even more tests

internal/controlplane/handlers_oauth_test.go

@@ -834,6 +834,7 @@ func (p partialDbParamsMatcher) Matches(x interface{}) bool {
 	}
 
 	typedX.SessionState = ""
+
 	return cmp.Equal(typedX, p.value,
 		cmpopts.IgnoreFields(db.CreateSessionStateParams{}, "ProviderConfig"))
 }

internal/crypto/engine_test.go

@@ -31,7 +31,28 @@ import (
 //Test both the algorithm and the engine in one test suite
 // TODO: if we add additional algorithms in future, we should split up testing
 
-func TestKeyLoadFail(t *testing.T) {
+func TestNewFromCryptoConfig(t *testing.T) {
+	t.Parallel()
+
+	config := &server.Config{
+		Crypto: server.CryptoConfig{
+			KeyStore: server.KeyStoreConfig{
+				Type: "local",
+				Config: map[string]any{
+					"key_dir": "./testdata",
+				},
+			},
+			Default: server.DefaultCrypto{
+				KeyID:     "test_encryption_key",
+				Algorithm: string(algorithms.Aes256Cfb),
+			},
+		},
+	}
+	_, err := NewEngineFromConfig(config)
+	require.NoError(t, err)
+}
+
+func TestNewKeyLoadFail(t *testing.T) {
 	t.Parallel()
 
 	config := &server.Config{
@@ -43,6 +64,59 @@ func TestKeyLoadFail(t *testing.T) {
 	require.ErrorContains(t, err, "failed to read token key file")
 }
 
+func TestNewKeyRejectsEmptyConfig(t *testing.T) {
+	t.Parallel()
+
+	config := &server.Config{}
+	_, err := NewEngineFromConfig(config)
+	require.ErrorContains(t, err, "no encryption keys configured")
+}
+
+func TestNewKeyRejectsBadAlgo(t *testing.T) {
+	t.Parallel()
+
+	config := &server.Config{
+		Crypto: server.CryptoConfig{
+			KeyStore: server.KeyStoreConfig{
+				Type: "local",
+				Config: map[string]any{
+					"key_dir": "./testdata",
+				},
+			},
+			Default: server.DefaultCrypto{
+				KeyID:     "test_encryption_key",
+				Algorithm: "I'm a little teapot",
+			},
+		},
+	}
+	_, err := NewEngineFromConfig(config)
+	require.ErrorIs(t, err, algorithms.ErrUnknownAlgorithm)
+}
+
+func TestNewKeyRejectsBadFallbackAlgo(t *testing.T) {
+	t.Parallel()
+
+	config := &server.Config{
+		Crypto: server.CryptoConfig{
+			KeyStore: server.KeyStoreConfig{
+				Type: "local",
+				Config: map[string]any{
+					"key_dir": "./testdata",
+				},
+			},
+			Default: server.DefaultCrypto{
+				KeyID:     "test_encryption_key",
+				Algorithm: string(algorithms.Aes256Cfb),
+			},
+			Fallback: server.FallbackCrypto{
+				Algorithms: []string{"what even is this?"},
+			},
+		},
+	}
+	_, err := NewEngineFromConfig(config)
+	require.ErrorIs(t, err, algorithms.ErrUnknownAlgorithm)
+}
+
 func TestEncryptDecryptBytes(t *testing.T) {
 	t.Parallel()