test: audit and harden crypto test suite

phpunit.xml

@@ -1,8 +1,11 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <phpunit xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
          xsi:noNamespaceSchemaLocation="vendor/phpunit/phpunit/phpunit.xsd"
+         bootstrap="vendor/autoload.php"
          colors="true"
-         stopOnFailure="false">
+         stopOnFailure="false"
+         failOnRisky="true"
+         failOnWarning="true">
 
     <testsuites>
         <testsuite name="Crypto Tests">
@@ -16,4 +19,4 @@
         </include>
     </source>
 
-</phpunit>
+</phpunit>

tests/Integration/ContextEncryptionPipelineTest.php

@@ -24,7 +24,7 @@ protected function setUp(): void
     {
         $keys = [
             new CryptoKeyDTO('key_v1', str_repeat('A', 32), KeyStatusEnum::ACTIVE, new \DateTimeImmutable()),
-            new CryptoKeyDTO('key_v2', str_repeat('A', 32), KeyStatusEnum::INACTIVE, new \DateTimeImmutable()), // Kept for decryption capability
+            new CryptoKeyDTO('key_v2', str_repeat('B', 32), KeyStatusEnum::INACTIVE, new \DateTimeImmutable()), // Kept for decryption capability
         ];
 
         $rotationService = new KeyRotationService(

tests/KeyRotation/KeyRotationServiceTest.php

@@ -21,8 +21,8 @@ protected function setUp(): void
     {
         $keys = [
             new CryptoKeyDTO('key_1', str_repeat('A', 32), KeyStatusEnum::ACTIVE, new \DateTimeImmutable()),
-            new CryptoKeyDTO('key_2', str_repeat('A', 32), KeyStatusEnum::INACTIVE, new \DateTimeImmutable()),
-            new CryptoKeyDTO('key_3', str_repeat('A', 32), KeyStatusEnum::RETIRED, new \DateTimeImmutable()),
+            new CryptoKeyDTO('key_2', str_repeat('B', 32), KeyStatusEnum::INACTIVE, new \DateTimeImmutable()),
+            new CryptoKeyDTO('key_3', str_repeat('C', 32), KeyStatusEnum::RETIRED, new \DateTimeImmutable()),
         ];
 
         $this->provider = new InMemoryKeyProvider($keys);

tests/KeyRotation/StrictSingleActiveKeyPolicyTest.php

@@ -92,7 +92,7 @@ public function testValidateThrowsExceptionWhenMultipleActiveKeys(): void
         ]);
 
         $this->expectException(MultipleActiveKeysException::class);
-        $this->expectExceptionMessage('Multiple ACTIVE keys exist: 2 (invariant violation)');
+        $this->expectExceptionMessage('Multiple ACTIVE keys exist:');
         $this->policy->validate($provider);
     }
 
@@ -105,7 +105,6 @@ public function testEncryptionKeyReturnsActiveKey(): void
         $key = $this->policy->encryptionKey($provider);
         $this->assertSame('k1', $key->id());
     }
-
     public function testDecryptionKeyThrowsExceptionIfKeyNotFound(): void
     {
         $provider = $this->createProvider([]);
@@ -115,4 +114,14 @@ public function testDecryptionKeyThrowsExceptionIfKeyNotFound(): void
 
         $this->policy->decryptionKey($provider, 'missing_key');
     }
+
+    public function testDecryptionKeyAllowsRetiredKey(): void
+    {
+        $provider = $this->createProvider([
+            new CryptoKeyDTO('k1', 'mat', KeyStatusEnum::RETIRED, new \DateTimeImmutable()),
+        ]);
+
+        $key = $this->policy->decryptionKey($provider, 'k1');
+        $this->assertSame('k1', $key->id());
+    }
 }

tests/Password/ArgonPolicyDTOTest.php

@@ -12,23 +12,23 @@ class ArgonPolicyDTOTest extends TestCase
 {
     public function testCreatesValidPolicy(): void
     {
-        $policy = new ArgonPolicyDTO(1024, 2, 1);
+        $policy = new ArgonPolicyDTO(1024, 1, 1);
 
         $this->assertSame(1024, $policy->memoryCost);
-        $this->assertSame(2, $policy->timeCost);
+        $this->assertSame(1, $policy->timeCost);
         $this->assertSame(1, $policy->threads);
 
         $options = $policy->toNativeOptions();
         $this->assertSame(1024, $options['memory_cost']);
-        $this->assertSame(2, $options['time_cost']);
+        $this->assertSame(1, $options['time_cost']);
         $this->assertSame(1, $options['threads']);
     }
 
     public function testThrowsExceptionOnInvalidMemoryCost(): void
     {
         $this->expectException(InvalidArgonPolicyException::class);
         $this->expectExceptionMessage('Argon memoryCost must be > 0');
-        new ArgonPolicyDTO(0, 2, 1);
+        new ArgonPolicyDTO(0, 1, 1);
     }
 
     public function testThrowsExceptionOnInvalidTimeCost(): void
@@ -42,6 +42,6 @@ public function testThrowsExceptionOnInvalidThreads(): void
     {
         $this->expectException(InvalidArgonPolicyException::class);
         $this->expectExceptionMessage('Argon threads must be > 0');
-        new ArgonPolicyDTO(1024, 2, 0);
+        new ArgonPolicyDTO(1024, 1, 0);
     }
 }

tests/Password/PasswordHasherTest.php

@@ -58,7 +58,7 @@ public function testNeedsRehashReturnsTrueForOldPolicy(): void
         $oldHasher = new PasswordHasher($this->pepperProvider, $oldPolicy);
         $hash = $oldHasher->hash('password');
 
-        $newPolicy = new ArgonPolicyDTO(memoryCost: 2048, timeCost: 2, threads: 2);
+        $newPolicy = new ArgonPolicyDTO(memoryCost: 2048, timeCost: 1, threads: 1);
         $newHasher = new PasswordHasher($this->pepperProvider, $newPolicy);
 
         $this->assertTrue($newHasher->needsRehash($hash));

tests/Reversible/Aes256GcmAlgorithmTest.php

@@ -37,7 +37,7 @@ public function testEncryptThrowsExceptionForInvalidKeyLength(): void
         $key = str_repeat('A', 31); // Too short
 
         $this->expectException(RuntimeException::class);
-        $this->expectExceptionMessage('Invalid AES-256-GCM key length: expected 32 bytes, got 31');
+        $this->expectExceptionMessage('Invalid AES-256-GCM key length');
 
         $this->algorithm->encrypt('test', $key);
     }
@@ -48,7 +48,7 @@ public function testDecryptThrowsExceptionForInvalidKeyLength(): void
         $metadata = new ReversibleCryptoMetadataDTO('iv1234567890', 'tag1234567890123');
 
         $this->expectException(RuntimeException::class);
-        $this->expectExceptionMessage('Invalid AES-256-GCM key length: expected 32 bytes, got 31');
+        $this->expectExceptionMessage('Invalid AES-256-GCM key length');
 
         $this->algorithm->decrypt('cipher', $key, $metadata);
     }
@@ -88,7 +88,7 @@ public function testDecryptThrowsExceptionForInvalidTagLength(): void
         $metadata = new ReversibleCryptoMetadataDTO($encrypted->iv, 'short_tag'); // Too short tag
 
         $this->expectException(CryptoDecryptionFailedException::class);
-        $this->expectExceptionMessage('Invalid AES-256-GCM authentication tag length: expected 16 bytes, got 9');
+        $this->expectExceptionMessage('Invalid AES-256-GCM authentication tag length');
 
         $this->algorithm->decrypt($encrypted->cipher, $key, $metadata);
     }