chore: checkpoint 第一版

internal/hardwarelicense/service_test.go

@@ -0,0 +1,36 @@
+package hardwarelicense
+
+import (
+	"testing"
+	"time"
+
+	"data-terminal-cloud/internal/audit"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+func TestNewServiceRequiresDomainKey(t *testing.T) {
+	for _, key := range []string{"", "not-hex", "00"} {
+		if _, err := NewService(&pgxpool.Pool{}, audit.NewRepository(), key); err == nil {
+			t.Fatalf("key %q should be rejected", key)
+		}
+	}
+}
+
+func TestLicenseCipherUsesBoundAAD(t *testing.T) {
+	service, err := NewService(&pgxpool.Pool{}, audit.NewRepository(), "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef")
+	if err != nil {
+		t.Fatal(err)
+	}
+	expires := time.Date(2027, 1, 2, 3, 4, 5, 0, time.UTC)
+	nonce := make([]byte, service.aead.NonceSize())
+	aad := licenseAAD("license-1", "instance-1", "product-1", expires)
+	ciphertext := service.aead.Seal(nil, nonce, []byte("secret-license-value"), aad)
+	plaintext, err := service.aead.Open(nil, nonce, ciphertext, aad)
+	if err != nil || string(plaintext) != "secret-license-value" {
+		t.Fatalf("round trip = %q, %v", plaintext, err)
+	}
+	if _, err := service.aead.Open(nil, nonce, ciphertext, licenseAAD("license-1", "instance-1", "product-2", expires)); err == nil {
+		t.Fatal("ciphertext must not decrypt for another product")
+	}
+}