RC-7

cmd/client/identity_test.go

@@ -2,6 +2,7 @@ package main
 
 import (
 	"encoding/hex"
+	"encoding/json"
 	"os"
 	"path/filepath"
 	"testing"
@@ -24,6 +25,17 @@ func TestBrowserIdentityExportImportRoundTrip(t *testing.T) {
 	if err := exportBrowserIdentity(path, "correct horse battery staple", id); err != nil {
 		t.Fatal(err)
 	}
+	b, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var enc encryptedIdentity
+	if err := json.Unmarshal(b, &enc); err != nil {
+		t.Fatal(err)
+	}
+	if enc.Format != "neuralhunt-identity-export" || enc.ClientID == "" || enc.Iterations != identityKDFIterations || enc.Cipher != "AES-256-GCM" {
+		t.Fatalf("missing portable export metadata: %#v", enc)
+	}
 	got, err := readIdentityImport(path, "correct horse battery staple")
 	if err != nil {
 		t.Fatal(err)
@@ -36,6 +48,16 @@ func TestBrowserIdentityExportImportRoundTrip(t *testing.T) {
 	}
 }
 
+func TestIdentityExportRejectsWeakPassphrase(t *testing.T) {
+	id, _, err := generateIdentity()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := exportBrowserIdentity(filepath.Join(t.TempDir(), "weak.json"), "too-short", id); err == nil {
+		t.Fatal("expected short export passphrase to be rejected")
+	}
+}
+
 func TestRawIdentityImport(t *testing.T) {
 	id, _, err := generateIdentity()
 	if err != nil {