// Encryption at rest for order data: round trip, randomised ciphertext, stable keyed hash, key required.
import { test, expect } from 'vitest';

test('order data is encrypted and hashed with the configured key', async () => {
  process.env.DATA_ENCRYPTION_KEY = 'a'.repeat(64);
  const { encrypt, decrypt, hashId } = await import('../../app/lib/crypto.server.ts');
  const c1 = encrypt('gid://shopify/Order/12345');
  const c2 = encrypt('gid://shopify/Order/12345');
  expect(c1).toMatch(/^v1:/);
  expect(c1).not.toContain('12345');
  expect(c1).not.toEqual(c2); // random IV
  expect(decrypt(c1)).toBe('gid://shopify/Order/12345');
  expect(decrypt('v1:' + Buffer.from('tampered-data-xxxxxxxxxxxxxxxxxxxx').toString('base64'))).toBeNull();
  expect(hashId('12345')).toEqual(hashId('12345'));
  expect(hashId('12345')).not.toContain('12345');
  expect(encrypt(null)).toBeNull();
});