feat: verschlüsselte Integrationseinstellungen, Haushaltsmitglieder mit Ersteller, Backup-Download

tests/settings-store.test.ts

@@ -0,0 +1,55 @@
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { canEncrypt, decryptSecret, encryptSecret } from "../lib/settings-crypto";
+import { validateIntegrationSection } from "../lib/integration-settings";
+
+const ORIGINAL = process.env.SETTINGS_ENCRYPTION_KEY;
+
+beforeEach(() => {
+  process.env.SETTINGS_ENCRYPTION_KEY = "test-schluessel-mindestens-32-zeichen-lang!";
+});
+
+afterEach(() => {
+  if (ORIGINAL === undefined) delete process.env.SETTINGS_ENCRYPTION_KEY;
+  else process.env.SETTINGS_ENCRYPTION_KEY = ORIGINAL;
+});
+
+describe("settings-crypto", () => {
+  it("roundtrip: entschlüsseln liefert Klartext", () => {
+    const enc = encryptSecret("smtp-geheim");
+    expect(enc.startsWith("gcm1:")).toBe(true);
+    expect(decryptSecret(enc)).toBe("smtp-geheim");
+  });
+  it("gleicher Klartext ergibt verschiedene Chiffre (Zufalls-IV)", () => {
+    expect(encryptSecret("x")).not.toBe(encryptSecret("x"));
+  });
+  it("manipulierter Wert wird abgelehnt", () => {
+    const enc = encryptSecret("wichtig");
+    const tampered = enc.slice(0, -2) + (enc.endsWith("AA") ? "BB" : "AA");
+    expect(() => decryptSecret(tampered)).toThrow();
+    expect(() => decryptSecret("klartext")).toThrow();
+  });
+  it("ohne/zu kurzem Key kein Verschlüsseln", () => {
+    delete process.env.SETTINGS_ENCRYPTION_KEY;
+    expect(canEncrypt()).toBe(false);
+    expect(() => encryptSecret("x")).toThrow("SETTINGS_ENCRYPTION_KEY");
+    process.env.SETTINGS_ENCRYPTION_KEY = "kurz";
+    expect(canEncrypt()).toBe(false);
+  });
+});
+
+describe("validateIntegrationSection", () => {
+  it("unbekannte Bereiche ablehnen", () => {
+    expect(validateIntegrationSection("login", {})).toEqual(["section"]);
+  });
+  it("gültige SMTP-Werte bestehen", () => {
+    expect(validateIntegrationSection("smtp", { smtp_host: "mail.de", smtp_port: "587", smtp_pass: "" })).toEqual([]);
+  });
+  it("ungültiger Port und Typen ablehnen", () => {
+    expect(validateIntegrationSection("smtp", { smtp_port: "abc" })).toEqual(["smtp_port"]);
+    expect(validateIntegrationSection("smtp", { smtp_host: 5 })).toEqual(["smtp_host"]);
+  });
+  it("leeres Geheimnis-Feld ist ok (behält bestehenden Wert)", () => {
+    expect(validateIntegrationSection("telegram", { telegram_bot_token: "" })).toEqual([]);
+    expect(validateIntegrationSection("logo", { logo_dev_secret_key: "sk_x", logo_dev_publishable_key: "pk_x" })).toEqual([]);
+  });
+});