feat: 导入 MemRelay 初始源码

backend/tests/test_security.py

@@ -0,0 +1,26 @@
+import base64
+
+import pytest
+
+from memrelay.errors import AppError
+from memrelay.security import SecretBox, load_or_create_master_key, token_digest
+
+
+def test_master_key_is_persisted_and_secrets_are_context_bound(tmp_path) -> None:
+    path = tmp_path / "config" / "master.key"
+    first = load_or_create_master_key(path)
+    second = load_or_create_master_key(path)
+    assert first == second
+    assert len(base64.urlsafe_b64decode(path.read_bytes())) == 32
+
+    box = SecretBox(first)
+    encrypted = box.encrypt("private-value", "vault")
+    assert "private-value" not in encrypted
+    assert box.decrypt(encrypted, "vault") == "private-value"
+    with pytest.raises(AppError, match="加密数据无法解密"):
+        box.decrypt(encrypted, "other-context")
+
+
+def test_token_digest_is_stable_without_storing_plaintext() -> None:
+    assert token_digest("abc") == token_digest("abc")
+    assert token_digest("abc") != token_digest("abcd")