node-avo-inspector 1.2.0 → 2.0.0-beta.2

package/src/__tests__/TestAvoEncryption.ts

@@ -1,515 +0,0 @@
-import * as crypto from "crypto";
-import { AvoEncryption } from "../AvoEncryption";
-import { AvoNetworkCallsHandler } from "../AvoNetworkCallsHandler";
-import { AvoInspectorEnv } from "../AvoInspectorEnv";
-import { AvoGuid } from "../AvoGuid";
-import { mockedReturns } from "./constants";
-
-// Generate a test key pair for encryption tests
-function generateTestKeyPair() {
-  const ecdh = crypto.createECDH("prime256v1");
-  ecdh.generateKeys();
-  return {
-    publicKey: ecdh.getPublicKey("hex"),
-    privateKey: ecdh.getPrivateKey(),
-    ecdh,
-  };
-}
-
-function parseWireFormat(encryptedBase64: string) {
-  const wire = Buffer.from(encryptedBase64, "base64");
-  return {
-    version: wire[0],
-    ephemeralPubKey: wire.subarray(1, 66),
-    iv: wire.subarray(66, 82),
-    authTag: wire.subarray(82, 98),
-    ciphertext: wire.subarray(98),
-    wire,
-  };
-}
-
-describe("AvoEncryption", () => {
-  describe("shouldEncrypt", () => {
-    const dummyHexKey = "deadbeef";
-
-    test("dev + key => true", () => {
-      expect(AvoEncryption.shouldEncrypt(AvoInspectorEnv.Dev, dummyHexKey)).toBe(true);
-    });
-
-    test("staging + key => true", () => {
-      expect(AvoEncryption.shouldEncrypt(AvoInspectorEnv.Staging, dummyHexKey)).toBe(true);
-    });
-
-    test("prod + key => false", () => {
-      expect(AvoEncryption.shouldEncrypt(AvoInspectorEnv.Prod, dummyHexKey)).toBe(false);
-    });
-
-    test("dev + null => false", () => {
-      expect(AvoEncryption.shouldEncrypt(AvoInspectorEnv.Dev, undefined)).toBe(false);
-    });
-
-    test("dev + empty string => false", () => {
-      expect(AvoEncryption.shouldEncrypt(AvoInspectorEnv.Dev, "")).toBe(false);
-    });
-  });
-
-  describe("wire format", () => {
-    const testKeyPair = generateTestKeyPair();
-
-    test("base64Decode(output).length >= 99", () => {
-      const encrypted = AvoEncryption.encryptValue("hello", testKeyPair.publicKey);
-      expect(encrypted).not.toBeNull();
-      const decoded = Buffer.from(encrypted!, "base64");
-      // 1 (version) + 65 (ephemeral pubkey) + 16 (IV) + 16 (auth tag) + ciphertext >= 1
-      expect(decoded.length).toBeGreaterThanOrEqual(99);
-    });
-
-    test("output[0] == 0x00 (version byte)", () => {
-      const encrypted = AvoEncryption.encryptValue("hello", testKeyPair.publicKey);
-      const decoded = Buffer.from(encrypted!, "base64");
-      expect(decoded[0]).toBe(0x00);
-    });
-
-    test("output[1] == 0x04 (uncompressed pubkey marker)", () => {
-      const encrypted = AvoEncryption.encryptValue("hello", testKeyPair.publicKey);
-      const decoded = Buffer.from(encrypted!, "base64");
-      expect(decoded[1]).toBe(0x04);
-    });
-
-    test("ephemeral public key is 65 bytes (uncompressed)", () => {
-      const encrypted = AvoEncryption.encryptValue("test data", testKeyPair.publicKey);
-      const decoded = Buffer.from(encrypted!, "base64");
-      // bytes 1..65 are the ephemeral public key
-      const ephemeralPubKey = decoded.subarray(1, 66);
-      expect(ephemeralPubKey.length).toBe(65);
-      expect(ephemeralPubKey[0]).toBe(0x04); // uncompressed marker
-    });
-  });
-
-  describe("round-trip encrypt/decrypt", () => {
-    test("can decrypt back to original plaintext", () => {
-      const ecdh = crypto.createECDH("prime256v1");
-      ecdh.generateKeys();
-      const recipientPubKeyHex = ecdh.getPublicKey("hex");
-
-      const plaintext = "Hello, encryption!";
-      const encrypted = AvoEncryption.encryptValue(plaintext, recipientPubKeyHex);
-      expect(encrypted).not.toBeNull();
-
-      // Decrypt: parse wire format
-      const { version, ephemeralPubKey, iv, authTag, ciphertext } = parseWireFormat(encrypted!);
-      expect(version).toBe(0x00);
-
-      // Compute shared secret the same way
-      const sharedSecret = ecdh.computeSecret(ephemeralPubKey);
-      const aesKey = crypto.createHash("sha256").update(sharedSecret).digest();
-
-      const decipher = crypto.createDecipheriv("aes-256-gcm", aesKey, iv, {
-        authTagLength: 16,
-      });
-      decipher.setAuthTag(authTag);
-      let decrypted = decipher.update(ciphertext);
-      decrypted = Buffer.concat([decrypted, decipher.final()]);
-
-      expect(decrypted.toString("utf8")).toBe(plaintext);
-    });
-
-    test("different encryptions of same value produce different ciphertext", () => {
-      const ecdh = crypto.createECDH("prime256v1");
-      ecdh.generateKeys();
-      const pubKey = ecdh.getPublicKey("hex");
-
-      const enc1 = AvoEncryption.encryptValue("same", pubKey);
-      const enc2 = AvoEncryption.encryptValue("same", pubKey);
-      // Ephemeral keys differ each time, so output differs
-      expect(enc1).not.toBe(enc2);
-    });
-  });
-
-  describe("encryption failure handling", () => {
-    test("returns null and warns on invalid key", () => {
-      const warnSpy = jest.spyOn(console, "warn").mockImplementation(() => {});
-      const result = AvoEncryption.encryptValue("hello", "not-a-valid-hex-key");
-      expect(result).toBeNull();
-      expect(warnSpy).toHaveBeenCalledWith(
-        expect.stringContaining("[Avo Inspector] Warning:")
-      );
-      warnSpy.mockRestore();
-    });
-  });
-
-  describe("isListType", () => {
-    test("detects list types", () => {
-      expect(AvoEncryption.isListType("list(string)")).toBe(true);
-      expect(AvoEncryption.isListType("list(int)")).toBe(true);
-      expect(AvoEncryption.isListType("list(object)")).toBe(true);
-    });
-
-    test("non-list types return false", () => {
-      expect(AvoEncryption.isListType("string")).toBe(false);
-      expect(AvoEncryption.isListType("int")).toBe(false);
-      expect(AvoEncryption.isListType("object")).toBe(false);
-    });
-  });
-});
-
-describe("AvoNetworkCallsHandler encryption integration", () => {
-  const inspectorVersion = process.env.npm_package_version || "";
-
-  beforeEach(() => {
-    const now = new Date();
-    // @ts-ignore
-    jest.spyOn(global, "Date").mockImplementation(() => now);
-    jest
-      .spyOn(AvoGuid as any, "newGuid")
-      .mockImplementation(() => mockedReturns.GUID);
-  });
-
-  afterEach(() => {
-    jest.restoreAllMocks();
-  });
-
-  test("publicEncryptionKey included in base body when non-null and non-empty", () => {
-    const pubKey = "deadbeef";
-    const handler = new AvoNetworkCallsHandler(
-      "api-key",
-      AvoInspectorEnv.Dev,
-      "app",
-      "1.0",
-      inspectorVersion,
-      pubKey
-    );
-
-    const body = handler.bodyForEventSchemaCall(
-      "anon-id",
-      "test-event",
-      [{ propertyName: "prop1", propertyType: "string" }],
-      null,
-      null
-    );
-
-    expect((body as any).publicEncryptionKey).toBe(pubKey);
-  });
-
-  test("publicEncryptionKey NOT included in base body when null", () => {
-    const handler = new AvoNetworkCallsHandler(
-      "api-key",
-      AvoInspectorEnv.Dev,
-      "app",
-      "1.0",
-      inspectorVersion,
-      undefined
-    );
-
-    const body = handler.bodyForEventSchemaCall(
-      "anon-id",
-      "test-event",
-      [{ propertyName: "prop1", propertyType: "string" }],
-      null,
-      null
-    );
-
-    expect((body as any).publicEncryptionKey).toBeUndefined();
-  });
-
-  test("publicEncryptionKey NOT included in base body when empty string", () => {
-    const handler = new AvoNetworkCallsHandler(
-      "api-key",
-      AvoInspectorEnv.Dev,
-      "app",
-      "1.0",
-      inspectorVersion,
-      ""
-    );
-
-    const body = handler.bodyForEventSchemaCall(
-      "anon-id",
-      "test-event",
-      [{ propertyName: "prop1", propertyType: "string" }],
-      null,
-      null
-    );
-
-    expect((body as any).publicEncryptionKey).toBeUndefined();
-  });
-
-  test("dev env with key: properties are encrypted with encryptedPropertyValue", () => {
-    const ecdh = crypto.createECDH("prime256v1");
-    ecdh.generateKeys();
-    const pubKey = ecdh.getPublicKey("hex");
-
-    const handler = new AvoNetworkCallsHandler(
-      "api-key",
-      AvoInspectorEnv.Dev,
-      "app",
-      "1.0",
-      inspectorVersion,
-      pubKey
-    );
-
-    const body = handler.bodyForEventSchemaCall(
-      "anon-id",
-      "test-event",
-      [{ propertyName: "username", propertyType: "string" }],
-      null,
-      null,
-      { username: "alice" }
-    );
-
-    // Should have encryptedPropertyValue alongside propertyType
-    expect(body.eventProperties.length).toBe(1);
-    expect(body.eventProperties[0].propertyName).toBe("username");
-    expect((body.eventProperties[0] as any).encryptedPropertyValue).toBeDefined();
-    expect((body.eventProperties[0] as any).propertyType).toBe("string");
-  });
-
-  test("prod env: no encryptedPropertyValue, propertyType kept as-is", () => {
-    const ecdh = crypto.createECDH("prime256v1");
-    ecdh.generateKeys();
-    const pubKey = ecdh.getPublicKey("hex");
-
-    const handler = new AvoNetworkCallsHandler(
-      "api-key",
-      AvoInspectorEnv.Prod,
-      "app",
-      "1.0",
-      inspectorVersion,
-      pubKey
-    );
-
-    const body = handler.bodyForEventSchemaCall(
-      "anon-id",
-      "test-event",
-      [{ propertyName: "username", propertyType: "string" }],
-      null,
-      null
-    );
-
-    expect(body.eventProperties.length).toBe(1);
-    expect((body.eventProperties[0] as any).propertyType).toBe("string");
-    expect((body.eventProperties[0] as any).encryptedPropertyValue).toBeUndefined();
-  });
-
-  test("list-type properties are omitted entirely when encryption is active", () => {
-    const ecdh = crypto.createECDH("prime256v1");
-    ecdh.generateKeys();
-    const pubKey = ecdh.getPublicKey("hex");
-
-    const handler = new AvoNetworkCallsHandler(
-      "api-key",
-      AvoInspectorEnv.Dev,
-      "app",
-      "1.0",
-      inspectorVersion,
-      pubKey
-    );
-
-    const body = handler.bodyForEventSchemaCall(
-      "anon-id",
-      "test-event",
-      [
-        { propertyName: "name", propertyType: "string" },
-        { propertyName: "tags", propertyType: "list(string)" },
-        { propertyName: "scores", propertyType: "list(int)" },
-      ],
-      null,
-      null,
-      { name: "Alice", tags: ["a", "b"], scores: [1, 2] }
-    );
-
-    // List types should be omitted
-    expect(body.eventProperties.length).toBe(1);
-    expect(body.eventProperties[0].propertyName).toBe("name");
-  });
-
-  test("encryption failure: property is omitted, warning logged", () => {
-    const warnSpy = jest.spyOn(console, "warn").mockImplementation(() => {});
-
-    const handler = new AvoNetworkCallsHandler(
-      "api-key",
-      AvoInspectorEnv.Dev,
-      "app",
-      "1.0",
-      inspectorVersion,
-      "invalid-key-that-will-fail"
-    );
-
-    const body = handler.bodyForEventSchemaCall(
-      "anon-id",
-      "test-event",
-      [{ propertyName: "prop1", propertyType: "string" }],
-      null,
-      null,
-      { prop1: "hello" }
-    );
-
-    // Property should be omitted on failure
-    expect(body.eventProperties.length).toBe(0);
-    expect(warnSpy).toHaveBeenCalledWith(
-      expect.stringContaining("[Avo Inspector] Warning:")
-    );
-    warnSpy.mockRestore();
-  });
-
-  test("non-string value (number) is JSON.stringify'd before encryption", () => {
-    const ecdh = crypto.createECDH("prime256v1");
-    ecdh.generateKeys();
-    const pubKey = ecdh.getPublicKey("hex");
-
-    const handler = new AvoNetworkCallsHandler(
-      "api-key",
-      AvoInspectorEnv.Dev,
-      "app",
-      "1.0",
-      inspectorVersion,
-      pubKey
-    );
-
-    const body = handler.bodyForEventSchemaCall(
-      "anon-id",
-      "test-event",
-      [{ propertyName: "count", propertyType: "int" }],
-      null,
-      null,
-      { count: 42 }
-    );
-
-    expect(body.eventProperties.length).toBe(1);
-    const encryptedValue = (body.eventProperties[0] as any).encryptedPropertyValue;
-    expect(encryptedValue).toBeDefined();
-
-    // Decrypt and verify the value is the JSON-stringified number "42"
-    const { ephemeralPubKey, iv, authTag, ciphertext } = parseWireFormat(encryptedValue);
-
-    const sharedSecret = ecdh.computeSecret(ephemeralPubKey);
-    const aesKey = crypto.createHash("sha256").update(sharedSecret).digest();
-    const decipher = crypto.createDecipheriv("aes-256-gcm", aesKey, iv, {
-      authTagLength: 16,
-    });
-    decipher.setAuthTag(authTag);
-    let decrypted = decipher.update(ciphertext);
-    decrypted = Buffer.concat([decrypted, decipher.final()]);
-    expect(decrypted.toString("utf8")).toBe("42");
-  });
-
-  test("missing property in rawEventProperties encrypts 'null' instead of crashing", () => {
-    const ecdh = crypto.createECDH("prime256v1");
-    ecdh.generateKeys();
-    const pubKey = ecdh.getPublicKey("hex");
-
-    const handler = new AvoNetworkCallsHandler(
-      "api-key",
-      AvoInspectorEnv.Dev,
-      "app",
-      "1.0",
-      inspectorVersion,
-      pubKey
-    );
-
-    // Schema says "missing_prop" exists, but rawEventProperties does NOT have it
-    const body = handler.bodyForEventSchemaCall(
-      "anon-id",
-      "test-event",
-      [{ propertyName: "missing_prop", propertyType: "string" }],
-      null,
-      null,
-      { other_prop: "value" }
-    );
-
-    expect(body.eventProperties.length).toBe(1);
-    const encryptedValue = (body.eventProperties[0] as any).encryptedPropertyValue;
-    expect(encryptedValue).toBeDefined();
-
-    // Decrypt and verify the value is "null"
-    const { ephemeralPubKey, iv, authTag, ciphertext } = parseWireFormat(encryptedValue);
-
-    const sharedSecret = ecdh.computeSecret(ephemeralPubKey);
-    const aesKey = crypto.createHash("sha256").update(sharedSecret).digest();
-    const decipher = crypto.createDecipheriv("aes-256-gcm", aesKey, iv, {
-      authTagLength: 16,
-    });
-    decipher.setAuthTag(authTag);
-    let decrypted = decipher.update(ciphertext);
-    decrypted = Buffer.concat([decrypted, decipher.final()]);
-    expect(decrypted.toString("utf8")).toBe("null");
-  });
-
-  test("children are preserved in encrypted property output", () => {
-    const ecdh = crypto.createECDH("prime256v1");
-    ecdh.generateKeys();
-    const pubKey = ecdh.getPublicKey("hex");
-
-    const handler = new AvoNetworkCallsHandler(
-      "api-key",
-      AvoInspectorEnv.Dev,
-      "app",
-      "1.0",
-      inspectorVersion,
-      pubKey
-    );
-
-    const children = [
-      { propertyName: "street", propertyType: "string" },
-      { propertyName: "zip", propertyType: "int" },
-    ];
-
-    const body = handler.bodyForEventSchemaCall(
-      "anon-id",
-      "test-event",
-      [{ propertyName: "address", propertyType: "object", children }],
-      null,
-      null,
-      { address: { street: "123 Main St", zip: 12345 } }
-    );
-
-    expect(body.eventProperties.length).toBe(1);
-    const prop = body.eventProperties[0] as any;
-    expect(prop.propertyName).toBe("address");
-    expect(prop.encryptedPropertyValue).toBeDefined();
-    expect(prop.children).toEqual(children);
-  });
-
-  test("cross-SDK interop: encrypted wire format structure is correct", () => {
-    const ecdh = crypto.createECDH("prime256v1");
-    ecdh.generateKeys();
-    const pubKey = ecdh.getPublicKey("hex");
-
-    const handler = new AvoNetworkCallsHandler(
-      "api-key",
-      AvoInspectorEnv.Dev,
-      "app",
-      "1.0",
-      inspectorVersion,
-      pubKey
-    );
-
-    const body = handler.bodyForEventSchemaCall(
-      "anon-id",
-      "test-event",
-      [{ propertyName: "email", propertyType: "string" }],
-      null,
-      null,
-      { email: "user@example.com" }
-    );
-
-    const encryptedValue = (body.eventProperties[0] as any).encryptedPropertyValue;
-    expect(encryptedValue).toBeDefined();
-
-    const { version, ephemeralPubKey, iv, authTag, ciphertext, wire } = parseWireFormat(encryptedValue);
-    // Verify wire format: [0x00][65-byte ephemeral pubkey][16-byte IV][16-byte auth tag][ciphertext]
-    expect(wire.length).toBeGreaterThanOrEqual(99);
-    expect(version).toBe(0x00); // version
-    expect(ephemeralPubKey[0]).toBe(0x04); // uncompressed pubkey marker
-
-    // Verify we can decrypt it
-    const sharedSecret = ecdh.computeSecret(ephemeralPubKey);
-    const aesKey = crypto.createHash("sha256").update(sharedSecret).digest();
-    const decipher = crypto.createDecipheriv("aes-256-gcm", aesKey, iv, {
-      authTagLength: 16,
-    });
-    decipher.setAuthTag(authTag);
-    let decrypted = decipher.update(ciphertext);
-    decrypted = Buffer.concat([decrypted, decipher.final()]);
-    expect(decrypted.toString("utf8")).toBe('"user@example.com"');
-  });
-});