Expand test coverage for Sodium public commands

.github/workflows/Process-PSModule.yml

@@ -27,5 +27,5 @@ permissions:
 
 jobs:
   Process-PSModule:
-    uses: PSModule/Process-PSModule/.github/workflows/workflow.yml@fb1bdb8fefd243292f779d2a856a38db6fe6daf4 # v6.1.13
+    uses: PSModule/Process-PSModule/.github/workflows/workflow.yml@1653be8d36607d9535f600278c44789979477813 # v6.1.16
     secrets: inherit

tests/Sodium.Tests.ps1

@@ -1,6 +1,19 @@
 #Requires -Modules @{ ModuleName = 'Pester'; ModuleVersion = '6.0.0'; MaximumVersion = '6.*' }
 
 Describe 'Sodium' {
+    BeforeAll {
+        $script:ModuleName = 'Sodium'
+        if (-not (Get-Module -Name $script:ModuleName -ErrorAction SilentlyContinue)) {
+            $srcRoot = Split-Path -Path $PSScriptRoot -Parent
+            $manifestPath = Join-Path -Path $srcRoot -ChildPath 'src\Sodium.psd1'
+            if (Test-Path -Path $manifestPath) {
+                Import-Module -Name $manifestPath -Force -ErrorAction Stop
+            } else {
+                throw "Module '$script:ModuleName' is not loaded and no source manifest was found at '$manifestPath'. Build the module first."
+            }
+        }
+    }
+
     Context 'SealedBox - Encryption and Decryption' {
         It 'Encrypts and decrypts a message correctly using valid keys' {
             $keyPair = New-SodiumKeyPair
@@ -49,6 +62,71 @@ Describe 'Sodium' {
                 Should -Throw 'Invalid sealed box. Expected at least 48 bytes but got 16.'
         }
 
+        It 'Rejects an empty message because the parameter is mandatory' {
+            $keyPair = New-SodiumKeyPair
+
+            { ConvertTo-SodiumSealedBox -Message '' -PublicKey $keyPair.PublicKey } | Should -Throw
+        }
+
+        It 'Encrypts and decrypts a message containing Unicode and special characters' {
+            $keyPair = New-SodiumKeyPair
+            $message = 'Hello 🌍! Æøå 日本語 <script>alert(1)</script>'
+
+            $encryptedMessage = ConvertTo-SodiumSealedBox -Message $message -PublicKey $keyPair.PublicKey
+            $decryptedString = ConvertFrom-SodiumSealedBox -SealedBox $encryptedMessage -PublicKey $keyPair.PublicKey -PrivateKey $keyPair.PrivateKey
+
+            $decryptedString | Should -BeExactly $message
+        }
+
+        It 'Produces a different sealed box each time the same message is encrypted' {
+            $keyPair = New-SodiumKeyPair
+            $message = 'Deterministic input should not yield deterministic output'
+
+            $encrypted1 = ConvertTo-SodiumSealedBox -Message $message -PublicKey $keyPair.PublicKey
+            $encrypted2 = ConvertTo-SodiumSealedBox -Message $message -PublicKey $keyPair.PublicKey
+
+            $encrypted1 | Should -Not -Be $encrypted2
+        }
+
+        It 'Fails decryption when the public key does not match the private key' {
+            $keyPair1 = New-SodiumKeyPair
+            $keyPair2 = New-SodiumKeyPair
+            $message = 'Mismatched public key test'
+
+            $encryptedMessage = ConvertTo-SodiumSealedBox -Message $message -PublicKey $keyPair1.PublicKey
+
+            { ConvertFrom-SodiumSealedBox -SealedBox $encryptedMessage -PublicKey $keyPair2.PublicKey -PrivateKey $keyPair1.PrivateKey } |
+                Should -Throw 'Decryption failed.'
+        }
+
+        It 'Rejects encryption with a public key that is valid base64 but the wrong length' {
+            $message = 'Wrong length public key'
+            $shortPublicKey = [Convert]::ToBase64String([byte[]]::new(16))
+
+            { ConvertTo-SodiumSealedBox -Message $message -PublicKey $shortPublicKey } |
+                Should -Throw 'Invalid public key. Expected 32 bytes but got 16.'
+        }
+
+        It 'Rejects decryption with a private key that is valid base64 but the wrong length' {
+            $keyPair = New-SodiumKeyPair
+            $message = 'Wrong length private key'
+            $encryptedMessage = ConvertTo-SodiumSealedBox -Message $message -PublicKey $keyPair.PublicKey
+            $shortPrivateKey = [Convert]::ToBase64String([byte[]]::new(16))
+
+            { ConvertFrom-SodiumSealedBox -SealedBox $encryptedMessage -PrivateKey $shortPrivateKey } |
+                Should -Throw 'Invalid private key. Expected 32 bytes but got 16.'
+        }
+
+        It 'Requires a non-null message parameter' {
+            $keyPair = New-SodiumKeyPair
+
+            { ConvertTo-SodiumSealedBox -Message $null -PublicKey $keyPair.PublicKey } | Should -Throw
+        }
+
+        It 'Requires a non-empty public key parameter' {
+            { ConvertTo-SodiumSealedBox -Message 'test' -PublicKey '' } | Should -Throw
+        }
+
         It 'Encrypts a message correctly when using pipeline input on ConvertTo-SodiumSealedBox' {
             $keyPair = New-SodiumKeyPair
             $publicKey = $keyPair.PublicKey
@@ -103,6 +181,13 @@ Describe 'Sodium' {
             $result = $encryptedMessage | ConvertFrom-SodiumSealedBox -PrivateKey $kp.PrivateKey
             $result | Should -Be $message
         }
+
+        It 'Requires a non-empty private key when no public key is given' {
+            $kp = New-SodiumKeyPair
+            $encryptedMessage = ConvertTo-SodiumSealedBox -Message 'test' -PublicKey $kp.PublicKey
+
+            { ConvertFrom-SodiumSealedBox -SealedBox $encryptedMessage -PrivateKey '' } | Should -Throw
+        }
     }
 
     Context 'Key Pair Generation' {
@@ -150,6 +235,24 @@ Describe 'Sodium' {
             $keyPair1.PublicKey | Should -Be $keyPair2.PublicKey
             $keyPair1.PrivateKey | Should -Be $keyPair2.PrivateKey
         }
+
+        It 'Returns a PSCustomObject with PublicKey and PrivateKey properties' {
+            $keyPair = New-SodiumKeyPair
+
+            $keyPair | Should -BeOfType [PSCustomObject]
+            $keyPair.PublicKey | Should -Not -BeNullOrEmpty
+            $keyPair.PrivateKey | Should -Not -BeNullOrEmpty
+            ($keyPair | Get-Member -MemberType NoteProperty).Name | Should -Contain 'PublicKey'
+            ($keyPair | Get-Member -MemberType NoteProperty).Name | Should -Contain 'PrivateKey'
+        }
+
+        It 'Generates different random key pairs when no seed is provided' {
+            $keyPair1 = New-SodiumKeyPair
+            $keyPair2 = New-SodiumKeyPair
+
+            $keyPair1.PublicKey | Should -Not -Be $keyPair2.PublicKey
+            $keyPair1.PrivateKey | Should -Not -Be $keyPair2.PrivateKey
+        }
     }
 
     Context 'Public Key Derivation' {
@@ -183,6 +286,11 @@ Describe 'Sodium' {
             { Get-SodiumPublicKey -PrivateKey $shortPrivateKey } |
                 Should -Throw 'Invalid private key. Expected 32 bytes but got 16.'
         }
+
+        It 'Get-SodiumPublicKey - Requires a non-empty private key' {
+            { Get-SodiumPublicKey -PrivateKey '' } | Should -Throw
+        }
+
     }
 
     Context 'Runtime diagnostics' {