foxhunt/tli/tests/encryption_security_audit.rs

/// Security audit test for Wave 155 encryption implementation
/// This test creates token files and does NOT clean them up for manual inspection

#[tokio::test]
#[ignore] // Ignored by default since it leaves files for inspection
async fn security_audit_create_persistent_tokens() {
    use std::path::PathBuf;
    use tli::auth::token_manager::{FileTokenStorage, TokenStorage};

    // Create persistent test directory
    let test_dir = PathBuf::from("/tmp/foxhunt_security_audit_wave155");

    // Clean up old test data
    let _ = std::fs::remove_dir_all(&test_dir);

    // Create new storage
    let storage = FileTokenStorage::with_directory(test_dir.clone()).unwrap();

    // Create tokens with sensitive data patterns
    let jwt_token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SENSITIVE_SIGNATURE_DATA";
    let refresh_token =
        "Bearer_refresh_token_SECRET_KEY_12345_CONFIDENTIAL_DATA_PASSWORD_CREDENTIALS";

    // Store tokens
    storage.store_access_token(jwt_token).await.unwrap();
    storage.store_refresh_token(refresh_token).await.unwrap();

    // Verify roundtrip works
    let retrieved_access = storage.get_access_token().await.unwrap().unwrap();
    let retrieved_refresh = storage.get_refresh_token().await.unwrap().unwrap();

    assert_eq!(retrieved_access, jwt_token, "Access token roundtrip failed");
    assert_eq!(
        retrieved_refresh, refresh_token,
        "Refresh token roundtrip failed"
    );

    println!("\n=== Wave 155 Security Audit ===");
    println!(
        "\n✅ Tokens created successfully at: {}",
        test_dir.display()
    );
    println!("✅ Encryption roundtrip verified");
    println!("\n📋 Manual inspection instructions:");
    println!("   1. Check files exist: ls -la {}", test_dir.display());
    println!(
        "   2. Check ENC: prefix: head -c 4 {}/access_token",
        test_dir.display()
    );
    println!(
        "   3. Check for plaintext: strings {}/access_token | grep -i 'bearer\\|jwt\\|secret'",
        test_dir.display()
    );
    println!(
        "   4. Check permissions: stat {} /access_token",
        test_dir.display()
    );
    println!("\n⚠️  NOTE: Files are NOT cleaned up for manual inspection");
    println!("   Cleanup command: rm -rf {}", test_dir.display());
}