test: add regression tests for Jira credential encryption at rest (#1797)

[Ridanshi]

Closes #1797

Investigation result

Issue confirmed — and the encryption fix is already applied. The full Jira credential lifecycle was traced:

Storage path (POST /api/integrations/jira/credentials)

const { encrypted, iv } = encryptToken(apiToken);   // AES-256-GCM
await supabaseAdmin.from("jira_credentials").upsert({
  api_token: encrypted,   // ciphertext stored
  token_iv: iv,           // IV stored
  ...                     // plaintext apiToken never written
});

Read path (GET /api/integrations/jira/credentials)

.select("id, jira_domain, email, project_key, is_active, created_at")
// api_token and token_iv are deliberately excluded from the SELECT

Jira API usage (GET /api/integrations/jira)

const decrypted = decryptToken(cred.api_token, cred.token_iv);
// decrypted token used only for the outbound Jira API call
// never returned in the response

The encryption uses AES-256-GCM (authenticated encryption) via the project's existing encryptToken / decryptToken helpers in src/lib/crypto.ts, keyed from ENCRYPTION_KEY in the environment. This matches the pattern already in use for WakaTime keys and GitHub OAuth tokens.

What was missing

Zero regression tests existed for the credential lifecycle. A future refactor could reintroduce plaintext storage with nothing to catch it.

What this PR adds — test/jira-credentials.test.ts (15 new tests)

Category	Tests
POST — encryption at rest	Encrypted value (not plaintext) is written to DB; response body never contains the token; encryptToken not called when Jira connectivity check fails; 401 for unauthenticated; 400 for invalid domain; 400 for missing fields
GET credentials — token never exposed	SELECT clause excludes api_token and token_iv; serialised response contains no token data; empty array when no credentials exist
DELETE	Specific credential by ID; all credentials without ID
GET Jira data — decryption flow	decryptToken called with DB values; Jira API receives decrypted token; 500 when decryption fails (Jira API not called); 404 for missing credentials; metrics response exposes no credential data

All 15 pass. The 10 pre-existing upstream failures (unrelated to this change) remain unchanged.

[vercel]

@Ridanshi is attempting to deploy a commit to the PRIYANSHU DOSHI's projects Team on Vercel.

A member of the Team first needs to authorize it.

[github-actions]

GSSoC Label Checklist 🏷️

@Priyanshu-byte-coder — please apply the appropriate labels before merging:

Difficulty (pick one):

• level:beginner — 20 pts
• level:intermediate — 35 pts
• level:advanced — 55 pts
• level:critical — 80 pts

Quality (optional):

• quality:clean — ×1.2 multiplier
• quality:exceptional — ×1.5 multiplier

Validation (required to score):

• gssoc:approved — counts for points
• gssoc:invalid / gssoc:spam / gssoc:ai-slop — does not score

Type labels (type:*) are auto-detected from files and title. Review and adjust if needed.
Points formula: (difficulty × quality_multiplier) + type_bonus

[gitguardian]

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

Since your pull request originates from a forked repository, GitGuardian is not able to associate the secrets uncovered with secret incidents on your GitGuardian dashboard.
Skipping this check run and merging your pull request will create secret incidents on your GitGuardian dashboard.

🔎 Detected hardcoded secret in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
-	-	Generic High Entropy Secret	12f2ecc	test/jira-credentials.test.ts	View secret

🛠 Guidelines to remediate hardcoded secrets

1. Understand the implications of revoking this secret by investigating where it is used in your code.
2. Replace and store your secret safely. Learn here the best practices.
3. Revoke and rotate this secret.
4. If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

• following these best practices for managing and storing secrets including API keys and other credentials
• install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

---

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}