Update

backend/test/secrets.test.ts

@@ -0,0 +1,26 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { decryptSecret, encryptSecret, isEncryptedSecret } from "../src/secrets.js";
+
+test("database secrets are encrypted and can be decrypted", () => {
+  process.env.SECRET_ENCRYPTION_KEY = "test-secret-key";
+
+  const encrypted = encryptSecret("zammad-token-with-specials-!$%&/()=?");
+
+  assert.equal(isEncryptedSecret(encrypted), true);
+  assert.notEqual(encrypted, "zammad-token-with-specials-!$%&/()=?");
+  assert.equal(decryptSecret(encrypted), "zammad-token-with-specials-!$%&/()=?");
+});
+
+test("plain legacy secrets are read as-is until migration encrypts them", () => {
+  assert.equal(decryptSecret("legacy-token"), "legacy-token");
+  assert.equal(decryptSecret(null), null);
+});
+
+test("already encrypted secrets are not encrypted twice", () => {
+  process.env.SECRET_ENCRYPTION_KEY = "test-secret-key";
+
+  const encrypted = encryptSecret("zammad-token");
+
+  assert.equal(encryptSecret(encrypted), encrypted);
+});