From caa1e6e834012cd08a349a5347a333f0a44ec3e7 Mon Sep 17 00:00:00 2001
From: Claude <claude@volcanic>
Date: Fri, 28 Aug 2026 12:08:37 +0000
Subject: [PATCH] fix(persistence): use ThrowsAny in tamper test; keep AesGcm
 exception subclass visible

---
 .../Encryption/EncryptionService.cs                   | 11 +----------
 tests/VolcanicCore.Tests/EncryptionServiceTests.cs    |  2 +-
 2 files changed, 2 insertions(+), 11 deletions(-)

diff --git a/src/VolcanicCore.Persistence/Encryption/EncryptionService.cs b/src/VolcanicCore.Persistence/Encryption/EncryptionService.cs
index 9dc44bd..b7d71ac 100644
--- a/src/VolcanicCore.Persistence/Encryption/EncryptionService.cs
+++ b/src/VolcanicCore.Persistence/Encryption/EncryptionService.cs
@@ -39,16 +39,7 @@ public sealed class EncryptionService
         var cipher = wire.AsSpan(NonceSize, wire.Length - NonceSize - TagSize);
         var plain = new byte[cipher.Length];
         using var aes = new AesGcm(_key, TagSize);
-        try
-        {
-            aes.Decrypt(nonce, cipher, tag, plain);
-        }
-        catch (CryptographicException ex) when (ex.GetType() != typeof(CryptographicException))
-        {
-            // .NET throws the more specific AuthenticationTagMismatchException on tamper;
-            // normalize to the base type so callers can catch CryptographicException.
-            throw new CryptographicException("Decryption failed: authentication tag mismatch.", ex);
-        }
+        aes.Decrypt(nonce, cipher, tag, plain);
         return System.Text.Encoding.UTF8.GetString(plain);
     }
 }
diff --git a/tests/VolcanicCore.Tests/EncryptionServiceTests.cs b/tests/VolcanicCore.Tests/EncryptionServiceTests.cs
index c80e236..fff0467 100644
--- a/tests/VolcanicCore.Tests/EncryptionServiceTests.cs
+++ b/tests/VolcanicCore.Tests/EncryptionServiceTests.cs
@@ -31,7 +31,7 @@ public class EncryptionServiceTests
         var bytes = Convert.FromBase64String(wire);
         bytes[^1] ^= 0x01;          // flip a bit in the tag
         var tampered = Convert.ToBase64String(bytes);
-        Assert.Throws<CryptographicException>(() => svc.Decrypt(tampered));
+        Assert.ThrowsAny<CryptographicException>(() => svc.Decrypt(tampered));
     }
 
     [Fact]