Release Crypto Tools 0.2.0

tests/crypto/pkcs12.test.ts

@@ -0,0 +1,127 @@
+import { describe, expect, it } from "vitest";
+import { inspectCryptoInput } from "../../src/crypto/inspection";
+import { inspectPkcs12 } from "../../src/crypto/pkcs12";
+import {
+  EMPTY_PASSWORD_PFX_BASE64,
+  LEGACY_PFX_BASE64,
+  MODERN_PFX_PASSWORD,
+  pfxFixture,
+} from "../fixtures/pkcs12";
+
+describe("bounded PKCS #12 inspection", () => {
+  it("inventories supported content without silently using a password", async () => {
+    const result = await inspectPkcs12(pfxFixture());
+    expect(result.mac).toMatchObject({
+      present: true,
+      status: "password-required",
+      algorithm: "SHA-256",
+      iterations: 2_048,
+    });
+    expect(result.contents).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({
+          type: "encryptedData",
+          state: "password-required",
+        }),
+        expect.objectContaining({ type: "data", state: "parsed" }),
+      ]),
+    );
+    expect(result.bags).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({
+          bagType: "shrouded-private-key",
+          friendlyName: "Local test identity",
+          state: "password-required",
+        }),
+      ]),
+    );
+  });
+
+  it("verifies MacData and decrypts PBES2 SafeContents/key bags", async () => {
+    const result = await inspectPkcs12(pfxFixture(), {
+      password: MODERN_PFX_PASSWORD,
+    });
+    expect(result.mac.status).toBe("verified");
+    expect(result.contents.every((content) => content.state === "parsed")).toBe(
+      true,
+    );
+    expect(result.bags).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({
+          bagType: "certificate",
+          friendlyName: "Local test identity",
+        }),
+        expect.objectContaining({
+          bagType: "shrouded-private-key",
+          state: "inspected",
+          key: expect.objectContaining({ algorithm: "RSA" }),
+        }),
+      ]),
+    );
+  });
+
+  it("distinguishes explicit empty passwords from password omission", async () => {
+    const bytes = pfxFixture(EMPTY_PASSWORD_PFX_BASE64);
+    expect((await inspectPkcs12(bytes)).mac.status).toBe("password-required");
+    const inspected = await inspectPkcs12(bytes, { password: "" });
+    expect(inspected.mac.status).toBe("verified");
+    expect(
+      inspected.bags.some(
+        (bag) =>
+          bag.bagType === "shrouded-private-key" &&
+          bag.state === "inspected" &&
+          bag.key?.algorithm === "RSA",
+      ),
+    ).toBe(true);
+  });
+
+  it("fails closed for wrong passwords, damaged nesting and legacy PBE", async () => {
+    await expect(
+      inspectPkcs12(pfxFixture(), { password: "wrong-password" }),
+    ).rejects.toThrow(/password is incorrect|MacData\/authSafe/u);
+
+    const truncated = pfxFixture().slice(0, -1);
+    await expect(inspectPkcs12(truncated)).rejects.toThrow(
+      /malformed DER|trailing bytes/u,
+    );
+
+    await expect(
+      inspectPkcs12(pfxFixture(LEGACY_PFX_BASE64), {
+        password: MODERN_PFX_PASSWORD,
+      }),
+    ).rejects.toThrow(/legacy PKCS #12 PBE/u);
+
+    await expect(
+      inspectPkcs12(pfxFixture(), { password: "x".repeat(4_097) }),
+    ).rejects.toThrow(/at most 4,096 UTF-16 units/u);
+  });
+
+  it("integrates bag and certificate inventory without reporting secrets", async () => {
+    const result = await inspectCryptoInput(pfxFixture(), new Date(), {
+      password: MODERN_PFX_PASSWORD,
+    });
+    expect(result.items[0]).toMatchObject({
+      type: "PKCS #12/PFX",
+      facts: expect.objectContaining({
+        MacData: expect.stringMatching(/Verified/u),
+      }),
+    });
+    expect(result.items.some((item) => item.certificate)).toBe(true);
+    expect(
+      result.items.some((item) =>
+        item.facts["Private-key algorithm"]?.includes("RSA"),
+      ),
+    ).toBe(true);
+    const reportSurface = JSON.stringify(
+      result.items.map(({ id, type, title, facts, findings }) => ({
+        id,
+        type,
+        title,
+        facts,
+        findings,
+      })),
+    );
+    expect(reportSurface).not.toContain(MODERN_PFX_PASSWORD);
+    expect(reportSurface).not.toContain("PRIVATE KEY-----");
+  });
+});