[ci skip] more codex 5.3 improvements

internal/secrets/secrets_test.go

@@ -0,0 +1,27 @@
+package secrets
+
+import (
+	"encoding/base64"
+	"io"
+	"log/slog"
+	"strings"
+	"testing"
+)
+
+func testLogger() *slog.Logger {
+	return slog.New(slog.NewTextHandler(io.Discard, nil))
+}
+
+func TestDecryptRejectsShortCiphertext(t *testing.T) {
+	key := []byte("0123456789abcdef0123456789abcdef")
+	s := New(testLogger(), key)
+
+	encoded := base64.StdEncoding.EncodeToString([]byte{1, 2, 3})
+	_, err := s.Decrypt(encoded)
+	if err == nil {
+		t.Fatal("expected error for short ciphertext, got nil")
+	}
+	if !strings.Contains(err.Error(), "ciphertext is too short") {
+		t.Fatalf("unexpected error: %v", err)
+	}
+}