Shade/packages/shade-storage-encrypted/tests/kdf.test.ts

import { describe, test, expect } from 'bun:test';
import {
  buildAad, deriveFieldKey, deriveMasterKey, deriveNonce, deriveStorageKey,
  hkdfDerive, DEFAULT_SCRYPT,
} from '../src/crypto/kdf.js';

describe('KDF — masterKey', () => {
  const salt = new Uint8Array(16).fill(0x42);

  test('deriveMasterKey is deterministic for the same input', async () => {
    const fast = { ...DEFAULT_SCRYPT, N: 1 << 10 };
    const a = await deriveMasterKey('correct-horse-battery-staple', salt, fast);
    const b = await deriveMasterKey('correct-horse-battery-staple', salt, fast);
    expect(a).toEqual(b);
    expect(a.length).toBe(32);
  });

  test('different passphrase → different masterKey', async () => {
    const fast = { ...DEFAULT_SCRYPT, N: 1 << 10 };
    const a = await deriveMasterKey('alpha', salt, fast);
    const b = await deriveMasterKey('beta',  salt, fast);
    expect(a).not.toEqual(b);
  });

  test('different salt → different masterKey', async () => {
    const fast = { ...DEFAULT_SCRYPT, N: 1 << 10 };
    const otherSalt = new Uint8Array(16).fill(0x43);
    const a = await deriveMasterKey('p', salt, fast);
    const b = await deriveMasterKey('p', otherSalt, fast);
    expect(a).not.toEqual(b);
  });

  test('NFKC-normalises passphrase', async () => {
    const fast = { ...DEFAULT_SCRYPT, N: 1 << 10 };
    // U+00E9 (é, single codepoint) vs U+0065 U+0301 (e + combining acute)
    const composed = await deriveMasterKey('café', salt, fast);
    const decomposed = await deriveMasterKey('café', salt, fast);
    expect(composed).toEqual(decomposed);
  });

  test('rejects empty passphrase', async () => {
    await expect(deriveMasterKey('', salt)).rejects.toThrow(/non-empty/);
  });

  test('rejects too-short salt', async () => {
    await expect(deriveMasterKey('p', new Uint8Array(8))).rejects.toThrow(/at least 16/);
  });
});

describe('KDF — derivation chain', () => {
  test('storageKey is HKDF("shade-storage-v1")', () => {
    const master = new Uint8Array(32).fill(7);
    const sk = deriveStorageKey(master);
    const expected = hkdfDerive(master, 'shade-storage-v1', 32);
    expect(sk).toEqual(expected);
    expect(sk.length).toBe(32);
  });

  test('fieldKey changes per (table, column)', () => {
    const sk = new Uint8Array(32).fill(9);
    const a = deriveFieldKey(sk, 'sessions', 'session');
    const b = deriveFieldKey(sk, 'sessions', 'identity');
    const c = deriveFieldKey(sk, 'identity', 'session');
    expect(a).not.toEqual(b);
    expect(a).not.toEqual(c);
    expect(b).not.toEqual(c);
  });

  test('nonce is deterministic per (rowKey, table, pk)', () => {
    const k = new Uint8Array(32).fill(11);
    const n1 = deriveNonce(k, 'sessions', 'alice');
    const n2 = deriveNonce(k, 'sessions', 'alice');
    expect(n1).toEqual(n2);
    expect(n1.length).toBe(12);
  });

  test('nonce changes when pk changes', () => {
    const k = new Uint8Array(32).fill(11);
    const n1 = deriveNonce(k, 'sessions', 'alice');
    const n2 = deriveNonce(k, 'sessions', 'bob');
    expect(n1).not.toEqual(n2);
  });

  test('nonce changes when table changes', () => {
    const k = new Uint8Array(32).fill(11);
    const n1 = deriveNonce(k, 'sessions', 'alice');
    const n2 = deriveNonce(k, 'identity', 'alice');
    expect(n1).not.toEqual(n2);
  });
});

describe('KDF — AAD binding', () => {
  test('buildAad encodes (table, column, pk)', () => {
    const aad = buildAad('sessions', 'session', 'alice');
    expect(new TextDecoder().decode(aad)).toBe('shade-aad-v1|sessions|session|alice');
  });

  test('AAD differs for any change in binding tuple', () => {
    const a = buildAad('sessions', 'session', 'alice');
    const b = buildAad('sessions', 'session', 'bob');
    const c = buildAad('sessions', 'trust', 'alice');
    const d = buildAad('identity', 'session', 'alice');
    expect(a).not.toEqual(b);
    expect(a).not.toEqual(c);
    expect(a).not.toEqual(d);
  });
});