PeachScriptTest.kt

1package com.peachpasswords.vault23import org.junit.Assert.assertEquals4import org.junit.Assert.assertNotNull5import org.junit.Assert.assertNull6import org.junit.Assert.assertThrows7import org.junit.Assert.assertTrue8import org.junit.Test9import java.util.Base6410import kotlinx.serialization.json.Json11import kotlinx.serialization.json.contentOrNull12import kotlinx.serialization.json.jsonObject13import kotlinx.serialization.json.jsonPrimitive1415class PeachScriptTest {1617    private fun login() = VaultEntry(18        id = "11111111-2222-3333-4444-555555555555", type = "login", title = "GitHub",19        url = "https://github.com", username = "june", email = "[email protected]",20        password = "hunter2-Σ-🔐", totp = "JBSWY3DPEHPK3PXP", tags = listOf("dev", "work"),21        notes = "primary account", additionalUrls = listOf("https://gist.github.com"),22        breach = 3, passwordChangedAt = 1_600_000_000_000,23        canary = Canary(webhookUrl = "https://canary.example.com/hook", label = "tripwire"),24        createdAt = 1_500_000_000_000, modifiedAt = 1_600_000_500_000,25    )2627    private fun note() = VaultEntry(28        id = "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee", type = "note", title = "そふと メモ 🌸",29        notes = "日本語のノート\nsecond line", tags = listOf("personal"),30        createdAt = 1_500_000_000_000, modifiedAt = 1_500_000_000_000,31    )3233    private fun card() = VaultEntry(34        id = "99999999-8888-7777-6666-555544443333", type = "card", title = "Visa",35        cardholderName = "JUNE MOON", cardNumber = "4111111111111111", expMonth = "04",36        expYear = "2030", cvc = "123", cardNickname = "daily", cardNetwork = "visa",37        notes = "spending card", tags = listOf("finance"),38        createdAt = 1_500_000_000_000, modifiedAt = 1_500_000_000_000,39    )4041    // ── KAT: parse a REAL browser-produced PeachScript payload ──────────────42    // Envelope generated by the browser's own buildPayload (/tmp/gen_peach3.mjs43    // via vite SSR), proving Android decrypts + zstd-decompresses + unpacks the44    // exact bytes the extension writes. This is the cross-platform import proof.45    @Test fun parses_browser_produced_payload() {46        val envelope = Base64.getDecoder().decode(BROWSER_FIXTURE_B64)47        val entries = PeachPayloadCodec.parsePayload(envelope, "backup-pass-123")48        assertEquals(3, entries.size)4950        val l = entries[0]51        assertEquals("11111111-2222-3333-4444-555555555555", l.id)52        assertEquals("login", l.type)53        assertEquals("GitHub", l.title)54        assertEquals("https://github.com", l.url)55        assertEquals("june", l.username)56        assertEquals("[email protected]", l.email)57        assertEquals("hunter2-Σ-🔐", l.password)58        assertEquals("JBSWY3DPEHPK3PXP", l.totp)59        assertEquals(listOf("dev", "work"), l.tags)60        assertEquals("primary account", l.notes)61        assertEquals(listOf("https://gist.github.com"), l.additionalUrls)62        assertEquals(3, l.breach)63        assertEquals(1_600_000_000_000L, l.passwordChangedAt)64        assertEquals("https://canary.example.com/hook", l.canary?.webhookUrl)65        assertEquals("tripwire", l.canary?.label)66        assertEquals(1_500_000_000_000L, l.createdAt)67        assertEquals(1_600_000_500_000L, l.modifiedAt)6869        val n = entries[1]70        assertEquals("note", n.type)71        assertEquals("そふと メモ 🌸", n.title)72        assertEquals("日本語のノート\nsecond line", n.notes)73        assertEquals(listOf("personal"), n.tags)7475        val c = entries[2]76        assertEquals("card", c.type)77        assertEquals("JUNE MOON", c.cardholderName)78        assertEquals("4111111111111111", c.cardNumber)79        assertEquals("04", c.expMonth)80        assertEquals("2030", c.expYear)81        assertEquals("123", c.cvc)82        assertEquals("daily", c.cardNickname)83        assertEquals("visa", c.cardNetwork)84        assertEquals("spending card", c.notes)85        assertEquals(listOf("finance"), c.tags)86    }8788    // ── Android self round-trip: all fields, all entry types ────────────────89    @Test fun self_round_trips_all_fields() {90        val input = listOf(login(), note(), card())91        val out = PeachPayloadCodec.buildPayload(input, "pw-123")92        val back = PeachPayloadCodec.parsePayload(out, "pw-123")93        assertEquals(3, back.size)9495        val l = back[0]96        assertEquals(login().id, l.id)97        assertEquals("hunter2-Σ-🔐", l.password)98        assertEquals(listOf("dev", "work"), l.tags)99        assertEquals(3, l.breach)100        assertEquals(1_600_000_000_000L, l.passwordChangedAt)101        assertEquals("tripwire", l.canary?.label)102        assertEquals(listOf("https://gist.github.com"), l.additionalUrls)103        assertEquals(1_500_000_000_000L, l.createdAt)104        assertEquals(1_600_000_500_000L, l.modifiedAt)105106        val c = back[2]107        assertEquals("4111111111111111", c.cardNumber)108        assertEquals("visa", c.cardNetwork)109        assertEquals("123", c.cvc)110    }111112    // ── Cross-direction: Android export parsed by the browser's algorithm ───113    // (Verified manually via /tmp; here we at least prove a browser-shaped114    // envelope layout: salt(16)+nonce(12)+ct+tag, padded to a size bucket.)115    @Test fun export_envelope_has_browser_shape() {116        val out = PeachPayloadCodec.buildPayload(listOf(login()), "pw")117        // salt(16)+nonce(12)+tag(16) overhead; payload padded to >= 1024 bucket,118        // so the ciphertext alone is at least one bucket.119        assertTrue(out.size >= 16 + 12 + 1024 + 16)120    }121122    @Test fun empty_vault_round_trips() {123        val out = PeachPayloadCodec.buildPayload(emptyList(), "pw")124        assertEquals(0, PeachPayloadCodec.parsePayload(out, "pw").size)125    }126127    @Test fun unicode_fields_round_trip() {128        val out = PeachPayloadCodec.buildPayload(listOf(note()), "pw")129        val n = PeachPayloadCodec.parsePayload(out, "pw").single()130        assertEquals("そふと メモ 🌸", n.title)131        assertEquals("日本語のノート\nsecond line", n.notes)132    }133134    @Test fun wrong_password_is_invalid_passphrase() {135        val out = PeachPayloadCodec.buildPayload(listOf(login()), "right-pw")136        val ex = assertThrows(PeachPayloadCodec.PeachScriptException::class.java) {137            PeachPayloadCodec.parsePayload(out, "wrong-pw")138        }139        assertEquals("INVALID_PASSPHRASE", ex.message)140    }141142    @Test fun pua_codec_round_trips() {143        val bytes = ByteArray(256) { it.toByte() }144        val text = PeachScript.encode(bytes)145        assertTrue(PeachScript.isPeachScript(text))146        assertEquals(256, text.codePointCount(0, text.length))147        assertTrue(bytes.contentEquals(PeachScript.decode(text)))148        // Whitespace is stripped before decode.149        assertTrue(bytes.contentEquals(PeachScript.decode(PeachScript.normalise("  $text \n"))))150    }151152    @Test fun passkey_core_fields_round_trip() {153        val privateKeyJwk = """{"kty":"EC","crv":"P-256","x":"x1","y":"y1","d":"d1"}"""154        val pk = VaultEntry(155            id = "12121212-3434-5656-7878-909090909090", type = "passkey", title = "Passkey",156            passkey = PasskeyData(157                credentialId = "cred-abc", publicKeyCose = "cose-xyz", rpId = "example.com",158                privateKeyJwk = privateKeyJwk, rpName = "Example",159                userHandle = "uh-1", userName = "june", userDisplayName = "June",160            ),161            createdAt = 1_500_000_000_000, modifiedAt = 1_500_000_000_000,162        )163        val out = PeachPayloadCodec.buildPayload(listOf(pk), "pw")164        val back = PeachPayloadCodec.parsePayload(out, "pw").single()165        assertEquals("passkey", back.type)166        assertNotNull(back.passkey)167        assertEquals("cred-abc", back.passkey?.credentialId)168        assertEquals("example.com", back.passkey?.rpId)169        assertEquals("june", back.passkey?.userName)170        val backJwk = Json.parseToJsonElement(requireNotNull(back.passkey?.privateKeyJwk)).jsonObject171        assertEquals("EC", backJwk["kty"]?.jsonPrimitive?.contentOrNull)172        assertEquals("d1", backJwk["d"]?.jsonPrimitive?.contentOrNull)173    }174175    @Test fun full_export_import_via_peachscript_text() {176        val text = com.peachpasswords.ui.vault.PeachScriptExport.buildEncrypted(listOf(login(), card()), "bp")177        assertTrue(com.peachpasswords.ui.vault.PeachScriptImport.looksLikePeachScript(text))178        val r = com.peachpasswords.ui.vault.PeachScriptImport.decryptAndParse(text, "bp")179        assertTrue(r is com.peachpasswords.ui.vault.PeachScriptImport.DecryptResult.Success)180        r as com.peachpasswords.ui.vault.PeachScriptImport.DecryptResult.Success181        assertEquals(2, r.entries.size)182        assertEquals("hunter2-Σ-🔐", r.entries[0].password)183        assertNull(184            (com.peachpasswords.ui.vault.PeachScriptImport.decryptAndParse(text, "nope")185                as? com.peachpasswords.ui.vault.PeachScriptImport.DecryptResult.Success)?.entries,186        )187    }188189    companion object {190        // Real browser PeachScript envelope (base64) — see /tmp/gen_peach3.mjs.191        private const val BROWSER_FIXTURE_B64 =192            "RTRXPzyl+oHgPhKUK3DCdab09Rb+zMF5Dfphcydo2qzHWqE2PfJHdLEalnhL7jSOxCiowSjIYmrbkCLP2qCLeSHwceeSD9RhBx04bHNoc5J/ml/sXrY/7BFIZizNk5dlDt921VSQNhaNEzYmP/fKkYWjFpz+OOhUCBTUgt+WtCwa5mf8Ctf6R1UPkh21Fu3pwwb/IQjhFvij+CYgS+1skXtogw0iYTrNbSLMIxMsIKvXytFGOp4IGWbbATO/7vFPXnwc2Zh9gOkbUbVM8D7dBUBV+hTodCNHO8PsvxzPAQL0io4/t/Iu60x91eiB8+TTJEwQy9d/aNGM0hgAZq5TzBj4IpYW2tGwfMqRwhuQz07e7SrcL3ggJVlrOf+rph0UnzgdRuCeMS67/83IhNg0UUCftSqdBdQFeqE3UNLavRohLO4AaqTLR1i4UfDApjL79MVtqjztfj8xTJr+zf1SH0BZ0/6PCyIXnm526lxk4WALgJiXu1FWoIXP3xGjs/ZAe1t7RONiVak51kTLs7djQMh6WLMGxW8KVaFAu1a+jG3Zus9Ynn9FBpowipW1E4rnUnytqUzh/udY0q4Y8nJvavyD3hO5xEbHkslfbPSYqxrrGaL3OFb9llKoLyZSiYGB5p+/QM7xn5DFZ3VOtx90xf9wVEe2Uhfhq0XfQUqT384kWp8Ujlyq4pFB6nIe3f3e8C2pE+fJMou0Q2RFvotx/F56T3Ul2d0fpoN7ucyqJC94Fo6B8Peh1u5oxu5njPZEjRSUl2eBt3K8Aval7d9yYbm7I1ecUSLNJ+nHphL/DMYKL2CYQd90pdyfOeDgRCt4WML8z6hjTtW6uPUKDkd5WVu0qp2ktuzawolWi7aah1BnTZMwH2/jm6bPlLNE5r/bFwr1MAgNscjpwwa0DXTfMovbgJHLxEp6/0vpxuYcCfoRoinpTErt7Eafz2rQqw7mEit3eoUZ1Nv+AdfvBC3PN0pB/L5gdzi/cCrEtVCX2A/1NkhV91EKnx0tCQnkjZyovd9ZhKb/QNgzA6v7lugua4e0foRJJBSqwcJJ4Sr7CUXsK5/yuwXsYcJ0I+yTwiHoe4WA5I/go61xvSPsDV/5aXyS0bJbAa5DusVd/SnUM1QFFwHjOfwGUlU/PupZSr2zvZdds+ZX8B8u16L55gZE8xOdOUq7tAd25Gd3v0r6sSwcYu1amjhbfQlgw2RBQBWHmMZ8Jn715A9RblOMW95EqVu8AhG1Jfl547WdahfgC93Aw3nlT39sUBpzqRwa54N6Q9RHc81uC1q+xtU7CiTIMWJm1qqnVjP89MWMnRpYjRXOYBOop73uHh4BjomUlEzXEXmtJiaMq1nsqW85k+FKnO0bF/rGVzmFvHWuBx4cWYic9e8tmUalxdJxDsqFr+dh3h3Fp/YD9oOIT2XD"193    }194}