security: hardening по результатам аудита безопасности

pkg/adapters/crypto/composite/composite_test.go

@@ -947,3 +947,41 @@ func loadGoldenPrivs(
 	}
 	return newFakePriv(fakePqSchemeID, pqRaw), newFakePriv(fakeClassicalSchemeID, classicalRaw)
 }
+
+func TestLimitedWriter_AllowsWritesWithinBudget(t *testing.T) {
+	var buf bytes.Buffer
+	lw := &limitedWriter{writer: &buf, remaining: 10}
+
+	n, err := lw.Write([]byte("hello"))
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if n != 5 {
+		t.Errorf("wrote %d bytes, want 5", n)
+	}
+
+	n, err = lw.Write([]byte("world"))
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if n != 5 {
+		t.Errorf("wrote %d bytes, want 5", n)
+	}
+
+	if buf.String() != "helloworld" {
+		t.Errorf("buffer = %q, want %q", buf.String(), "helloworld")
+	}
+}
+
+func TestLimitedWriter_RejectsOverBudget(t *testing.T) {
+	var buf bytes.Buffer
+	lw := &limitedWriter{writer: &buf, remaining: 3}
+
+	_, err := lw.Write([]byte("hello"))
+	if !errors.Is(err, ErrPlaintextTooLarge) {
+		t.Errorf("error = %v, want ErrPlaintextTooLarge", err)
+	}
+	if buf.Len() != 0 {
+		t.Errorf("buffer len = %d, want 0", buf.Len())
+	}
+}