Posh-SecretSharing

0.5.0

Tests/Public/Split-SecretSharingSecret.Tests.ps1

BeforeDiscovery {
    Import-Module (Join-Path $PSScriptRoot '../../Posh-SecretSharing.psd1') -Force
}

Describe 'Split-SecretSharingSecret' -Tag Unit {
    Context 'single group' {
        It 'returns Count member shares for a single-group T-of-N split' {
            $secret = New-SecretSharingSecret -Entropy 128
            $shares = Split-SecretSharingSecret -Secret $secret -Group @{ Threshold = 3; Count = 5 }
            $shares.Count | Should -Be 5
            foreach ($share in $shares) {
                $share.GroupIndex | Should -Be 0
                $share.GroupThreshold | Should -Be 1
                $share.GroupCount | Should -Be 1
                $share.MemberThreshold | Should -Be 3
            }
        }

        It 'produces a 20-word mnemonic for a 128-bit secret and 33-word mnemonic for a 256-bit secret' {
            $secret128 = New-SecretSharingSecret -Entropy 128
            $share128 = (Split-SecretSharingSecret -Secret $secret128 -Group @{ Threshold = 2; Count = 3 })[0]
            ($share128.Mnemonic -split ' ').Count | Should -Be 20

            $secret256 = New-SecretSharingSecret -Entropy 256
            $share256 = (Split-SecretSharingSecret -Secret $secret256 -Group @{ Threshold = 2; Count = 3 })[0]
            ($share256.Mnemonic -split ' ').Count | Should -Be 33
        }

        It 'produces different mnemonics for the same secret on repeated calls' {
            $secret = New-SecretSharingSecret -Entropy 128
            $sharesA = Split-SecretSharingSecret -Secret $secret -Group @{ Threshold = 2; Count = 3 }
            $sharesB = Split-SecretSharingSecret -Secret $secret -Group @{ Threshold = 2; Count = 3 }
            $sharesA[0].Mnemonic | Should -Not -Be $sharesB[0].Mnemonic
        }
    }

    Context 'multiple groups' {
        It 'returns the sum of each group''s Count for a multi-group split' {
            $secret = New-SecretSharingSecret -Entropy 128
            $shares = Split-SecretSharingSecret -Secret $secret -GroupThreshold 2 -Group @{ Threshold = 2; Count = 3 }, @{ Threshold = 1; Count = 1 }
            $shares.Count | Should -Be 4
            @($shares | Where-Object GroupIndex -eq 0).Count | Should -Be 3
            @($shares | Where-Object GroupIndex -eq 1).Count | Should -Be 1
        }
    }

    Context 'validation' {
        It 'throws when GroupThreshold exceeds the number of -Group entries' {
            $secret = New-SecretSharingSecret -Entropy 128
            { Split-SecretSharingSecret -Secret $secret -GroupThreshold 3 -Group @{ Threshold = 2; Count = 3 } } | Should -Throw
        }

        It 'throws when a Group Threshold exceeds its Count' {
            $secret = New-SecretSharingSecret -Entropy 128
            { Split-SecretSharingSecret -Secret $secret -Group @{ Threshold = 5; Count = 3 } } | Should -Throw
        }

        It 'throws when a Group entry is missing Threshold or Count' {
            $secret = New-SecretSharingSecret -Entropy 128
            { Split-SecretSharingSecret -Secret $secret -Group @{ Threshold = 2 } } | Should -Throw
            { Split-SecretSharingSecret -Secret $secret -Group @{ Count = 3 } } | Should -Throw
        }

        It 'throws when a Group Threshold or Count is out of the 1-16 range' {
            $secret = New-SecretSharingSecret -Entropy 128
            { Split-SecretSharingSecret -Secret $secret -Group @{ Threshold = 0; Count = 3 } } | Should -Throw
            { Split-SecretSharingSecret -Secret $secret -Group @{ Threshold = 2; Count = 17 } } | Should -Throw
        }
    }
}