Class ServerKeyTest

Standalone verification of ServerKey's AES-GCM sensitive-parameter encoding.

This test deliberately exercises ServerKey DIRECTLY rather than going through ServerSecurityManager: a ServerKey needs only Utilities.getSecureRandom() and ServerSecurityManager.digest(byte[]), both of which are plain statics with no server state, so the whole file runs with no ServerShell, no keys file, no property manager and no network. The manager-level path (the blob.fingerprint wire form and the key-selection map) needs a server context and is NOT covered here - see the README in this package.

There is no JUnit in the IIZI build, so this is a main() with a hand-rolled check counter. It exits with status 0 when every check passes and 1 otherwise, so it can be used as a build gate.

What is proven here:

1. Round-trip fidelity across ASCII, Latin-1 accents, CJK, the empty string, a 64 KiB string, and every single-byte value - UTF-8 in, identical UTF-8 out.
2. Output is base64url with no padding, so it is safe in a cookie value or a URL with no further escaping.
3. Encryption is non-deterministic: the same plaintext under the same key never produces the same blob, because a fresh nonce is drawn per call.
4. Authentication actually works. Every byte position of a blob is flipped in turn and each one must be rejected. This is the whole point of moving from CBC-plus-unkeyed- SHA to GCM, and it is the check that would have caught a tag that was never verified.
5. A blob encrypted under one key is rejected by another key.
6. Truncated and structurally invalid input is rejected rather than silently decoded.
7. Key identity: equals/hashCode ignore the timestamp, and the fingerprint is stable for identical key material.

Run it as a plain Java application with the com.iizix.server plugin and its dependencies on the classpath.