Add a unit test suite for internal/cryptox AES-256-GCM encrypt/decrypt and key parsing

[Jagadeeshftw]

📌 Description

internal/cryptox/aesgcm.go implements KeyFromB64, EncryptAESGCM, and DecryptAESGCM — the routines that protect stored GitHub OAuth tokens at rest — yet there is no aesgcm_test.go. This security-critical code is completely untested.

💡 Why it matters: The token-encryption primitives guard credentials at rest; a silent regression here could expose tokens or make them undecryptable.

🧩 Requirements and context

• Test round-trip: Decrypt(Encrypt(x)) == x for various plaintext sizes including empty.
• Test KeyFromB64 rejects non-32-byte keys and invalid base64.
• Test that two encryptions of the same plaintext differ (random nonce) but both decrypt.
• Test tamper detection: flipping a ciphertext byte makes decryption fail (GCM auth).
• Test decryption of a too-short blob returns an error, not a panic.

Non-functional requirements

• Must be secure, tested, and documented.
• Should be efficient and easy to review.

🛠️ Suggested execution

1. Fork the repo and create a branch

git checkout -b test/cryptox-aesgcm

2. Implement changes

• Write/modify the relevant source: none (tests only); add GoDoc if gaps found
• Write comprehensive tests: internal/cryptox/aesgcm_test.go
• Add documentation: brief package GoDoc on aesgcm.go
• Include GoDoc comments where behavior is clarified
• Validate security assumptions: confirm nonce uniqueness and AEAD tamper detection

3. Test and commit

• Run tests:

go test ./internal/cryptox/... -race

• Cover edge cases: empty plaintext, short blob, wrong key, tampered ciphertext
• Include test output and security notes in the PR description.

Example commit message

test(cryptox): cover AES-256-GCM encrypt/decrypt and key parsing

✅ Acceptance criteria

• Round-trip and empty-plaintext cases pass
• Invalid key length and base64 rejected by tests
• Tamper and short-blob cases return errors, no panics
• Coverage for internal/cryptox ≥ 95%

🔒 Security notes

Verifies AEAD integrity and nonce randomness; tests must not hardcode real production keys.

📋 Guidelines

• Minimum 95% test coverage
• Clear documentation
• Timeframe: 96 hours

[prettyboyvic]

I'd like to take this on. I'll keep it tests-only for internal/cryptox AES-GCM/key parsing, cover round-trips, invalid keys, nonce randomness, tamper detection, and short ciphertext handling, then run the package tests with race detection.