add round-trip tests for recovery tokens

test/fixtures/iapi.conf

@@ -4,7 +4,7 @@ tls_cert: 'test/fixtures/iapi_certs/pki/issued/iapi.127.0.0.1.nip.io.crt'
 
 port: 9876
 
-mail_crypt_issuer_key: '76e2ac45d1f23d3415d7ca4293fd0cf481221a4adceb6a6aa12d137ae0e838f8:aa4779053b7a6625fab3cdf4ff79c42425a3cf8c01c287be90ff5915c43e6162'
+mail_crypt_issuer_key: '3faf36009704b185e93e25b7339e76ffc7db920f174f12d0993fb14ab0bc2bd5:c5215ac38e4bc799ccf2a9e66f6d8004807b5405d046d3de959572a4e88ec508'
 api_token_secret: 'this must be a random high entropy string'
 
 saml:

test/integration/recovery_token_test.rb

@@ -3,13 +3,22 @@ require 'test_helper'
 class RecoveryTokenTest < ActionDispatch::IntegrationTest
   test "token" do
     with_fresh_user do |user, pw, token|
+      cli = "#{IAPI_LOCATION}/bin/mailcrypt-cli.rb"
+      key = Rails.root.join('test/fixtures/iapi_certs/master.kring')
+
+      assert(`#{cli} check-recover -k '#{key}' -t '#{token}'` =~ /pubkey/)
 
       post '/mail_crypt_token', params: {
         pass: pw,
       }
 
-      assert_select '.password-readable', /.{140}/i
       assert_select 'a', /recovery email/i
+
+      assert_select '.password-readable' do |new_token|
+        new_token = new_token.to_s.gsub(/<[^>]*>/,"")
+        res = `#{cli} check-recover -k '#{key}' -t '#{new_token}'`
+        assert(res =~ /pubkey/)
+      end
     end
   end
 end