argon2.test.ts

1import { describe, expect, it } from "vitest";23import { deriveKey, generateSalt } from "./argon2";45// Same glyph "café" decomposed (e + U+0301) and composed (U+00E9). Both are6// derived from one base literal via normalize(), so the stored byte form of the7// literal is irrelevant — the two forms are guaranteed distinct.8const CAFE_BASE = "café";9const CAFE_NFD = CAFE_BASE.normalize("NFD");10const CAFE_NFC = CAFE_BASE.normalize("NFC");1112describe("crypto argon2", () => {13  it("deriveKey is deterministic for the same password and salt", async () => {14    const salt = generateSalt();1516    const first = await deriveKey("correct-pass-12345", salt);17    const second = await deriveKey("correct-pass-12345", salt);1819    expect(first).toEqual(second);20  });2122  it("deriveKey changes when the salt changes", async () => {23    const first = await deriveKey("correct-pass-12345", generateSalt());24    const second = await deriveKey("correct-pass-12345", generateSalt());2526    expect(first).not.toEqual(second);27  });2829  it("deriveKey changes when the password changes", async () => {30    const salt = generateSalt();3132    const first = await deriveKey("correct-pass-12345", salt);33    const second = await deriveKey("wrong-pass-67890", salt);3435    expect(first).not.toEqual(second);36  });3738  it("LV-1: deriveKey NFC-normalizes so composed and decomposed forms match", async () => {39    const salt = generateSalt();40    expect(CAFE_NFC).not.toBe(CAFE_NFD);41    expect(await deriveKey(CAFE_NFC, salt)).toEqual(await deriveKey(CAFE_NFD, salt));42  });4344  it("generateSalt returns 16 bytes", () => {45    expect(generateSalt()).toHaveLength(16);46  });4748  it("generateSalt returns different values across calls", () => {49    expect(generateSalt()).not.toEqual(generateSalt());50  });51});