Function encryptForTest

services/kiloclaw/src/utils/encryption.test.ts:18–36

* Helper: encrypt a string using the same RSA+AES envelope scheme * used by the shared lib (src/lib/encryption.ts). This allows us * to test decryption without importing the shared encryption module.

(value: string, publicKeyPem: string)

 * to test decryption without importing the shared encryption module.
 */
function encryptForTest(value: string, publicKeyPem: string): EncryptedEnvelope {
  const dek = randomBytes(32);
  const iv = randomBytes(16);
  const cipher = createCipheriv('aes-256-gcm', dek, iv);
  let encrypted = cipher.update(value, 'utf8');
  encrypted = Buffer.concat([encrypted, cipher.final()]);
  const authTag = cipher.getAuthTag();
  const encryptedDataBuffer = Buffer.concat([iv, encrypted, authTag]);
  const encryptedDEKBuffer = publicEncrypt(
    { key: publicKeyPem, padding: constants.RSA_PKCS1_OAEP_PADDING, oaepHash: 'sha256' },
    dek
  );
  return {
    encryptedData: encryptedDataBuffer.toString('base64'),
    encryptedDEK: encryptedDEKBuffer.toString('base64'),
    algorithm: 'rsa-aes-256-gcm',
    version: 1,
  };
}

describe('encryption utilities', () => {
  let publicKey: string;