Repository navigation
test(workers): pin the 64 KiB AAD boundary through the wasm binding (LAB-9108) - #234
Conversation
The secure-key AAD boundary tests ran only through the NAPI binding. Drive a secure-cache key to exactly 65 536 AAD bytes through the Workers lane, so a drift between the TS MAX_AAD_SIZE and the wasm one fails a test instead of failing inside encrypt() on Workers only. The key budget counts the tenant id, the backend keyPrefix and the compression flag, for both flag values.
Code Review Completed! 🔥The code review was successfully completed based on your current configurations. Kody Guide: Usage and ConfigurationInteracting with Kody
Providing Context (Files & MCPs)Add these hints in your PR description (or a comment) to unlock deeper checks:
Current Kody ConfigurationReview OptionsThe following review options are enabled or disabled:
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
Summary by CodeRabbit
WalkthroughThe workerd tests cover encrypted cache keys at the 65,536-byte AAD limit. They check exact-limit round trips and verify that keys one character over the limit are rejected by ChangesEncrypted cache key boundary
Priority: ⬇️ Low Estimated code review effort: 2 (Simple) | ~10 minutes Change: Other Merge Risk: ⚪ Minimal · up to This change only adds tests for the encrypted cache key size limit. It does not alter production behavior, and no merge-blocking risk was identified. Pre-merge checks |
 |
| Check name | Status | Explanation |
|---|---|---|
| Description check |  |
The description clearly explains the Workers tests for the secure-cache AAD boundary, including the exact-limit and over-limit cases, wasm binding coverage, backend-call checks, and verification resul… |
| Title check | |
The title clearly identifies a Workers test that verifies the 64 KiB AAD boundary through the wasm binding. It is concise and directly related to the main change. |
| Docstring Coverage | |
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1… |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
✨ Finishing Touches
-
📝 Generate docstrings
-
- Commit to this branch
- Create a new PR
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
![kodus-27b[bot]](https://avatars.githubusercontent.com/u/223823690?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
1 participant
The Workers test lane now drives a secure-cache key to the AES-GCM AAD limit through the real wasm binding: a key whose AAD is exactly 65 536 bytes round-trips, and a key one byte longer throws
ConfigurationErrorfrom bothset()andget()before any backend call.Why
The secure-key AAD pre-flight (
EncryptionManagerCore.validateKey) is tested at its boundary only incache.test.ts, which encrypts through the NAPI binding. The Workers entrypoint encrypts throughcachekit-core-wasm, whoseMAX_AAD_SIZEthe TS constant claims to mirror, and nothing drove a key to the limit there. If the two limits drifted, an at-limit key would pass the TS check and fail insideencrypt()inside the reliability executor, on Workers only, with every test green.Change
Test code only, in
test/workers/cache.workers.test.ts. Oneit.eachovercompression: true / false. The key budget is written out from the v0x03 AAD layout (1 + 16 + tenant id + keyPrefix + key +msgpack+True/False), using the cache's own tenant id and a backendkeyPrefix, since the AAD bindskeyPrefix + key. L1 is off so the read decrypts through wasm. The over-limit case counts backendget/setcalls and expects zero.Verification
pnpm --filter @cachekit-io/cachekit test:workers: 171 passed (afterbuild:wasmand the package build).MAX_AAD_SIZEraised by one, both new cases fail (promise resolved "undefined" instead of rejecting). The wasmencrypt()refuses the 65 537-byte AAD inside the executor and degradation swallows it, which is the failure this test exists to catch.tsc -p tsconfig.test.json, eslint and prettier clean on the file.No docs change: test-only.
Closes LAB-9108