UserCredentialVersion extends CredentialVersion { @Override public void rotate() { final String decryptedPassword = getPassword(); final StringGenerationParameters decryptedGenerationParameters = getGenerationParameters(); setPassword(decryptedPassword); setGenerationParameters(decryptedGenerationParameters); } UserCredentialVersion(final UserCredentialVersionData delegate);  UserCredentialVersion(final String name);  UserCredentialVersion(
    final UserCredentialValue userValue,
    final String name,
    final StringGenerationParameters generationParameters,
    final Encryptor encryptor
  ); @Override String getCredentialType(); @Override void rotate(); String getPassword(); void setPassword(final String password); String getUsername(); void setUsername(final String username); String getSalt(); void setSalt(final String salt); @Override StringGenerationParameters getGenerationParameters(); void setGenerationParameters(final StringGenerationParameters generationParameters); @Override boolean matchesGenerationParameters(final GenerationParameters generationParameters);  }
@Test public void rotate_reEncryptsPasswordWithNewEncryptionKey() { final UUID oldEncryptionKeyUuid = UUID.randomUUID(); final byte[] oldEncryptedPassword = "old-encrypted-password".getBytes(UTF_8); final byte[] oldEncryptedGenerationParams = "old-encrypted-generation-params".getBytes(UTF_8); final byte[] oldNonce = "old-nonce".getBytes(UTF_8); final byte[] oldParametersNonce = "old-parameters-nonce".getBytes(UTF_8); final EncryptedValue parametersEncryption = new EncryptedValue(oldEncryptionKeyUuid, oldEncryptedGenerationParams, oldParametersNonce); final EncryptedValue encryptedUserValue = new EncryptedValue(); encryptedUserValue.setEncryptionKeyUuid(oldEncryptionKeyUuid); encryptedUserValue.setEncryptedValue(oldEncryptedPassword); encryptedUserValue.setNonce(oldNonce); userCredentialData = new UserCredentialVersionData(CREDENTIAL_NAME); userCredentialData.setEncryptedValueData(encryptedUserValue); userCredentialData.setEncryptedGenerationParameters(parametersEncryption); subject = new UserCredentialVersion(userCredentialData); subject.setEncryptor(encryptor); when(encryptor.decrypt(new EncryptedValue(oldEncryptionKeyUuid, oldEncryptedPassword, oldNonce))) .thenReturn(USER_PASSWORD); when(encryptor.decrypt(new EncryptedValue(oldEncryptionKeyUuid, oldEncryptedGenerationParams, oldParametersNonce))) .thenReturn(userGenerationParametersString); when(encryptor.encrypt(eq(USER_PASSWORD))) .thenReturn(new EncryptedValue(ENCRYPTION_KEY_UUID, ENCRYPTED_PASSWORD, NONCE)); when(encryptor.encrypt(eq(userGenerationParametersString))) .thenReturn(new EncryptedValue(ENCRYPTION_KEY_UUID, ENCRYPTED_GENERATION_PARAMS, PARAMETERS_NONCE)); subject.rotate(); verify(encryptor, times(2)).decrypt(any()); verify(encryptor).encrypt(USER_PASSWORD); verify(encryptor).encrypt(userGenerationParametersString); assertThat(userCredentialData.getEncryptionKeyUuid(), equalTo(ENCRYPTION_KEY_UUID)); assertThat(userCredentialData.getEncryptedValueData().getEncryptedValue(), equalTo(ENCRYPTED_PASSWORD)); assertThat(userCredentialData.getEncryptedGenerationParameters().getEncryptedValue(), equalTo(ENCRYPTED_GENERATION_PARAMS)); assertThat(userCredentialData.getNonce(), equalTo(NONCE)); assertThat(userCredentialData.getEncryptedGenerationParameters().getNonce(), equalTo(PARAMETERS_NONCE)); }