feat(auth): remember encrypted local login credentials

web/src/core-bridge/worker/credentialCipher.test.ts

@@ -0,0 +1,24 @@
+import { describe, expect, it } from 'vitest';
+import { decryptLogin, encryptLogin } from './credentialCipher';
+
+describe('local encrypted login fields', () => {
+  const endpoint = 'https://drop.test/api/v1/';
+  const fields = { username: 'alice', password: 'a-test-password' };
+  it('restores fields using a non-exportable key while keeping plaintext out of the record', async () => {
+    const value = await encryptLogin(fields, endpoint);
+    expect(value.key.extractable).toBe(false);
+    expect(new TextDecoder().decode(value.ciphertext)).not.toContain(fields.password);
+    expect(await decryptLogin(value, endpoint)).toEqual(fields);
+    await expect(crypto.subtle.exportKey('raw', value.key)).rejects.toThrow();
+  });
+  it('binds a saved credential to its API server and rejects tampering', async () => {
+    const value = await encryptLogin(fields, endpoint);
+    await expect(decryptLogin(value, 'https://other.test/api/v1/')).rejects.toThrow();
+    const bytes = new Uint8Array(value.ciphertext); bytes[0] = (bytes[0] ?? 0) ^ 1;
+    await expect(decryptLogin({ ...value, ciphertext: bytes.buffer }, endpoint)).rejects.toThrow();
+  });
+  it('uses independent random encryption material for repeated saves', async () => {
+    const first = await encryptLogin(fields, endpoint); const second = await encryptLogin(fields, endpoint);
+    expect(first.iv).not.toEqual(second.iv); expect(new Uint8Array(first.ciphertext)).not.toEqual(new Uint8Array(second.ciphertext));
+  });
+});