platforms/backend/api/internal/logic/common/client_security_test.go

package common

import (
	"testing"

	"git.apinb.com/heqiapp/platforms/backend/api/internal/config"
)

func TestClientValidPhone(t *testing.T) {
	tests := map[string]bool{
		"13800138000":  true,
		"12800138000":  false,
		"1380013800":   false,
		"138001380000": false,
		"":             false,
	}
	for phone, want := range tests {
		if got := ValidPhone(phone); got != want {
			t.Errorf("ValidPhone(%q) = %v, want %v", phone, got, want)
		}
	}
}

func TestProtectFieldUsesRandomCiphertextAndStableFingerprint(t *testing.T) {
	original := config.Spec.Global.FieldEncryptionKey
	config.Spec.Global.FieldEncryptionKey = "0123456789abcdef0123456789abcdef"
	t.Cleanup(func() { config.Spec.Global.FieldEncryptionKey = original })

	firstCipher, firstFingerprint, err := protectField("6222021234567890")
	if err != nil {
		t.Fatal(err)
	}
	secondCipher, secondFingerprint, err := protectField("6222021234567890")
	if err != nil {
		t.Fatal(err)
	}
	if firstCipher == secondCipher {
		t.Fatal("AES-GCM ciphertext must use a fresh nonce")
	}
	if firstFingerprint != secondFingerprint {
		t.Fatal("the same card number must have a stable HMAC fingerprint")
	}
}