.yml (direct-push tripwire) Agent-Session: claude-adopt-ci-20260616
This commit is contained in:
peptiderepo
162
tests/unit/KeyStoreTest.php
Normal file
162
tests/unit/KeyStoreTest.php
Normal file
@@ -0,0 +1,162 @@
|
||||
<?php
|
||||
/**
|
||||
* Tests for PRV_Key_Store and PRV_Crypto_Helper.
|
||||
*
|
||||
* Covers: encrypt/decrypt round-trip, resolver precedence,
|
||||
* write-only render, and Remove (clear_key).
|
||||
*
|
||||
* Security assertions (P0): plaintext never in stored option,
|
||||
* password input renders with empty value, wrong-key decrypts to empty.
|
||||
*
|
||||
* @package PrVision
|
||||
*/
|
||||
|
||||
declare(strict_types=1);
|
||||
|
||||
use PHPUnit\Framework\TestCase;
|
||||
|
||||
/**
|
||||
* @covers PRV_Key_Store
|
||||
* @covers PRV_Crypto_Helper
|
||||
*/
|
||||
class KeyStoreTest extends TestCase {
|
||||
|
||||
protected function setUp(): void {
|
||||
prv_test_reset();
|
||||
}
|
||||
|
||||
// ── Group 1: PRV_Crypto_Helper encrypt/decrypt round-trip ────────────
|
||||
|
||||
public function test_derive_encryption_key_returns_32_bytes(): void {
|
||||
$key = PRV_Key_Store::derive_encryption_key();
|
||||
$this->assertSame( 32, strlen( $key ), 'derive_encryption_key() returns 32-byte key' );
|
||||
}
|
||||
|
||||
public function test_encrypt_returns_non_empty_and_opaque(): void {
|
||||
$plaintext = 'sk-or-test-key-value-abc123';
|
||||
$enc_key = PRV_Key_Store::derive_encryption_key();
|
||||
$encrypted = PRV_Crypto_Helper::encrypt( $plaintext, $enc_key );
|
||||
|
||||
$this->assertNotEmpty( $encrypted, 'encrypt() returns non-empty string' );
|
||||
$this->assertNotSame( $plaintext, $encrypted, 'encrypt() does not return plaintext' );
|
||||
$this->assertStringNotContainsString( $plaintext, $encrypted, 'Plaintext not visible in ciphertext' );
|
||||
}
|
||||
|
||||
public function test_decrypt_recovers_plaintext(): void {
|
||||
$plaintext = 'sk-or-test-key-value-abc123';
|
||||
$enc_key = PRV_Key_Store::derive_encryption_key();
|
||||
$encrypted = PRV_Crypto_Helper::encrypt( $plaintext, $enc_key );
|
||||
$decrypted = PRV_Crypto_Helper::decrypt( $encrypted, $enc_key );
|
||||
|
||||
$this->assertSame( $plaintext, $decrypted, 'decrypt(encrypt(key)) === original key' );
|
||||
}
|
||||
|
||||
public function test_each_encryption_produces_unique_ciphertext(): void {
|
||||
$plaintext = 'sk-or-test-key-value-abc123';
|
||||
$enc_key = PRV_Key_Store::derive_encryption_key();
|
||||
$ct1 = PRV_Crypto_Helper::encrypt( $plaintext, $enc_key );
|
||||
$ct2 = PRV_Crypto_Helper::encrypt( $plaintext, $enc_key );
|
||||
|
||||
$this->assertNotSame( $ct1, $ct2, 'Two encryptions differ (random nonce)' );
|
||||
$this->assertSame( $plaintext, PRV_Crypto_Helper::decrypt( $ct2, $enc_key ), 'Second ciphertext also decrypts correctly' );
|
||||
}
|
||||
|
||||
public function test_decrypt_rejects_malformed_inputs(): void {
|
||||
$enc_key = PRV_Key_Store::derive_encryption_key();
|
||||
|
||||
$this->assertSame( '', PRV_Crypto_Helper::decrypt( '', $enc_key ), 'decrypt("") returns empty' );
|
||||
$this->assertSame( '', PRV_Crypto_Helper::decrypt( 'garbage', $enc_key ), 'decrypt(garbage) returns empty' );
|
||||
$this->assertSame( '', PRV_Crypto_Helper::decrypt( 'aabb:', $enc_key ), 'decrypt(empty cipher) returns empty' );
|
||||
}
|
||||
|
||||
public function test_decrypt_wrong_key_returns_empty(): void {
|
||||
$plaintext = 'sk-or-test-key-value-abc123';
|
||||
$enc_key = PRV_Key_Store::derive_encryption_key();
|
||||
$encrypted = PRV_Crypto_Helper::encrypt( $plaintext, $enc_key );
|
||||
$wrong_key = hash( 'sha256', 'wrong-salt', true );
|
||||
|
||||
$this->assertSame( '', PRV_Crypto_Helper::decrypt( $encrypted, $wrong_key ), 'decrypt with wrong key returns empty' );
|
||||
}
|
||||
|
||||
// ── Group 2: store_key / clear_key / get_source ──────────────────────
|
||||
|
||||
public function test_get_source_none_when_no_key(): void {
|
||||
$this->assertSame( PRV_Key_Store::SOURCE_NONE, PRV_Key_Store::get_source() );
|
||||
}
|
||||
|
||||
public function test_store_key_writes_encrypted_option(): void {
|
||||
$plaintext = 'sk-or-test-key-value-abc123';
|
||||
$stored = PRV_Key_Store::store_key( $plaintext );
|
||||
|
||||
$this->assertTrue( $stored, 'store_key() returns true on success' );
|
||||
|
||||
$option_val = get_option( PRV_Key_Store::OPTION_ENC, '' );
|
||||
$this->assertNotEmpty( $option_val, 'Option is set after store_key()' );
|
||||
$this->assertNotSame( $plaintext, $option_val, 'Option value is NOT the plaintext key (encrypted at rest)' );
|
||||
$this->assertStringNotContainsString( $plaintext, (string) $option_val, 'Plaintext not in stored option value' );
|
||||
$this->assertStringNotContainsString( 'sk-or-', (string) $option_val, 'Key prefix not in stored option' );
|
||||
$this->assertSame( PRV_Key_Store::SOURCE_OPTION, PRV_Key_Store::get_source() );
|
||||
}
|
||||
|
||||
public function test_clear_key_removes_option(): void {
|
||||
PRV_Key_Store::store_key( 'sk-or-test-key-value-abc123' );
|
||||
PRV_Key_Store::clear_key();
|
||||
|
||||
$this->assertSame( '', get_option( PRV_Key_Store::OPTION_ENC, '' ) );
|
||||
$this->assertSame( PRV_Key_Store::SOURCE_NONE, PRV_Key_Store::get_source() );
|
||||
}
|
||||
|
||||
public function test_store_empty_key_is_noop(): void {
|
||||
$result = PRV_Key_Store::store_key( '' );
|
||||
|
||||
$this->assertFalse( $result, 'store_key("") returns false' );
|
||||
$this->assertSame( '', get_option( PRV_Key_Store::OPTION_ENC, '' ), 'Option unchanged after store_key("")' );
|
||||
}
|
||||
|
||||
// ── Group 3: Resolver precedence — constant > option > none ──────────
|
||||
|
||||
public function test_get_key_returns_empty_with_no_source(): void {
|
||||
$this->assertSame( '', PRV_Key_Store::get_key() );
|
||||
}
|
||||
|
||||
public function test_get_key_returns_decrypted_from_option(): void {
|
||||
$plaintext = 'sk-or-test-key-value-abc123';
|
||||
PRV_Key_Store::store_key( $plaintext );
|
||||
|
||||
$this->assertSame( $plaintext, PRV_Key_Store::get_key() );
|
||||
}
|
||||
|
||||
// ── Group 4: Write-only — key value never in rendered HTML output ─────
|
||||
|
||||
public function test_rendered_html_never_contains_key(): void {
|
||||
$plaintext = 'sk-or-test-key-value-abc123';
|
||||
PRV_Key_Store::store_key( $plaintext );
|
||||
|
||||
require_once PRV_PLUGIN_DIR . 'includes/core/class-prv-settings-page.php';
|
||||
require_once PRV_PLUGIN_DIR . 'includes/core/class-prv-key-manager-renderer.php';
|
||||
|
||||
ob_start();
|
||||
( new PRV_Key_Manager_Renderer() )->render();
|
||||
$html = (string) ob_get_clean();
|
||||
|
||||
$this->assertNotEmpty( $html, 'Key manager card renders non-empty HTML' );
|
||||
$this->assertStringNotContainsString( $plaintext, $html, 'Plaintext key absent from rendered HTML' );
|
||||
$this->assertStringNotContainsString( 'sk-or-test', $html, 'Key value prefix absent from rendered HTML' );
|
||||
$this->assertStringContainsString( 'type="password"', $html, 'Password input is present in output' );
|
||||
$this->assertStringContainsString( 'value=""', $html, 'Password input has empty value attribute' );
|
||||
$this->assertStringNotContainsString( 'value="sk-', $html, 'No key value in any value= attribute' );
|
||||
}
|
||||
|
||||
// ── Group 5: Remove clears the encrypted option ───────────────────────
|
||||
|
||||
public function test_clear_key_empties_option(): void {
|
||||
$plaintext = 'sk-or-test-key-value-abc123';
|
||||
PRV_Key_Store::store_key( $plaintext );
|
||||
|
||||
$this->assertNotEmpty( get_option( PRV_Key_Store::OPTION_ENC, '' ), 'Key present before remove' );
|
||||
|
||||
PRV_Key_Store::clear_key();
|
||||
|
||||
$this->assertSame( '', get_option( PRV_Key_Store::OPTION_ENC, '' ), 'Option empty after clear_key()' );
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user