fix: add tests for raw rsa keyring node (aws#142)

Author: seebees

modules/raw-rsa-keyring-node/test/raw_rsa_keyring_node.test.ts

@@ -0,0 +1,182 @@
+/*
+ * Copyright 2019 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"). You may not use
+ * this file except in compliance with the License. A copy of the License is
+ * located at
+ *
+ *     http://aws.amazon.com/apache2.0/
+ *
+ * or in the "license" file accompanying this file. This file is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+ * implied. See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/* eslint-env mocha */
+
+import * as chai from 'chai'
+import chaiAsPromised from 'chai-as-promised'
+import 'mocha'
+import {
+  RawRsaKeyringNode
+} from '../src/index'
+import {
+  KeyringNode,
+  NodeEncryptionMaterial,
+  NodeAlgorithmSuite,
+  AlgorithmSuiteIdentifier,
+  EncryptedDataKey, // eslint-disable-line no-unused-vars
+  NodeDecryptionMaterial
+} from '@aws-crypto/material-management-node'
+
+chai.use(chaiAsPromised)
+const { expect } = chai
+
+/* RSA Keys to test.
+ * These keys are *Public*!
+ * *DO NOT USE*
+ *
+ * to recrate
+crypto.generateKeyPair('rsa', {
+  modulusLength: 4096,
+  publicKeyEncoding: {
+    type: 'spki',
+    format: 'pem'
+  },
+  privateKeyEncoding: {
+    type: 'pkcs8',
+    format: 'pem'
+  }
+}, (e, p, v) => {
+  public = p
+  private = v
+})
+ */
+const publicPem = '-----BEGIN PUBLIC KEY-----\nMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAu3eAVbBR//sN05yszjSh\n09D9L9e5q6W7z5SqdnsJ7WyENvDunOuuwIKBYOlj6P1XUKtxzwO4/v3Mu4SY4Tu2\n0rH3yP+rnGPSpRSwOOZOOBQcq6b1hK2ucGAbvYNZQSup/eqi1M+9hEgVBvMTrPfP\nm89N6xiwLaJhPAXLhVeAXroGv8yOIClkezcYkZxBx+/vdt0R31R8o08XoyniLWZt\np8xd2ge/hX8RxLc+7EhTouzHR/Pz63bhy9O9aNVVKcb2W5H4lOU9gNdPMEhmjERB\ne9M7u2rU2VyWSzwEpHx/8Vxl5T3f6i7lK0YLrFYhmmR311mCjZ50oEzJgsL+CtIO\nmq1aOYg1EJE7fOxzVPswG+BLp0r2Tx/4sevRh3Ap+BTSuOeTWlS1piV04JA5eeLE\nPrlScIVr4zj4uxMFkIxFMxMar4DD+TZGCnhqAokF56MZs9xndC6xWAnZWf3KV+il\nNN7yGo5CBGIv3Fu7CTsHTB7xOxAQyOeMSu0uGP2XO3N1DGRqv5imfRH8Jy5FhGzt\nwkSf8wPbUHINnqcQLnFvlqj1pc1j272tfVFDifr2IyToTyMIEY3S60VRBUs/F529\njCyhp8+0LMlw1WVbGt9Hxqwfzmt0rOfVc4/qnIKSc1IaBKCkwmeFOWK9qIGKMVtc\nMqsi59G6k0Ik3PjcwZ0gmv8CAwEAAQ==\n-----END PUBLIC KEY-----\n'
+const privatePem = '-----BEGIN PRIVATE KEY-----\nMIIJQQIBADANBgkqhkiG9w0BAQEFAASCCSswggknAgEAAoICAQC7d4BVsFH/+w3T\nnKzONKHT0P0v17mrpbvPlKp2ewntbIQ28O6c667AgoFg6WPo/VdQq3HPA7j+/cy7\nhJjhO7bSsffI/6ucY9KlFLA45k44FByrpvWEra5wYBu9g1lBK6n96qLUz72ESBUG\n8xOs98+bz03rGLAtomE8BcuFV4Beuga/zI4gKWR7NxiRnEHH7+923RHfVHyjTxej\nKeItZm2nzF3aB7+FfxHEtz7sSFOi7MdH8/PrduHL071o1VUpxvZbkfiU5T2A108w\nSGaMREF70zu7atTZXJZLPASkfH/xXGXlPd/qLuUrRgusViGaZHfXWYKNnnSgTMmC\nwv4K0g6arVo5iDUQkTt87HNU+zAb4EunSvZPH/ix69GHcCn4FNK455NaVLWmJXTg\nkDl54sQ+uVJwhWvjOPi7EwWQjEUzExqvgMP5NkYKeGoCiQXnoxmz3Gd0LrFYCdlZ\n/cpX6KU03vIajkIEYi/cW7sJOwdMHvE7EBDI54xK7S4Y/Zc7c3UMZGq/mKZ9Efwn\nLkWEbO3CRJ/zA9tQcg2epxAucW+WqPWlzWPbva19UUOJ+vYjJOhPIwgRjdLrRVEF\nSz8Xnb2MLKGnz7QsyXDVZVsa30fGrB/Oa3Ss59Vzj+qcgpJzUhoEoKTCZ4U5Yr2o\ngYoxW1wyqyLn0bqTQiTc+NzBnSCa/wIDAQABAoICACuWf4ps8sP4FaDsPum7Jx1e\n7F+hYxRb9q0vPetKdGZ14s/7eR+XVQyBy59C5O4ZaaHiGxYtIWh4jo/TJtDH15xp\nsNlVSQuV0jZ79vVj5y/2zSvEKDXvRC3wysJntesHQgE9+xpMKx6EvA7fmeWPwP/T\nVaSiGuShasZP+qBIVhqwWj1iTHGB7lEP4HCKymi4iw8yG6O3uzslerN/W41+0WRA\nilnVj1x0zSbWDJVXw8qQD03VlRNckueXleS4JZMPJdzotcm4+3Hnngv16ZIXlLo7\nxRmwn0ji1Dct/05XfFAcUbzZhCSpPrOvF6u8YxfI4Gx77XUMMMXM1NXIjNTrPmWm\nfOtNmCsUiWjFi/aM8cNlH+veoa4SAgY0k3d51ilupd+H7CkHGnvDFKSLK+AWERWr\nGK37ffmJH0p7fXcI445+KQoT2ujm+UKNNfx8PB8jXRs7BTHb2xXhd2kjh/VmV6Gw\nVpgFloNm+OEcFcuqxQdl/Co+EsXhbmtVfb7xDhYxVkwnDRISuQyeahKf2b9sQMrf\noXOiwFLaBdsiqsxAVAVWgzA4brZdZfsLyq8tqdWrIddIDIruvk6UvLjDfhcK9dO9\nNkzIm88CAJi68lS2m/zIitvao5OJ3KyESkdAJzMSGnBYrD7fWyk1wbv0T9PbQpdo\nk/YIwuCVlKosOd355ynxAoIBAQDnm+ODTjv/HhDWLlZyxYZiXe4GfcBrukA9NF/1\nOqIqR93SpR9du2Pc7z1mCkWGFGFx4/KRVsLVl2bUgw0IEkAu4XF5ydy/dG2eLnX0\nMJjJvkXle2Z10zzp45sn8Cx8hYRfehYefBg/vG3QWfXvLGM2A2G3Niqd96FNAIc1\nM7FKcicFvM1NkxEugTK20ZgqzBZIv+WzXtG5qr4aOImBnpQa0+ucien722LE6UNw\nNShsU5kVBhraW/H+ko68xdF2CJS6poySggkd3S5yHOUXga5sPUjIErguILMVw5p1\niXf8hV2NgUp9K4zmG5rHmowMQKwckDu8Zn0oBOe/CAHVQhiDAoIBAQDPNY2V1AlY\nR97zNk8xFYk/G5I/kqcrlxyHcQlJC3ALJXKFdn8vgFfC2oSO4I8VZrieP6s1xYtA\nhdvxOu+8mpUNBal3N/1z/mBMBwmA1La3SE0RW7nWnxwoPMy64uxzVJv3/O8HvOah\n/hk3odxZuGZJ8LOCXeUllwBzPIOoP++ke92EscIL/Uo67hXd04+wkmGvzIJOkmAa\nyhPZUUuTLRSFuQzjJui3f+j95GxeuHTGOxeqSQL6I4WskHkKExY5O0nZXjoiz0tB\nI1B4jQIe/Plcr62hgraTD++8iHTSbcMINSc9qp247H9Hdi01fN1V/PAtJJZuwcS2\n8xsUEFGkoxLVAoIBAFFwGvuckrQN2lW1TWhl0+7aoEtgBDzc7KGYvPT5fPPo+TKM\nJQ9MSLzy0mAC1Jdkqy7ku/Im07NO3TV0LyzbXf4d/0yXkisvwSuRoqAORmsJoIIk\ndc6QTCbhhTjx1nKib/0ybHyjndMramGMgFFtBiWD4uQNA8cvv2PX/7LRTlGi+d2m\nmXnhcHUtsKtf32WNBXjnINmFSbFDPDz0DEWrgOA+C+arB78rUPt0GeZmiqQscPNX\nhjGpitm8prvxwskCE2neDiel2ZbKov408sjlLHOayPCwxFpT3SSV9sXFZI9CRbbv\n80U3/v8aTb5JtVzJkLsqbBa+4tsjfmlJY3udFgkCggEATU9p2DEYm3uVT6E/wsyK\nPKWI13dcMANdfZtLH5nI4B/Ers8bfRmhpO3q73QRbqa40zJmKtXdsuE+wq5+rBvw\n6L7oD7cwNYr/Wt51SUAUPCYZuxRCLjWHR+wHZuMr3Yv/9XLFrFlqo54uwnb9w+vt\nHkFUeJuX14KThGtbo/bW7sPYTp4UDG0guQQD3JQG1JaJJBJlu/MZMGWdKkQOsobr\nVUlJ6aamxXBP+gqz9FNWHnAF0F8VYUbHpS7yOjQM4qWgVB24CyzUoyUN7SyPUgiI\n8XAKlGw0uoIDrJAtJiYV0oYicfuqhUiX5I3PKFnCK0cIRY+VIRXi02+49q9wBsFh\nUQKCAQB190+U+7Z7YsvKWIbFxnSIGRpzae2HlVJzRI/aoo79ij5qNfisaZvxhvfY\nUTkz6FzHIJoxq/mAJXKQgQ9ofW+XMR/xWKaFRkiGE2aPy3JecoVOx1OL6TWV7KDX\n2prwflF4WEzkZA25BPmg2GM8sTXXln9xSVwNLe24lF6UNj0KG+6zioUM+oepf70v\nUB63Bn/qQwBGgh72oBni4HxqskNG1bNkKt6emgyr/tRNZGqrKCxjqq3Oa8YMrfbr\nP4goDm0LICzbeLlFtVUT7xpAGuItkK26JGypoAfdU5SybjuKaXDygTcq1EEMyduV\nnUwWh19LU+597M0VXIKm2/H3v4up\n-----END PRIVATE KEY-----\n'
+
+describe('RawRsaKeyringWebCrypto::constructor', () => {
+  const keyName = 'keyName'
+  const keyNamespace = 'keyNamespace'
+
+  it('constructor decorates', async () => {
+    const test = new RawRsaKeyringNode({
+      rsaKey: {
+        privateKey: privatePem,
+        publicKey: publicPem
+      },
+      keyName,
+      keyNamespace
+    })
+
+    expect(test.keyName).to.equal(keyName)
+    expect(test.keyNamespace).to.equal(keyNamespace)
+    expect(test._wrapKey).to.be.a('function')
+    expect(test._unwrapKey).to.be.a('function')
+    expect(test).to.be.instanceOf(KeyringNode)
+  })
+
+  it('can construct with only public key', () => {
+    const testPublicOnly = new RawRsaKeyringNode({
+      rsaKey: {
+        publicKey: publicPem
+      },
+      keyName,
+      keyNamespace
+    })
+    expect(testPublicOnly).to.be.instanceOf(RawRsaKeyringNode)
+  })
+
+  it('can construct with only private key', () => {
+    const testPrivateOnly = new RawRsaKeyringNode({
+      rsaKey: {
+        privateKey: privatePem
+      },
+      keyName,
+      keyNamespace
+    })
+    expect(testPrivateOnly).to.be.instanceOf(RawRsaKeyringNode)
+  })
+
+  it('Precondition: RsaKeyringNode needs either a public or a private key to operate.', () => {
+    expect(() => new RawRsaKeyringNode({
+      keyName,
+      keyNamespace,
+      rsaKey: {}
+    })).to.throw()
+  })
+
+  it('Precondition: RsaKeyringNode needs identifying information for encrypt and decrypt.', () => {
+    // @ts-ignore Typescript is trying to save us.
+    expect(() => new RawRsaKeyringNode({
+      rsaKey: { privateKey: privatePem, publicKey: publicPem }
+    })).to.throw()
+    // @ts-ignore Typescript is trying to save us.
+    expect(() => new RawRsaKeyringNode({
+      rsaKey: { privateKey: privatePem, publicKey: publicPem },
+      keyNamespace
+    })).to.throw()
+    // @ts-ignore Typescript is trying to save us.
+    expect(() => new RawRsaKeyringNode({
+      rsaKey: { privateKey: privatePem, publicKey: publicPem },
+      keyName
+    })).to.throw()
+  })
+})
+
+describe('RawRsaKeyringWebCrypto encrypt/decrypt', () => {
+  const keyNamespace = 'keyNamespace'
+  const keyName = 'keyName'
+  const keyring = new RawRsaKeyringNode({
+    rsaKey: { privateKey: privatePem, publicKey: publicPem },
+    keyName,
+    keyNamespace
+  })
+  let encryptedDataKey: EncryptedDataKey
+
+  it('can encrypt and create unencrypted data key', async () => {
+    const suite = new NodeAlgorithmSuite(AlgorithmSuiteIdentifier.ALG_AES256_GCM_IV12_TAG16_HKDF_SHA256)
+    const material = new NodeEncryptionMaterial(suite)
+    const test = await keyring.onEncrypt(material)
+    expect(test.hasValidKey()).to.equal(true)
+    const udk = test.getUnencryptedDataKey()
+    expect(udk).to.have.lengthOf(suite.keyLengthBytes)
+    expect(test.encryptedDataKeys).to.have.lengthOf(1)
+    const [edk] = test.encryptedDataKeys
+    expect(edk.providerId).to.equal(keyNamespace)
+    encryptedDataKey = edk
+  })
+
+  it('can decrypt an EncryptedDataKey', async () => {
+    const suite = new NodeAlgorithmSuite(AlgorithmSuiteIdentifier.ALG_AES256_GCM_IV12_TAG16_HKDF_SHA256)
+    const material = new NodeDecryptionMaterial(suite)
+    const test = await keyring.onDecrypt(material, [encryptedDataKey])
+    expect(test.hasValidKey()).to.equal(true)
+  })
+
+  it('Precondition: Public key must be defined to support encrypt.', async () => {
+    const keyring = new RawRsaKeyringNode({
+      rsaKey: { privateKey: privatePem },
+      keyName,
+      keyNamespace
+    })
+
+    const suite = new NodeAlgorithmSuite(AlgorithmSuiteIdentifier.ALG_AES256_GCM_IV12_TAG16_HKDF_SHA256)
+    const material = new NodeEncryptionMaterial(suite)
+    expect(keyring.onEncrypt(material)).to.rejectedWith(Error)
+  })
+
+  it('Precondition: Private key must be defined to support decrypt.', async () => {
+    const keyring = new RawRsaKeyringNode({
+      rsaKey: { publicKey: publicPem },
+      keyName,
+      keyNamespace
+    })
+
+    const suite = new NodeAlgorithmSuite(AlgorithmSuiteIdentifier.ALG_AES256_GCM_IV12_TAG16_HKDF_SHA256)
+    const material = new NodeDecryptionMaterial(suite)
+    await keyring.onDecrypt(material, [encryptedDataKey])
+    expect(keyring.onDecrypt(material, [encryptedDataKey])).to.rejectedWith(Error)
+  })
+})