secret/internal/vault/metadata_test.go

package vault

import (
	"testing"

	"path/filepath"

	"git.eeqj.de/sneak/secret/pkg/agehd"
	"github.com/spf13/afero"
)

func TestVaultMetadata(t *testing.T) {
	fs := afero.NewMemMapFs()
	stateDir := "/test/state"

	t.Run("ComputeDoubleSHA256", func(t *testing.T) {
		// Test data
		data := []byte("test data")
		hash := ComputeDoubleSHA256(data)

		// Verify it's a valid hex string of 64 characters (32 bytes * 2)
		if len(hash) != 64 {
			t.Errorf("Expected hash length of 64, got %d", len(hash))
		}

		// Verify consistency
		hash2 := ComputeDoubleSHA256(data)
		if hash != hash2 {
			t.Errorf("Hash should be consistent for same input")
		}

		// Verify different input produces different hash
		hash3 := ComputeDoubleSHA256([]byte("different data"))
		if hash == hash3 {
			t.Errorf("Different input should produce different hash")
		}
	})

	t.Run("GetNextDerivationIndex", func(t *testing.T) {
		// Test with no existing vaults
		index, err := GetNextDerivationIndex(fs, stateDir, "mnemonic-hash-1")
		if err != nil {
			t.Fatalf("Failed to get derivation index: %v", err)
		}
		if index != 0 {
			t.Errorf("Expected index 0 for first vault, got %d", index)
		}

		// Create a vault with metadata
		vaultDir := filepath.Join(stateDir, "vaults.d", "vault1")
		if err := fs.MkdirAll(vaultDir, 0700); err != nil {
			t.Fatalf("Failed to create vault directory: %v", err)
		}

		metadata1 := &VaultMetadata{
			Name:            "vault1",
			DerivationIndex: 0,
			MnemonicHash:    "mnemonic-hash-1",
			LongTermKeyHash: "key-hash-1",
		}
		if err := SaveVaultMetadata(fs, vaultDir, metadata1); err != nil {
			t.Fatalf("Failed to save metadata: %v", err)
		}

		// Next index for same mnemonic should be 1
		index, err = GetNextDerivationIndex(fs, stateDir, "mnemonic-hash-1")
		if err != nil {
			t.Fatalf("Failed to get derivation index: %v", err)
		}
		if index != 1 {
			t.Errorf("Expected index 1 for second vault with same mnemonic, got %d", index)
		}

		// Different mnemonic should start at 0
		index, err = GetNextDerivationIndex(fs, stateDir, "mnemonic-hash-2")
		if err != nil {
			t.Fatalf("Failed to get derivation index: %v", err)
		}
		if index != 0 {
			t.Errorf("Expected index 0 for first vault with different mnemonic, got %d", index)
		}

		// Add another vault with same mnemonic but higher index
		vaultDir2 := filepath.Join(stateDir, "vaults.d", "vault2")
		if err := fs.MkdirAll(vaultDir2, 0700); err != nil {
			t.Fatalf("Failed to create vault directory: %v", err)
		}

		metadata2 := &VaultMetadata{
			Name:            "vault2",
			DerivationIndex: 5,
			MnemonicHash:    "mnemonic-hash-1",
			LongTermKeyHash: "key-hash-2",
		}
		if err := SaveVaultMetadata(fs, vaultDir2, metadata2); err != nil {
			t.Fatalf("Failed to save metadata: %v", err)
		}

		// Next index should be 6
		index, err = GetNextDerivationIndex(fs, stateDir, "mnemonic-hash-1")
		if err != nil {
			t.Fatalf("Failed to get derivation index: %v", err)
		}
		if index != 6 {
			t.Errorf("Expected index 6 after vault with index 5, got %d", index)
		}
	})

	t.Run("MetadataPersistence", func(t *testing.T) {
		vaultDir := filepath.Join(stateDir, "vaults.d", "test-vault")
		if err := fs.MkdirAll(vaultDir, 0700); err != nil {
			t.Fatalf("Failed to create vault directory: %v", err)
		}

		// Create and save metadata
		metadata := &VaultMetadata{
			Name:            "test-vault",
			DerivationIndex: 3,
			MnemonicHash:    "test-mnemonic-hash",
			LongTermKeyHash: "test-key-hash",
		}

		if err := SaveVaultMetadata(fs, vaultDir, metadata); err != nil {
			t.Fatalf("Failed to save metadata: %v", err)
		}

		// Load and verify
		loaded, err := LoadVaultMetadata(fs, vaultDir)
		if err != nil {
			t.Fatalf("Failed to load metadata: %v", err)
		}

		if loaded.Name != metadata.Name {
			t.Errorf("Name mismatch: expected %s, got %s", metadata.Name, loaded.Name)
		}
		if loaded.DerivationIndex != metadata.DerivationIndex {
			t.Errorf("DerivationIndex mismatch: expected %d, got %d", metadata.DerivationIndex, loaded.DerivationIndex)
		}
		if loaded.MnemonicHash != metadata.MnemonicHash {
			t.Errorf("MnemonicHash mismatch: expected %s, got %s", metadata.MnemonicHash, loaded.MnemonicHash)
		}
		if loaded.LongTermKeyHash != metadata.LongTermKeyHash {
			t.Errorf("LongTermKeyHash mismatch: expected %s, got %s", metadata.LongTermKeyHash, loaded.LongTermKeyHash)
		}
	})

	t.Run("DifferentKeysForDifferentIndices", func(t *testing.T) {
		testMnemonic := "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about"

		// Derive keys with different indices
		identity0, err := agehd.DeriveIdentity(testMnemonic, 0)
		if err != nil {
			t.Fatalf("Failed to derive identity with index 0: %v", err)
		}

		identity1, err := agehd.DeriveIdentity(testMnemonic, 1)
		if err != nil {
			t.Fatalf("Failed to derive identity with index 1: %v", err)
		}

		// Compute hashes
		hash0 := ComputeDoubleSHA256([]byte(identity0.String()))
		hash1 := ComputeDoubleSHA256([]byte(identity1.String()))

		// Verify different indices produce different keys
		if hash0 == hash1 {
			t.Errorf("Different derivation indices should produce different keys")
		}

		// Verify public keys are also different
		if identity0.Recipient().String() == identity1.Recipient().String() {
			t.Errorf("Different derivation indices should produce different public keys")
		}
	})
}