From b3afda9ed864ad0bede62194930ff4fd4b78b80a Mon Sep 17 00:00:00 2001
From: Benjamin Toby <devops@tben.me>
Date: Fri, 23 Oct 2026 06:10:41 +0100
Subject: [PATCH] Stop the tamper test from tampering with its own prefix

---
 src/utils/crypt.test.ts | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/src/utils/crypt.test.ts b/src/utils/crypt.test.ts
index 681a7c5..dc274c9 100644
--- a/src/utils/crypt.test.ts
+++ b/src/utils/crypt.test.ts
@@ -42,7 +42,12 @@ describe("encrypt/decrypt", () => {
 
     test("decrypt fails on tampered input", async () => {
         const encrypted = await encrypt("secret");
-        const tampered = "A" + encrypted.slice(1);
-        expect(async () => await decrypt(tampered)).toThrow();
+        // Flip the first character to one it is not, so the ciphertext is
+        // always different: prefixing "A" left it untouched whenever the
+        // base64 happened to start with "A".
+        const first = encrypted[0] === "A" ? "B" : "A";
+        const tampered = first + encrypted.slice(1);
+        expect(tampered).not.toBe(encrypted);
+        await expect(decrypt(tampered)).rejects.toThrow();
     });
 });
\ No newline at end of file