From 0d852ab3e052bc3eba83ea7d7f3aa096e4921135 Mon Sep 17 00:00:00 2001
From: diegosouzapw <diegosouzapw@users.noreply.github.com>
Date: Tue, 21 Apr 2026 17:46:47 -0300
Subject: [PATCH] fix: restore local test fixes for encryption and resilience

---
 src/lib/db/encryption.ts                    | 54 ++++++++++-----------
 tests/e2e/resilience-plan-alignment.spec.ts |  4 +-
 2 files changed, 30 insertions(+), 28 deletions(-)

diff --git a/src/lib/db/encryption.ts b/src/lib/db/encryption.ts
index 80a27aba7b..f322ceb54a 100644
--- a/src/lib/db/encryption.ts
+++ b/src/lib/db/encryption.ts
@@ -149,41 +149,41 @@ export function decrypt(ciphertext: string | null | undefined): string | null |
 
   const [ivHex, encryptedHex, authTagHex] = parts;
 
-  try {
-    const iv = Buffer.from(ivHex, "hex");
-    const authTag = Buffer.from(authTagHex, "hex");
-    const decipher = createDecipheriv(ALGORITHM, key, iv);
-    decipher.setAuthTag(authTag);
-
-    let decrypted = decipher.update(encryptedHex, "hex", "utf8");
+  const tryDecryptWithKey = (candidateKey: Buffer): string | null => {
     try {
+      const iv = Buffer.from(ivHex, "hex");
+      const authTag = Buffer.from(authTagHex, "hex");
+      const decipher = createDecipheriv(ALGORITHM, candidateKey, iv);
+      decipher.setAuthTag(authTag);
+
+      let decrypted = decipher.update(encryptedHex, "hex", "utf8");
       decrypted += decipher.final("utf8");
-    } catch (finalErr: unknown) {
-      const finalMessage = finalErr instanceof Error ? finalErr.message : String(finalErr);
-      console.error(
-        `[Encryption] Decryption final() failed: ${finalMessage}. ` +
-          `Ciphertext prefix: ${ciphertext.slice(0, 30)}... ` +
-          `Auth tag validation likely failed.`
-      );
-      return ciphertext;
+      return decrypted;
+    } catch {
+      return null;
     }
-    return decrypted;
-  } catch (err: unknown) {
+  };
+
+  try {
+    const decrypted = tryDecryptWithKey(key);
+    if (decrypted !== null) {
+      return decrypted;
+    }
+
     const legacyKey = getLegacyKey();
     if (legacyKey) {
-      try {
-        const iv = Buffer.from(ivHex, "hex");
-        const authTag = Buffer.from(authTagHex, "hex");
-        const legacyDecipher = createDecipheriv(ALGORITHM, legacyKey, iv);
-        legacyDecipher.setAuthTag(authTag);
-
-        let legacyDecrypted = legacyDecipher.update(encryptedHex, "hex", "utf8");
-        legacyDecrypted += legacyDecipher.final("utf8");
+      const legacyDecrypted = tryDecryptWithKey(legacyKey);
+      if (legacyDecrypted !== null) {
         return legacyDecrypted;
-      } catch (legacyErr) {
-        // Fallback failed as well
       }
     }
+
+    console.error(
+      `[Encryption] Decryption failed. Ciphertext prefix: ${ciphertext.slice(0, 30)}... ` +
+        `Auth tag validation likely failed.`
+    );
+    return null;
+  } catch (err: unknown) {
     const message = err instanceof Error ? err.message : String(err);
     console.error("[Encryption] Decryption failed:", message);
     // Return null instead of encrypted ciphertext to prevent sending encrypted tokens to providers
diff --git a/tests/e2e/resilience-plan-alignment.spec.ts b/tests/e2e/resilience-plan-alignment.spec.ts
index 817ebcf5bc..a8ce031ba5 100644
--- a/tests/e2e/resilience-plan-alignment.spec.ts
+++ b/tests/e2e/resilience-plan-alignment.spec.ts
@@ -305,7 +305,9 @@ test.describe("Resilience Plan Alignment", () => {
     await mockResilienceSettings(page);
 
     await gotoDashboardRoute(page, "/dashboard/settings?tab=resilience");
-    await expect(page.getByText("Connection Cooldown")).toBeVisible({ timeout: 15000 });
+    await expect(
+      page.getByRole("heading", { name: "Connection Cooldown", exact: true })
+    ).toBeVisible({ timeout: 15000 });
     await expect(page.getByText("Base cooldown", { exact: true }).first()).toBeVisible();
     await expect(page.getByText("Use upstream retry hints", { exact: true }).first()).toBeVisible();
     await expect(page.getByText("Max backoff steps", { exact: true }).first()).toBeVisible();