From 1ed477602c09293afe2ee20b77c4187f9dffaa50 Mon Sep 17 00:00:00 2001
From: CallMeTechie <34693633+CallMeTechie@users.noreply.github.com>
Date: Fri, 26 Jun 2026 23:04:15 +0200
Subject: [PATCH] test(crypto): make tampered-ciphertext tamper deterministic
 (fix 1/256 flake)

---
 tests/crypto.test.js | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/tests/crypto.test.js b/tests/crypto.test.js
index 3836b0a2..f1cacaf5 100644
--- a/tests/crypto.test.js
+++ b/tests/crypto.test.js
@@ -45,7 +45,12 @@ describe('encrypt / decrypt', () => {
   it('throws on tampered ciphertext', () => {
     const ciphertext = encrypt('secret');
     const parts = ciphertext.split(':');
-    parts[2] = 'ff' + parts[2].slice(2); // tamper with encrypted data
+    // Flip the first ciphertext byte (XOR 0xff) so the tamper is ALWAYS a real change.
+    // Overwriting with a fixed 'ff' was a no-op ~1/256 of the time (when the random GCM
+    // ciphertext already started with 0xff), making this test flaky.
+    const buf = Buffer.from(parts[2], 'hex');
+    buf[0] ^= 0xff;
+    parts[2] = buf.toString('hex'); // tamper with encrypted data
     assert.throws(() => decrypt(parts.join(':')));
   });