Add optimization branch updates

backend/tests/test_auth_login_encryption.py

@@ -0,0 +1,41 @@
+from __future__ import annotations
+
+import base64
+import unittest
+
+from fastapi import HTTPException
+from cryptography.hazmat.primitives import hashes, serialization
+from cryptography.hazmat.primitives.asymmetric import padding
+
+from app.services.login_crypto import decrypt_login_password, get_login_public_key
+
+
+class AuthLoginEncryptionTest(unittest.TestCase):
+    def test_decrypts_password_encrypted_with_public_key(self) -> None:
+        key_info = get_login_public_key()
+        public_key = serialization.load_pem_public_key(key_info.public_key_pem.encode("utf-8"))
+        ciphertext = public_key.encrypt(
+            "safe-password-123".encode("utf-8"),
+            padding.OAEP(
+                mgf=padding.MGF1(algorithm=hashes.SHA256()),
+                algorithm=hashes.SHA256(),
+                label=None,
+            ),
+        )
+
+        decrypted = decrypt_login_password(base64.b64encode(ciphertext).decode("utf-8"), key_info.key_id)
+
+        self.assertEqual(decrypted, "safe-password-123")
+
+    def test_rejects_unknown_login_key_id(self) -> None:
+        key_info = get_login_public_key()
+
+        with self.assertRaises(HTTPException) as raised:
+            decrypt_login_password("not-a-real-ciphertext", f"{key_info.key_id}-old")
+
+        self.assertEqual(raised.exception.status_code, 400)
+        self.assertEqual(raised.exception.detail, "登录密钥已过期，请刷新后重试")
+
+
+if __name__ == "__main__":
+    unittest.main()