feat: complete V1 phases 0-7

2026-08-12 14:35:12 +08:00
commit c3dd9be674
311 changed files with 38750 additions and 0 deletions
@@ -0,0 +1,28 @@
+import { describe, expect, it } from 'vitest';
+
+import type { AppConfigService } from '../config/app-config.service';
+import { SensitiveDataService } from './sensitive-data.service';
+
+const config = {
+  fieldEncryptionKey: Buffer.alloc(32, 3),
+  sessionTokenPepper: 'test-session-token-pepper',
+  auditIpHashKey: 'test-audit-ip-hash-key',
+} as AppConfigService;
+
+describe('SensitiveDataService', () => {
+  it('encrypts sensitive values with randomized authenticated ciphertext', () => {
+    const service = new SensitiveDataService(config);
+    const first = service.encrypt('sensitive-openid');
+    const second = service.encrypt('sensitive-openid');
+
+    expect(first).not.toContain('sensitive-openid');
+    expect(first).not.toBe(second);
+    expect(service.decrypt(first)).toBe('sensitive-openid');
+  });
+
+  it('creates stable domain-separated lookup hashes', () => {
+    const service = new SensitiveDataService(config);
+    expect(service.lookupHash('openid', 'value')).toBe(service.lookupHash('openid', 'value'));
+    expect(service.lookupHash('openid', 'value')).not.toBe(service.lookupHash('unionid', 'value'));
+  });
+});