551e49994d
- Replace KEY import in golden.rs with local constant - Replace KEY import in crypto.rs tests with local TEST_KEY constant - Add --key to all CLI round-trip tests via cmd_with_key() helper - Add test_key_file_roundtrip: pack/unpack with --key-file - Add test_rejects_wrong_key: wrong key causes decryption failure - Add test_rejects_bad_hex: too-short hex produces clear error - Add test_rejects_missing_key: pack without key arg fails - Add test_inspect_without_key: shows header only, not TOC - Add test_inspect_with_key: shows full entry listing - All 47 tests pass (25 unit + 7 golden + 15 integration) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
505 lines
16 KiB
Rust
505 lines
16 KiB
Rust
//! CLI round-trip integration tests.
|
|
//!
|
|
//! Each test runs the actual `encrypted_archive` binary via `assert_cmd`,
|
|
//! packs files into an archive, unpacks them, and verifies byte-identical output.
|
|
//! All tests use `tempdir()` for isolation (auto-cleanup, parallel-safe).
|
|
|
|
use assert_cmd::Command;
|
|
use predicates::prelude::*;
|
|
use std::fs;
|
|
use std::os::unix::fs::PermissionsExt;
|
|
use tempfile::tempdir;
|
|
|
|
/// Hex-encoded 32-byte key for test archives (matches legacy hardcoded key)
|
|
const TEST_KEY_HEX: &str = "7a35c1d94fe82b6a910df358bc74a61e428fd063e5179b2cfa8406cd3e79b550";
|
|
|
|
/// Helper: get a Command for the encrypted_archive binary with --key pre-set.
|
|
fn cmd_with_key() -> Command {
|
|
let mut c = Command::new(assert_cmd::cargo::cargo_bin!("encrypted_archive"));
|
|
c.args(["--key", TEST_KEY_HEX]);
|
|
c
|
|
}
|
|
|
|
/// Helper: get a Command for the encrypted_archive binary without a key.
|
|
fn cmd() -> Command {
|
|
Command::new(assert_cmd::cargo::cargo_bin!("encrypted_archive"))
|
|
}
|
|
|
|
/// Single text file: pack "Hello", unpack, verify byte-identical.
|
|
#[test]
|
|
fn test_roundtrip_single_text_file() {
|
|
let dir = tempdir().unwrap();
|
|
let input_file = dir.path().join("hello.txt");
|
|
let archive = dir.path().join("archive.bin");
|
|
let output_dir = dir.path().join("output");
|
|
|
|
fs::write(&input_file, b"Hello").unwrap();
|
|
|
|
cmd_with_key()
|
|
.args(["pack", input_file.to_str().unwrap(), "-o", archive.to_str().unwrap()])
|
|
.assert()
|
|
.success();
|
|
|
|
cmd_with_key()
|
|
.args(["unpack", archive.to_str().unwrap(), "-o", output_dir.to_str().unwrap()])
|
|
.assert()
|
|
.success();
|
|
|
|
let extracted = fs::read(output_dir.join("hello.txt")).unwrap();
|
|
assert_eq!(extracted, b"Hello");
|
|
}
|
|
|
|
/// Multiple files: pack two files, unpack, verify both byte-identical.
|
|
#[test]
|
|
fn test_roundtrip_multiple_files() {
|
|
let dir = tempdir().unwrap();
|
|
let text_file = dir.path().join("text.txt");
|
|
let binary_file = dir.path().join("binary.dat");
|
|
let archive = dir.path().join("archive.bin");
|
|
let output_dir = dir.path().join("output");
|
|
|
|
fs::write(&text_file, b"Some text content").unwrap();
|
|
fs::write(&binary_file, &[0x42u8; 256]).unwrap();
|
|
|
|
cmd_with_key()
|
|
.args([
|
|
"pack",
|
|
text_file.to_str().unwrap(),
|
|
binary_file.to_str().unwrap(),
|
|
"-o",
|
|
archive.to_str().unwrap(),
|
|
])
|
|
.assert()
|
|
.success();
|
|
|
|
cmd_with_key()
|
|
.args(["unpack", archive.to_str().unwrap(), "-o", output_dir.to_str().unwrap()])
|
|
.assert()
|
|
.success();
|
|
|
|
assert_eq!(
|
|
fs::read(output_dir.join("text.txt")).unwrap(),
|
|
b"Some text content"
|
|
);
|
|
assert_eq!(
|
|
fs::read(output_dir.join("binary.dat")).unwrap(),
|
|
vec![0x42u8; 256]
|
|
);
|
|
}
|
|
|
|
/// Empty file: pack 0-byte file, unpack, verify extracted file is exactly 0 bytes.
|
|
/// This tests PKCS7 full-block padding on 0-byte input (encrypted_size = 16).
|
|
#[test]
|
|
fn test_roundtrip_empty_file() {
|
|
let dir = tempdir().unwrap();
|
|
let input_file = dir.path().join("empty.txt");
|
|
let archive = dir.path().join("archive.bin");
|
|
let output_dir = dir.path().join("output");
|
|
|
|
fs::write(&input_file, b"").unwrap();
|
|
|
|
cmd_with_key()
|
|
.args(["pack", input_file.to_str().unwrap(), "-o", archive.to_str().unwrap()])
|
|
.assert()
|
|
.success();
|
|
|
|
cmd_with_key()
|
|
.args(["unpack", archive.to_str().unwrap(), "-o", output_dir.to_str().unwrap()])
|
|
.assert()
|
|
.success();
|
|
|
|
let extracted = fs::read(output_dir.join("empty.txt")).unwrap();
|
|
assert!(extracted.is_empty(), "Empty file should extract as 0 bytes");
|
|
}
|
|
|
|
/// Cyrillic filename: pack file with UTF-8 non-ASCII name, unpack, verify content.
|
|
/// This tests non-ASCII (UTF-8) filename handling in TOC entries.
|
|
#[test]
|
|
fn test_roundtrip_cyrillic_filename() {
|
|
let dir = tempdir().unwrap();
|
|
let input_file = dir.path().join("файл.txt");
|
|
let archive = dir.path().join("archive.bin");
|
|
let output_dir = dir.path().join("output");
|
|
|
|
let content = "Содержимое".as_bytes();
|
|
fs::write(&input_file, content).unwrap();
|
|
|
|
cmd_with_key()
|
|
.args(["pack", input_file.to_str().unwrap(), "-o", archive.to_str().unwrap()])
|
|
.assert()
|
|
.success();
|
|
|
|
cmd_with_key()
|
|
.args(["unpack", archive.to_str().unwrap(), "-o", output_dir.to_str().unwrap()])
|
|
.assert()
|
|
.success();
|
|
|
|
let extracted = fs::read(output_dir.join("файл.txt")).unwrap();
|
|
assert_eq!(extracted, content);
|
|
}
|
|
|
|
/// Large file (11MB): pack, unpack, verify byte-identical.
|
|
/// Tests large file handling (>10MB) per Phase 3 success criteria.
|
|
#[test]
|
|
fn test_roundtrip_large_file() {
|
|
let dir = tempdir().unwrap();
|
|
let input_file = dir.path().join("large.bin");
|
|
let archive = dir.path().join("archive.bin");
|
|
let output_dir = dir.path().join("output");
|
|
|
|
// Generate 11MB of deterministic pseudo-random data
|
|
let data: Vec<u8> = (0..11_000_000u32)
|
|
.map(|i| i.wrapping_mul(2654435761) as u8)
|
|
.collect();
|
|
fs::write(&input_file, &data).unwrap();
|
|
|
|
// Pack with --no-compress bin (skip compression for binary extension)
|
|
cmd_with_key()
|
|
.args([
|
|
"pack",
|
|
input_file.to_str().unwrap(),
|
|
"-o",
|
|
archive.to_str().unwrap(),
|
|
"--no-compress",
|
|
"bin",
|
|
])
|
|
.assert()
|
|
.success();
|
|
|
|
cmd_with_key()
|
|
.args(["unpack", archive.to_str().unwrap(), "-o", output_dir.to_str().unwrap()])
|
|
.assert()
|
|
.success();
|
|
|
|
let extracted = fs::read(output_dir.join("large.bin")).unwrap();
|
|
assert_eq!(extracted.len(), data.len(), "Extracted file size must match original");
|
|
assert_eq!(extracted, data, "Extracted file content must be byte-identical");
|
|
}
|
|
|
|
/// No-compress flag: pack APK file (auto-detected as no-compress), unpack, verify.
|
|
/// APK extension is in the known compressed extensions list, so compression_flag=0.
|
|
#[test]
|
|
fn test_roundtrip_no_compress_flag() {
|
|
let dir = tempdir().unwrap();
|
|
let input_file = dir.path().join("data.apk");
|
|
let archive = dir.path().join("archive.bin");
|
|
let output_dir = dir.path().join("output");
|
|
|
|
// 100 bytes of pattern data
|
|
let data: Vec<u8> = (0..100u8).collect();
|
|
fs::write(&input_file, &data).unwrap();
|
|
|
|
cmd_with_key()
|
|
.args(["pack", input_file.to_str().unwrap(), "-o", archive.to_str().unwrap()])
|
|
.assert()
|
|
.success();
|
|
|
|
cmd_with_key()
|
|
.args(["unpack", archive.to_str().unwrap(), "-o", output_dir.to_str().unwrap()])
|
|
.assert()
|
|
.success();
|
|
|
|
let extracted = fs::read(output_dir.join("data.apk")).unwrap();
|
|
assert_eq!(extracted, data);
|
|
}
|
|
|
|
/// Directory round-trip: pack a directory tree, unpack, verify files, empty dirs, and permissions.
|
|
#[test]
|
|
fn test_roundtrip_directory() {
|
|
let dir = tempdir().unwrap();
|
|
let testdir = dir.path().join("testdir");
|
|
let subdir = testdir.join("subdir");
|
|
let emptydir = testdir.join("empty");
|
|
let archive = dir.path().join("archive.bin");
|
|
let output_dir = dir.path().join("output");
|
|
|
|
// Create directory structure
|
|
fs::create_dir_all(&subdir).unwrap();
|
|
fs::create_dir_all(&emptydir).unwrap();
|
|
|
|
fs::write(testdir.join("hello.txt"), b"Hello from dir").unwrap();
|
|
fs::write(subdir.join("nested.txt"), b"Nested file").unwrap();
|
|
|
|
// Set specific permissions
|
|
fs::set_permissions(&testdir, fs::Permissions::from_mode(0o755)).unwrap();
|
|
fs::set_permissions(testdir.join("hello.txt"), fs::Permissions::from_mode(0o644)).unwrap();
|
|
fs::set_permissions(&subdir, fs::Permissions::from_mode(0o755)).unwrap();
|
|
fs::set_permissions(subdir.join("nested.txt"), fs::Permissions::from_mode(0o755)).unwrap();
|
|
fs::set_permissions(&emptydir, fs::Permissions::from_mode(0o700)).unwrap();
|
|
|
|
// Pack directory
|
|
cmd_with_key()
|
|
.args(["pack", testdir.to_str().unwrap(), "-o", archive.to_str().unwrap()])
|
|
.assert()
|
|
.success();
|
|
|
|
// Unpack
|
|
cmd_with_key()
|
|
.args(["unpack", archive.to_str().unwrap(), "-o", output_dir.to_str().unwrap()])
|
|
.assert()
|
|
.success();
|
|
|
|
// Verify file contents
|
|
let hello = fs::read(output_dir.join("testdir/hello.txt")).unwrap();
|
|
assert_eq!(hello, b"Hello from dir");
|
|
|
|
let nested = fs::read(output_dir.join("testdir/subdir/nested.txt")).unwrap();
|
|
assert_eq!(nested, b"Nested file");
|
|
|
|
// Verify empty directory exists
|
|
assert!(
|
|
output_dir.join("testdir/empty").is_dir(),
|
|
"Empty directory should be recreated"
|
|
);
|
|
|
|
// Verify permissions
|
|
let nested_mode = fs::metadata(output_dir.join("testdir/subdir/nested.txt"))
|
|
.unwrap()
|
|
.permissions()
|
|
.mode()
|
|
& 0o7777;
|
|
assert_eq!(nested_mode, 0o755, "nested.txt should have mode 0755");
|
|
|
|
let empty_mode = fs::metadata(output_dir.join("testdir/empty"))
|
|
.unwrap()
|
|
.permissions()
|
|
.mode()
|
|
& 0o7777;
|
|
assert_eq!(empty_mode, 0o700, "empty dir should have mode 0700");
|
|
}
|
|
|
|
/// Mixed files and directories: pack both a standalone file and a directory, verify round-trip.
|
|
#[test]
|
|
fn test_roundtrip_mixed_files_and_dirs() {
|
|
let dir = tempdir().unwrap();
|
|
let standalone = dir.path().join("standalone.txt");
|
|
let mydir = dir.path().join("mydir");
|
|
let archive = dir.path().join("archive.bin");
|
|
let output_dir = dir.path().join("output");
|
|
|
|
fs::write(&standalone, b"Standalone").unwrap();
|
|
fs::create_dir_all(&mydir).unwrap();
|
|
fs::write(mydir.join("inner.txt"), b"Inner").unwrap();
|
|
|
|
// Pack both file and directory
|
|
cmd_with_key()
|
|
.args([
|
|
"pack",
|
|
standalone.to_str().unwrap(),
|
|
mydir.to_str().unwrap(),
|
|
"-o",
|
|
archive.to_str().unwrap(),
|
|
])
|
|
.assert()
|
|
.success();
|
|
|
|
// Unpack
|
|
cmd_with_key()
|
|
.args(["unpack", archive.to_str().unwrap(), "-o", output_dir.to_str().unwrap()])
|
|
.assert()
|
|
.success();
|
|
|
|
// Verify both entries
|
|
assert_eq!(
|
|
fs::read(output_dir.join("standalone.txt")).unwrap(),
|
|
b"Standalone"
|
|
);
|
|
assert_eq!(
|
|
fs::read(output_dir.join("mydir/inner.txt")).unwrap(),
|
|
b"Inner"
|
|
);
|
|
}
|
|
|
|
/// Inspect shows directory info: entry type and permissions for directory entries.
|
|
/// Now requires --key to see full TOC listing.
|
|
#[test]
|
|
fn test_inspect_shows_directory_info() {
|
|
let dir = tempdir().unwrap();
|
|
let testdir = dir.path().join("testdir");
|
|
let archive = dir.path().join("archive.bin");
|
|
|
|
fs::create_dir_all(&testdir).unwrap();
|
|
fs::write(testdir.join("file.txt"), b"content").unwrap();
|
|
|
|
cmd_with_key()
|
|
.args(["pack", testdir.to_str().unwrap(), "-o", archive.to_str().unwrap()])
|
|
.assert()
|
|
.success();
|
|
|
|
// Inspect with key: shows full TOC entry listing
|
|
cmd_with_key()
|
|
.args(["inspect", archive.to_str().unwrap()])
|
|
.assert()
|
|
.success()
|
|
.stdout(predicate::str::contains("dir"))
|
|
.stdout(predicate::str::contains("file"))
|
|
.stdout(predicate::str::contains("0755").or(predicate::str::contains("0775")))
|
|
.stdout(predicate::str::contains("Permissions:"));
|
|
}
|
|
|
|
// ========== New tests for key input ==========
|
|
|
|
/// Key file round-trip: create a 32-byte key file, pack with --key-file, unpack with --key-file.
|
|
#[test]
|
|
fn test_key_file_roundtrip() {
|
|
let dir = tempdir().unwrap();
|
|
let input_file = dir.path().join("data.txt");
|
|
let key_file = dir.path().join("test.key");
|
|
let archive = dir.path().join("archive.bin");
|
|
let output_dir = dir.path().join("output");
|
|
|
|
fs::write(&input_file, b"Key file test data").unwrap();
|
|
|
|
// Write a 32-byte key file (raw bytes)
|
|
let key_bytes: [u8; 32] = [
|
|
0x7A, 0x35, 0xC1, 0xD9, 0x4F, 0xE8, 0x2B, 0x6A,
|
|
0x91, 0x0D, 0xF3, 0x58, 0xBC, 0x74, 0xA6, 0x1E,
|
|
0x42, 0x8F, 0xD0, 0x63, 0xE5, 0x17, 0x9B, 0x2C,
|
|
0xFA, 0x84, 0x06, 0xCD, 0x3E, 0x79, 0xB5, 0x50,
|
|
];
|
|
fs::write(&key_file, key_bytes).unwrap();
|
|
|
|
// Pack with --key-file
|
|
cmd()
|
|
.args([
|
|
"--key-file", key_file.to_str().unwrap(),
|
|
"pack", input_file.to_str().unwrap(), "-o", archive.to_str().unwrap(),
|
|
])
|
|
.assert()
|
|
.success();
|
|
|
|
// Unpack with --key-file
|
|
cmd()
|
|
.args([
|
|
"--key-file", key_file.to_str().unwrap(),
|
|
"unpack", archive.to_str().unwrap(), "-o", output_dir.to_str().unwrap(),
|
|
])
|
|
.assert()
|
|
.success();
|
|
|
|
let extracted = fs::read(output_dir.join("data.txt")).unwrap();
|
|
assert_eq!(extracted, b"Key file test data");
|
|
}
|
|
|
|
/// Wrong key: pack with one key, try unpack with different key, expect HMAC failure.
|
|
#[test]
|
|
fn test_rejects_wrong_key() {
|
|
let dir = tempdir().unwrap();
|
|
let input_file = dir.path().join("secret.txt");
|
|
let archive = dir.path().join("archive.bin");
|
|
let output_dir = dir.path().join("output");
|
|
|
|
fs::write(&input_file, b"Secret data").unwrap();
|
|
|
|
// Pack with the test key
|
|
cmd_with_key()
|
|
.args(["pack", input_file.to_str().unwrap(), "-o", archive.to_str().unwrap()])
|
|
.assert()
|
|
.success();
|
|
|
|
// Try to unpack with a different key (all zeros).
|
|
// The wrong key causes TOC decryption to fail (invalid padding) or HMAC verification
|
|
// to fail on individual files, depending on where the decryption error surfaces first.
|
|
let wrong_key = "0000000000000000000000000000000000000000000000000000000000000000";
|
|
cmd()
|
|
.args([
|
|
"--key", wrong_key,
|
|
"unpack", archive.to_str().unwrap(), "-o", output_dir.to_str().unwrap(),
|
|
])
|
|
.assert()
|
|
.failure()
|
|
.stderr(
|
|
predicate::str::contains("HMAC")
|
|
.or(predicate::str::contains("verification"))
|
|
.or(predicate::str::contains("Decryption failed"))
|
|
.or(predicate::str::contains("wrong key"))
|
|
);
|
|
}
|
|
|
|
/// Bad hex: --key with too-short hex string should produce a clear error.
|
|
#[test]
|
|
fn test_rejects_bad_hex() {
|
|
let dir = tempdir().unwrap();
|
|
let input_file = dir.path().join("data.txt");
|
|
let archive = dir.path().join("archive.bin");
|
|
|
|
fs::write(&input_file, b"data").unwrap();
|
|
|
|
cmd()
|
|
.args([
|
|
"--key", "abcd",
|
|
"pack", input_file.to_str().unwrap(), "-o", archive.to_str().unwrap(),
|
|
])
|
|
.assert()
|
|
.failure()
|
|
.stderr(predicate::str::contains("32 bytes").or(predicate::str::contains("hex")));
|
|
}
|
|
|
|
/// Missing key: running pack without any key arg should produce a clear error.
|
|
#[test]
|
|
fn test_rejects_missing_key() {
|
|
let dir = tempdir().unwrap();
|
|
let input_file = dir.path().join("data.txt");
|
|
let archive = dir.path().join("archive.bin");
|
|
|
|
fs::write(&input_file, b"data").unwrap();
|
|
|
|
cmd()
|
|
.args(["pack", input_file.to_str().unwrap(), "-o", archive.to_str().unwrap()])
|
|
.assert()
|
|
.failure()
|
|
.stderr(predicate::str::contains("required for pack"));
|
|
}
|
|
|
|
/// Inspect without key: should succeed and show header metadata but NOT entry listing.
|
|
#[test]
|
|
fn test_inspect_without_key() {
|
|
let dir = tempdir().unwrap();
|
|
let input_file = dir.path().join("data.txt");
|
|
let archive = dir.path().join("archive.bin");
|
|
|
|
fs::write(&input_file, b"Hello inspect").unwrap();
|
|
|
|
// Pack with key
|
|
cmd_with_key()
|
|
.args(["pack", input_file.to_str().unwrap(), "-o", archive.to_str().unwrap()])
|
|
.assert()
|
|
.success();
|
|
|
|
// Inspect without key: should show header metadata, print TOC encrypted message
|
|
cmd()
|
|
.args(["inspect", archive.to_str().unwrap()])
|
|
.assert()
|
|
.success()
|
|
.stdout(predicate::str::contains("Version:"))
|
|
.stdout(predicate::str::contains("Flags:"))
|
|
.stdout(predicate::str::contains("Entries:"))
|
|
.stdout(predicate::str::contains("TOC is encrypted, provide a key to see entry listing"));
|
|
}
|
|
|
|
/// Inspect with key: should succeed and show full TOC entry listing.
|
|
#[test]
|
|
fn test_inspect_with_key() {
|
|
let dir = tempdir().unwrap();
|
|
let input_file = dir.path().join("data.txt");
|
|
let archive = dir.path().join("archive.bin");
|
|
|
|
fs::write(&input_file, b"Hello inspect with key").unwrap();
|
|
|
|
// Pack with key
|
|
cmd_with_key()
|
|
.args(["pack", input_file.to_str().unwrap(), "-o", archive.to_str().unwrap()])
|
|
.assert()
|
|
.success();
|
|
|
|
// Inspect with key: should show full entry listing
|
|
cmd_with_key()
|
|
.args(["inspect", archive.to_str().unwrap()])
|
|
.assert()
|
|
.success()
|
|
.stdout(predicate::str::contains("Version:"))
|
|
.stdout(predicate::str::contains("data.txt"))
|
|
.stdout(predicate::str::contains("Original:"))
|
|
.stdout(predicate::str::contains("SHA-256:"));
|
|
}
|