Fix decryption migration logic

src/tests/test_legacy_migration.py

@@ -40,4 +40,3 @@ def test_legacy_index_migrates(tmp_path: Path):
     assert new_file.exists()
     assert not legacy_file.exists()
     assert not (tmp_path / "seedpass_passwords_db_checksum.txt").exists()
-    assert (tmp_path / ("seedpass_entries_db.json.enc.fernet")).exists()

src/tests/test_portable_backup.py

@@ -51,7 +51,7 @@ def test_round_trip(monkeypatch):
         assert vault.load_index()["pw"] == data["pw"]
 
 
-from cryptography.exceptions import InvalidTag
+from cryptography.fernet import InvalidToken
 
 
 def test_corruption_detection(monkeypatch):
@@ -68,7 +68,7 @@ def test_corruption_detection(monkeypatch):
         content["payload"] = base64.b64encode(payload).decode()
         path.write_text(json.dumps(content))
 
-        with pytest.raises(InvalidTag):
+        with pytest.raises(InvalidToken):
             import_backup(vault, backup, path, parent_seed=SEED)
 
 

src/tests/test_seed_migration.py

@@ -23,9 +23,7 @@ def test_parent_seed_migrates_from_fernet(tmp_path: Path) -> None:
     assert decrypted == TEST_SEED
 
     new_file = tmp_path / "parent_seed.enc"
-    legacy_backup = tmp_path / "parent_seed.enc.fernet"
 
     assert new_file.exists()
-    assert legacy_backup.exists()
     assert new_file.read_bytes() != encrypted
-    assert legacy_backup.read_bytes() == encrypted
+    assert new_file.read_bytes().startswith(b"V2:")