added unit tests

tests/Unit/CryptoTest.php

@@ -0,0 +1,53 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests\Unit;
+
+use PHPUnit\Framework\TestCase;
+
+final class CryptoTest extends TestCase
+{
+    public function testAesRoundTrip(): void
+    {
+        $key = str_repeat('K', 32);
+        $plain = '{"clients":[{"clientCode":"C1"}]}';
+        $enc = aes256_cbc_encrypt_bytes($plain, $key);
+        $this->assertGreaterThan(16, strlen($enc));
+        $dec = aes256_cbc_decrypt_bytes($enc, $key);
+        $this->assertSame($plain, $dec);
+    }
+
+    public function testHkdfDeterministicForToken(): void
+    {
+        $token = bin2hex(random_bytes(16));
+        $k1 = hkdf_session_key_from_token($token);
+        $k2 = hkdf_session_key_from_token($token);
+        $this->assertSame(32, strlen($k1));
+        $this->assertSame($k1, $k2);
+    }
+
+    public function testHkdfDiffersForDifferentTokens(): void
+    {
+        $a = hkdf_session_key_from_token(bin2hex(random_bytes(16)));
+        $b = hkdf_session_key_from_token(bin2hex(random_bytes(16)));
+        $this->assertNotSame($a, $b);
+    }
+
+    public function testDecryptFailsWithWrongKey(): void
+    {
+        $key = str_repeat('K', 32);
+        $enc = aes256_cbc_encrypt_bytes('payload', $key);
+        $this->expectException(\Exception::class);
+        aes256_cbc_decrypt_bytes($enc, str_repeat('X', 32));
+    }
+
+    public function testDecryptFailsWhenCiphertextTampered(): void
+    {
+        $key = str_repeat('K', 32);
+        $enc = aes256_cbc_encrypt_bytes('payload', $key);
+        $enc[20] = $enc[20] === 'a' ? 'b' : 'a';
+        $this->expectException(\Exception::class);
+        aes256_cbc_decrypt_bytes($enc, $key);
+    }
+}