feat: govern legacy archive encryption

tests/test_zip_service.py

@@ -10,7 +10,10 @@ try:
 except ImportError:  # pragma: no cover
     pyzipper = None
 
-from govoplan_campaign.backend.services.zip_service import create_zip_archive
+from govoplan_campaign.backend.services.zip_service import (
+    create_zip_archive,
+    zip_archive_evidence,
+)
 
 
 class ZipServiceTests(unittest.TestCase):
@@ -28,6 +31,20 @@ class ZipServiceTests(unittest.TestCase):
                 self.assertEqual(info.compress_type, zipfile.ZIP_DEFLATED)
                 self.assertTrue(info.flag_bits & 0x1)
                 self.assertEqual(archive.read("message.txt", pwd=b"secret"), b"Hello Windows ZIP")
+                with self.assertRaises(RuntimeError):
+                    archive.read("message.txt", pwd=b"wrong-password")
+
+            evidence = zip_archive_evidence(
+                output,
+                [(source, "message.txt")],
+                password_protected=True,
+                method="zip_standard",
+            )
+            self.assertEqual("Legacy ZipCrypto", evidence["format"])
+            self.assertEqual("govoplan-campaign.zipcrypto", evidence["implementation"])
+            self.assertNotIn("password", evidence)
+            self.assertEqual(64, len(str(evidence["archive_sha256"])))
+            self.assertEqual(64, len(str(evidence["members"][0]["sha256"])))
 
     @unittest.skipIf(pyzipper is None, "pyzipper is not installed")
     def test_aes_password_zip_keeps_aes_encryption(self) -> None:
@@ -63,6 +80,18 @@ class ZipServiceTests(unittest.TestCase):
                 self.assertFalse(info.flag_bits & 0x1)
                 self.assertEqual(archive.read("message.txt"), b"Plain ZIP")
 
+    def test_unknown_password_method_fails_without_downgrade_or_output(self) -> None:
+        with tempfile.TemporaryDirectory() as temp_dir:
+            root = Path(temp_dir)
+            source = root / "source.txt"
+            source.write_text("No downgrade", encoding="utf-8")
+            output = root / "unknown.zip"
+
+            with self.assertRaisesRegex(ValueError, "Unsupported"):
+                create_zip_archive(output, [source], "secret", "unknown")
+
+            self.assertFalse(output.exists())
+
 
 if __name__ == "__main__":
     unittest.main()