@Test
public void mapUuidsToKeys_whenTheActiveKeyIsTheOnlyKey_whenThereIsNoMatchingCanaryInTheDatabase_whenDecryptingWithTheWrongKeyRaisesAnHSMException_throwsTheException()
  throws Exception {

  when(encryptionKeysConfiguration.isKeyCreationEnabled()).thenReturn(true);
  when(encryptionKeysConfiguration.getProviders().get(0).getKeys()).thenReturn(asList(activeKeyData));
  when(encryptionKeysConfiguration.getProviders()).thenReturn(asList(activeProvider));
  final EncryptionKeyCanary nonMatchingCanary = new EncryptionKeyCanary();
  nonMatchingCanary.setUuid(UUID.randomUUID());
  nonMatchingCanary.setEncryptedCanaryValue("fake-non-matching-encrypted-value".getBytes(UTF_8));
  nonMatchingCanary.setNonce("fake-non-matching-nonce".getBytes(UTF_8));
  when(encryptionKeyCanaryDataService.findAll())
    .thenReturn(asArrayList(nonMatchingCanary));
  when(activeKeyProxy.matchesCanary(nonMatchingCanary))
    .thenThrow(new RuntimeException(new IllegalBlockSizeException(
      "I don't know what 0x41 means and neither do you")));
  when(encryptionKeyCanaryDataService.save(any(EncryptionKeyCanary.class)))
    .thenReturn(activeKeyCanary);
  subject = new EncryptionKeyCanaryMapper(encryptionKeyCanaryDataService,
    encryptionKeysConfiguration, timedRetry, providerFactory);
  exception.expectMessage("javax.crypto.IllegalBlockSizeException: I don't know what 0x41 means and neither do you");
  subject.mapUuidsToKeys(keySet);
}