feat: improvements

Author: gantunesr

app/core/Encryptor/Encryptor.test.ts

@@ -1,6 +1,10 @@
 import { NativeModules } from 'react-native';
 import { Encryptor } from './Encryptor';
-import { ENCRYPTION_LIBRARY } from './constants';
+import {
+  ENCRYPTION_LIBRARY,
+  DEFAULT_DERIVATION_PARAMS,
+  KeyDerivationIteration,
+} from './constants';
 
 const Aes = NativeModules.Aes;
 const AesForked = NativeModules.AesForked;
@@ -9,10 +13,32 @@ describe('Encryptor', () => {
   let encryptor: Encryptor;
 
   beforeEach(() => {
-    encryptor = new Encryptor();
+    encryptor = new Encryptor({ derivationParams: DEFAULT_DERIVATION_PARAMS });
+  });
+
+  describe('constructor', () => {
+    it('throws an error if the provided iterations do not meet the minimum required', () => {
+      expect(
+        () =>
+          new Encryptor({
+            derivationParams: {
+              algorithm: 'PBKDF2',
+              params: {
+                iterations: 100,
+              },
+            },
+          }),
+      ).toThrowError(
+        `Invalid key derivation iterations: 100. Recommended number of iterations is ${KeyDerivationIteration.Default}. Minimum required is ${KeyDerivationIteration.Minimum}.`,
+      );
+    });
   });
 
   describe('encrypt', () => {
+    afterEach(() => {
+      jest.clearAllMocks();
+    });
+
     it('should encrypt an object correctly', async () => {
       const password = 'testPassword';
       const objectToEncrypt = { key: 'value' };
@@ -31,52 +57,187 @@ describe('Encryptor', () => {
   });
 
   describe('decrypt', () => {
+    let decryptAesSpy: jest.SpyInstance,
+      pbkdf2AesSpy: jest.SpyInstance,
+      decryptAesForkedSpy: jest.SpyInstance,
+      pbkdf2AesForkedSpy: jest.SpyInstance;
+
+    beforeEach(() => {
+      decryptAesSpy = jest
+        .spyOn(Aes, 'decrypt')
+        .mockResolvedValue('{"mockData": "mockedPlainText"}');
+      pbkdf2AesSpy = jest
+        .spyOn(Aes, 'pbkdf2')
+        .mockResolvedValue('mockedAesKey');
+      decryptAesForkedSpy = jest
+        .spyOn(AesForked, 'decrypt')
+        .mockResolvedValue('{"mockData": "mockedPlainText"}');
+      pbkdf2AesForkedSpy = jest
+        .spyOn(AesForked, 'pbkdf2')
+        .mockResolvedValue('mockedAesForkedKey');
+    });
+
+    afterEach(() => {
+      decryptAesSpy.mockRestore();
+      pbkdf2AesSpy.mockRestore();
+      decryptAesForkedSpy.mockRestore();
+      pbkdf2AesForkedSpy.mockRestore();
+    });
+
     it.each([
       {
         lib: ENCRYPTION_LIBRARY.original,
-        expectedDecryptFunction: 'decrypt',
-        expectedKey: 'mockedKey',
-        description: 'with original library',
+        expectedKey: 'mockedAesKey',
+        expectedPBKDF2Args: ['testPassword', 'mockedSalt', 900000, 256],
+        description:
+          'with original library and default iterations number for key generation',
+        keyMetadata: DEFAULT_DERIVATION_PARAMS,
+      },
+      {
+        lib: ENCRYPTION_LIBRARY.original,
+        expectedKey: 'mockedAesKey',
+        expectedPBKDF2Args: ['testPassword', 'mockedSalt', 5000, 256],
+        description:
+          'with original library and old iterations number for key generation',
+      },
+      {
+        lib: 'random-lib', // Assuming not using "original" should lead to AesForked
+        expectedKey: 'mockedAesForkedKey',
+        expectedPBKDF2Args: ['testPassword', 'mockedSalt'],
+        description:
+          'with library different to "original" and default iterations number for key generation',
+        keyMetadata: DEFAULT_DERIVATION_PARAMS,
       },
       {
         lib: 'random-lib', // Assuming not using "original" should lead to AesForked
-        expectedDecryptFunction: 'decrypt',
-        expectedKey: 'mockedKeyForked',
-        description: 'with library different to "original"',
+        expectedKey: 'mockedAesForkedKey',
+        expectedPBKDF2Args: ['testPassword', 'mockedSalt'],
+        description:
+          'with library different to "original" and old iterations number for key generation',
       },
     ])(
       'decrypts a string correctly $description',
-      async ({ lib, expectedDecryptFunction, expectedKey }) => {
+      async ({ lib, expectedKey, expectedPBKDF2Args, keyMetadata }) => {
         const password = 'testPassword';
-        const encryptedString = {
+        const mockVault = {
           cipher: 'mockedCipher',
           iv: 'mockedIV',
           salt: 'mockedSalt',
           lib,
         };
 
-        // Determine which AES module to spy on based on the lib value
-        const aesModuleToSpyOn =
-          lib === ENCRYPTION_LIBRARY.original ? Aes : AesForked;
-        const decryptSpy = jest.spyOn(
-          aesModuleToSpyOn,
-          expectedDecryptFunction,
-        );
-
         const decryptedObject = await encryptor.decrypt(
           password,
-          JSON.stringify(encryptedString),
+          JSON.stringify(
+            keyMetadata !== undefined
+              ? { ...mockVault, keyMetadata }
+              : mockVault,
+          ),
         );
 
         expect(decryptedObject).toEqual(expect.any(Object));
-        expect(decryptSpy).toHaveBeenCalledWith(
-          encryptedString.cipher,
-          expectedKey,
-          encryptedString.iv,
-        );
-
-        decryptSpy.mockRestore();
+        expect(
+          lib === ENCRYPTION_LIBRARY.original
+            ? decryptAesSpy
+            : decryptAesForkedSpy,
+        ).toHaveBeenCalledWith(mockVault.cipher, expectedKey, mockVault.iv);
+        expect(
+          lib === ENCRYPTION_LIBRARY.original
+            ? pbkdf2AesSpy
+            : pbkdf2AesForkedSpy,
+        ).toHaveBeenCalledWith(...expectedPBKDF2Args);
       },
     );
   });
+
+  describe('isVaultUpdated', () => {
+    it('returns true if a vault has the correct format', () => {
+      expect(
+        encryptor.isVaultUpdated(
+          JSON.stringify({
+            cipher: 'mockedCipher',
+            iv: 'mockedIV',
+            salt: 'mockedSalt',
+            lib: 'original',
+            keyMetadata: DEFAULT_DERIVATION_PARAMS,
+          }),
+        ),
+      ).toBe(true);
+    });
+
+    it('returns false if a vault has the incorrect format', () => {
+      expect(
+        encryptor.isVaultUpdated(
+          JSON.stringify({
+            cipher: 'mockedCipher',
+            iv: 'mockedIV',
+            salt: 'mockedSalt',
+            lib: 'original',
+          }),
+        ),
+      ).toBe(false);
+    });
+  });
+
+  describe('updateVault', () => {
+    let encryptSpy: jest.SpyInstance, decryptSpy: jest.SpyInstance;
+    const expectedKeyMetadata = DEFAULT_DERIVATION_PARAMS;
+
+    beforeEach(() => {
+      encryptSpy = jest
+        .spyOn(Aes, 'encrypt')
+        .mockResolvedValue(() => Promise.resolve('mockedCipher'));
+      decryptSpy = jest
+        .spyOn(Aes, 'decrypt')
+        .mockResolvedValue('{"mockData": "mockedPlainText"}');
+    });
+
+    afterEach(() => {
+      encryptSpy.mockRestore();
+      decryptSpy.mockRestore();
+    });
+
+    it('updates a vault correctly if keyMetadata is not present', async () => {
+      const mockVault = {
+        cipher: 'mockedCipher',
+        iv: 'mockedIV',
+        salt: 'mockedSalt',
+        lib: 'original',
+      };
+
+      const updatedVault = await encryptor.updateVault(
+        JSON.stringify(mockVault),
+        'mockPassword',
+      );
+
+      const vault = JSON.parse(updatedVault);
+
+      expect(encryptSpy).toBeCalledTimes(1);
+      expect(decryptSpy).toBeCalledTimes(1);
+      expect(vault).toHaveProperty('keyMetadata');
+      expect(vault.keyMetadata).toStrictEqual(expectedKeyMetadata);
+    });
+
+    it('does not update a vault if algorithm is PBKDF2 and the number of iterations is 900000', async () => {
+      const mockVault = {
+        cipher: 'mockedCipher',
+        iv: 'mockedIV',
+        salt: 'mockedSalt',
+        lib: 'original',
+        keyMetadata: DEFAULT_DERIVATION_PARAMS,
+      };
+
+      const updatedVault = await encryptor.updateVault(
+        JSON.stringify(mockVault),
+        'mockPassword',
+      );
+
+      const vault = JSON.parse(updatedVault);
+
+      expect(encryptSpy).toBeCalledTimes(0);
+      expect(decryptSpy).toBeCalledTimes(0);
+      expect(vault).toHaveProperty('keyMetadata');
+      expect(vault.keyMetadata).toStrictEqual(expectedKeyMetadata);
+    });
+  });
 });