chore: more tests

tests/security/test_encryption.py

@@ -97,3 +97,83 @@ def test_pad_and_unpad_are_inverse():
 
     assert len(padded) % 16 == 0
     assert encryption._unpad_data(padded) == original
+
+
+@pytest.mark.unit
+def test_pad_data_exact_block_size():
+    # When input is exactly 16 bytes, a full block of padding is added
+    original = b"0123456789abcdef"
+    assert len(original) == 16
+
+    padded = encryption._pad_data(original)
+
+    # Should be 32 bytes (16 + 16 padding)
+    assert len(padded) == 32
+    assert encryption._unpad_data(padded) == original
+
+
+@pytest.mark.unit
+def test_pad_data_various_sizes():
+    for size in range(1, 33):
+        data = b"x" * size
+        padded = encryption._pad_data(data)
+        assert len(padded) % 16 == 0
+        assert encryption._unpad_data(padded) == data
+
+
+@pytest.mark.unit
+def test_encrypt_decrypt_complex_credentials(monkeypatch):
+    monkeypatch.setattr(encryption.settings, "ENCRYPTION_SECRET_KEY", "complex-secret")
+
+    credentials = {
+        "token": "abc123",
+        "refresh": "xyz789",
+        "nested": {"key": "value"},
+        "list_field": [1, 2, 3],
+        "unicode": "\u4f60\u597d\u4e16\u754c",
+    }
+
+    encrypted = encryption.encrypt_credentials(credentials, "user-456")
+    decrypted = encryption.decrypt_credentials(encrypted, "user-456")
+
+    assert decrypted == credentials
+
+
+@pytest.mark.unit
+def test_decrypt_with_wrong_user_returns_empty(monkeypatch):
+    monkeypatch.setattr(encryption.settings, "ENCRYPTION_SECRET_KEY", "test-secret")
+
+    credentials = {"token": "abc123"}
+    encrypted = encryption.encrypt_credentials(credentials, "user-1")
+
+    # Decrypting with wrong user should fail gracefully
+    result = encryption.decrypt_credentials(encrypted, "user-2")
+    assert result == {}
+
+
+@pytest.mark.unit
+def test_decrypt_with_wrong_secret_returns_empty(monkeypatch):
+    monkeypatch.setattr(encryption.settings, "ENCRYPTION_SECRET_KEY", "secret-1")
+    credentials = {"token": "abc123"}
+    encrypted = encryption.encrypt_credentials(credentials, "user-1")
+
+    # Change the secret key
+    monkeypatch.setattr(encryption.settings, "ENCRYPTION_SECRET_KEY", "secret-2")
+    result = encryption.decrypt_credentials(encrypted, "user-1")
+    assert result == {}
+
+
+@pytest.mark.unit
+def test_encrypt_credentials_empty_dict(monkeypatch):
+    monkeypatch.setattr(encryption.settings, "ENCRYPTION_SECRET_KEY", "test-secret")
+    assert encryption.encrypt_credentials({}, "user-1") == ""
+
+
+@pytest.mark.unit
+def test_decrypt_credentials_truncated_payload(monkeypatch):
+    monkeypatch.setattr(encryption.settings, "ENCRYPTION_SECRET_KEY", "test-secret")
+    # base64 of only 10 bytes - not enough for salt+iv
+    import base64
+
+    short = base64.b64encode(b"0123456789").decode()
+    assert encryption.decrypt_credentials(short, "user-1") == {}