1 files changed, 42 insertions, 0 deletions
diff --git a/packages/meshbay-common/tests/test_webcrypto.py b/packages/meshbay-common/tests/test_webcrypto.py
index 25bcd5c..2ed6405 100644
--- a/packages/meshbay-common/tests/test_webcrypto.py
+++ b/packages/meshbay-common/tests/test_webcrypto.py
@@ -44,3 +44,45 @@ def test_aes_chunk_keys_unique_per_chunk():
     fh   = blake3.blake3(data).digest()
     keys = {chunk_key_aes(gek, fh, i) for i in range(5)}
     assert len(keys) == 5   # all distinct
+
+
+def test_aes_gek_wrap_unwrap_roundtrip():
+    from cryptography.hazmat.primitives.asymmetric.x25519 import X25519PrivateKey
+    from meshbay_common.crypto import (
+        wrap_gek_aes, unwrap_gek_aes, sk_to_raw, pk_to_raw,
+    )
+    gek = generate_gek()
+    sk = X25519PrivateKey.generate()
+    pk_raw = pk_to_raw(sk.public_key())
+    sk_raw = sk_to_raw(sk)
+
+    bundle = wrap_gek_aes(gek, pk_raw)
+    recovered = unwrap_gek_aes(bundle, sk_raw, pk_raw)
+    assert recovered == gek
+
+
+def test_aes_gek_wrap_wrong_key_rejected():
+    from cryptography.hazmat.primitives.asymmetric.x25519 import X25519PrivateKey
+    from meshbay_common.crypto import wrap_gek_aes, unwrap_gek_aes, sk_to_raw, pk_to_raw
+
+    gek = generate_gek()
+    sk_a = X25519PrivateKey.generate()
+    sk_b = X25519PrivateKey.generate()
+
+    bundle = wrap_gek_aes(gek, pk_to_raw(sk_a.public_key()))
+    with pytest.raises(Exception):
+        unwrap_gek_aes(bundle, sk_to_raw(sk_b), pk_to_raw(sk_b.public_key()))
+
+
+def test_aes_gek_wrap_differs_from_chacha_wrap():
+    from cryptography.hazmat.primitives.asymmetric.x25519 import X25519PrivateKey
+    from meshbay_common.crypto import (
+        wrap_gek, wrap_gek_aes, pk_to_raw,
+    )
+    gek = generate_gek()
+    sk = X25519PrivateKey.generate()
+    pk_raw = pk_to_raw(sk.public_key())
+
+    bundle_aes = wrap_gek_aes(gek, pk_raw)
+    bundle_chacha = wrap_gek(gek, pk_raw)
+    assert bundle_aes["wrapped_b64"] != bundle_chacha["wrapped_b64"]