Initial public release of Warp.

Repo-Sync-Origin: warpdotdev/warp-internal@12af1d983b
2026-04-28 08:43:33 -05:00
commit 0dbd3d567a
4982 changed files with 1431549 additions and 0 deletions
@@ -0,0 +1,140 @@
+use std::io;
+
+use tink_proto::{KeysetInfo, keyset_info::KeyInfo};
+
+use crate::ManagedSecretValue;
+
+use super::UploadKey;
+
+#[test]
+fn test_import_public_keyset() {
+    super::init();
+
+    // A base64-encoded public keyset as returned by warp-server.
+    let public_key = "COvInMIBEnAKZAo0dHlwZS5nb29nbGVhcGlzLmNvbS9nb29nbGUuY3J5cHRvLnRpbmsuSHBrZVB1YmxpY0tleRIqEgYIARABGAIaIHRaibhtYbpEfh2CSpdDPhh/6lCBnfoO3nqBmZ3VQGJyGAMQARjryJzCASAB";
+    let upload_key =
+        UploadKey::import_public_keyset(public_key).expect("unable to import public keyset");
+
+    let keyset_info = upload_key.public_key.keyset_info();
+    assert_eq!(
+        keyset_info,
+        KeysetInfo {
+            primary_key_id: 407315563,
+            key_info: vec![KeyInfo {
+                key_id: 407315563,
+                status: tink_proto::KeyStatusType::Enabled.into(),
+                type_url: "type.googleapis.com/google.crypto.tink.HpkePublicKey".to_string(),
+                output_prefix_type: tink_proto::OutputPrefixType::Tink.into(),
+            }],
+        }
+    );
+
+    let encrypted = upload_key
+        .encrypt
+        .encrypt(b"hello from rust", b"rust context")
+        .expect("unable to encrypt");
+    assert!(!encrypted.is_empty());
+}
+
+/// An HPKE private key for use in tests.
+///
+/// Created with:
+/// ```sh
+/// $ java -jar /opt/homebrew/Cellar/tinkey/1.12.0/bin/tinkey_deploy.jar create-keyset --key-template DHKEM_X25519_HKDF_SHA256_HKDF_SHA256_AES_256_GCM --out-format json | jq .
+/// ```
+const TEST_PRIVATE_KEY: &str = r#"
+{
+  "primaryKeyId": 625520774,
+  "key": [
+    {
+      "keyData": {
+        "typeUrl": "type.googleapis.com/google.crypto.tink.HpkePrivateKey",
+        "value": "EioSBggBEAEYAhogGHVh0Tju/DHOWEgpuUJ+9P/pXa5tK16udRWoJJwHbnIaIHdq5FthS7H4Q6xSLzCEnbf1z/F1+PTQHev/5PJ+pc+m",
+        "keyMaterialType": "ASYMMETRIC_PRIVATE"
+      },
+      "status": "ENABLED",
+      "keyId": 625520774,
+      "outputPrefixType": "TINK"
+    }
+  ]
+}
+"#;
+
+/// An HPKE public key for use in tests, corresponding to [`TEST_PRIVATE_KEY`].
+///
+/// Created with:
+/// ```sh
+/// $ java -jar /opt/homebrew/Cellar/tinkey/1.12.0/bin/tinkey_deploy.jar create-public-keyset | jq .
+/// < private key JSON on stdin >
+/// ```
+const TEST_PUBLIC_KEY: &str = r#"
+{
+  "primaryKeyId": 625520774,
+  "key": [
+    {
+      "keyData": {
+        "typeUrl": "type.googleapis.com/google.crypto.tink.HpkePublicKey",
+        "value": "EgYIARABGAIaIBh1YdE47vwxzlhIKblCfvT/6V2ubSternUVqCScB25y",
+        "keyMaterialType": "ASYMMETRIC_PUBLIC"
+      },
+      "status": "ENABLED",
+      "keyId": 625520774,
+      "outputPrefixType": "TINK"
+    }
+  ]
+}
+"#;
+
+/// Test encrypting a managed secret value.
+#[test]
+fn test_encrypt_managed_secret() {
+    super::init();
+
+    let keyset = read_keyset_json(TEST_PUBLIC_KEY);
+    let upload_key = UploadKey {
+        encrypt: tink_hybrid::new_encrypt(&keyset).expect("failed to create encrypt primitive"),
+        public_key: keyset,
+    };
+
+    let encrypted = upload_key
+        .encrypt_secret(
+            "user123",
+            "MY_SECRET",
+            &ManagedSecretValue::RawValue {
+                value: "secret".to_string(),
+            },
+        )
+        .expect("failed to encrypt secret");
+    assert!(!encrypted.is_empty());
+}
+
+/// Test our HPKE encryption and decryption primitives. At the very least, they should be able to roundtrip a plaintext value.
+#[test]
+fn test_encrypt_decrypt() {
+    super::init();
+
+    let private_key = read_keyset_json(TEST_PRIVATE_KEY);
+    let public_key = read_keyset_json(TEST_PUBLIC_KEY);
+
+    let encrypt =
+        tink_hybrid::new_encrypt(&public_key).expect("failed to create encrypt primitive");
+    let decrypt =
+        tink_hybrid::new_decrypt(&private_key).expect("failed to create decrypt primitive");
+
+    let context = b"I am context";
+    let plaintext = b"hello from rust";
+
+    let encrypted = encrypt
+        .encrypt(plaintext, context)
+        .expect("failed to encrypt");
+    let decrypted = decrypt
+        .decrypt(&encrypted, context)
+        .expect("failed to decrypt");
+
+    assert_eq!(decrypted, plaintext);
+}
+
+fn read_keyset_json(json: &str) -> tink_core::keyset::Handle {
+    let mut reader = tink_core::keyset::JsonReader::new(io::Cursor::new(json.as_bytes()));
+    tink_core::keyset::insecure::read(&mut reader).expect("failed to read keyset")
+}