refac: removed 7 direct and 12 indirect go modules for custom code instead
This commit is contained in:
Florian Sylvain committed
1 parent
cfcf108488
commit
c68e9a7858
73 files changed
+2455
-428
No files matched your search
@@ -0,0 +1,181 @@
|
||||
package test
|
||||
|
||||
import (
|
||||
"RenewCMS/api/pkg/authtoken"
|
||||
"crypto/hmac"
|
||||
"crypto/sha256"
|
||||
"encoding/base64"
|
||||
"errors"
|
||||
"strconv"
|
||||
"strings"
|
||||
"testing"
|
||||
"time"
|
||||
)
|
||||
|
||||
var authTokenEpoch = time.Date(2026, time.March, 1, 12, 0, 0, 0, time.UTC)
|
||||
|
||||
func authTokenAt(now time.Time) *authtoken.Auth {
|
||||
return authtoken.New([]byte("test-secret"), authtoken.WithClock(func() time.Time { return now }))
|
||||
}
|
||||
|
||||
func signedAuthTokenSegments(secret string, header string, payload string) string {
|
||||
encode := base64.RawURLEncoding.EncodeToString
|
||||
signingInput := encode([]byte(header)) + "." + encode([]byte(payload))
|
||||
mac := hmac.New(sha256.New, []byte(secret))
|
||||
mac.Write([]byte(signingInput))
|
||||
return signingInput + "." + encode(mac.Sum(nil))
|
||||
}
|
||||
|
||||
func TestAuthTokenEncodeDecode(t *testing.T) {
|
||||
t.Run("A token round-trips its claims", func(t *testing.T) {
|
||||
auth := authTokenAt(authTokenEpoch)
|
||||
|
||||
encoded, err := auth.Encode(map[string]any{"user_id": uint32(7), "token_version": uint32(3)})
|
||||
if err != nil {
|
||||
t.Fatalf("encode failed: %v", err)
|
||||
}
|
||||
claims, err := auth.Decode(encoded)
|
||||
if err != nil {
|
||||
t.Fatalf("decode failed: %v", err)
|
||||
}
|
||||
|
||||
if claims["user_id"] != float64(7) || claims["token_version"] != float64(3) {
|
||||
t.Errorf("unexpected claims %v", claims)
|
||||
}
|
||||
})
|
||||
|
||||
t.Run("Encoding stamps iat and an exp one session lifetime ahead", func(t *testing.T) {
|
||||
auth := authTokenAt(authTokenEpoch)
|
||||
|
||||
encoded, _ := auth.Encode(map[string]any{"user_id": 1})
|
||||
claims, _ := auth.Decode(encoded)
|
||||
|
||||
if claims["iat"] != float64(authTokenEpoch.Unix()) {
|
||||
t.Errorf("expected iat %d, got %v", authTokenEpoch.Unix(), claims["iat"])
|
||||
}
|
||||
if claims["exp"] != float64(authTokenEpoch.Add(authtoken.SessionLifetime).Unix()) {
|
||||
t.Errorf("unexpected exp %v", claims["exp"])
|
||||
}
|
||||
})
|
||||
|
||||
t.Run("Encoding keeps an explicit exp", func(t *testing.T) {
|
||||
auth := authTokenAt(authTokenEpoch)
|
||||
explicit := authTokenEpoch.Add(time.Minute).Unix()
|
||||
|
||||
encoded, _ := auth.Encode(map[string]any{"exp": explicit})
|
||||
claims, _ := auth.Decode(encoded)
|
||||
|
||||
if claims["exp"] != float64(explicit) {
|
||||
t.Errorf("expected exp %d, got %v", explicit, claims["exp"])
|
||||
}
|
||||
})
|
||||
|
||||
t.Run("Encoding does not mutate the caller's claims", func(t *testing.T) {
|
||||
input := map[string]any{"user_id": 1}
|
||||
|
||||
_, _ = authTokenAt(authTokenEpoch).Encode(input)
|
||||
|
||||
if len(input) != 1 {
|
||||
t.Errorf("input was mutated: %v", input)
|
||||
}
|
||||
})
|
||||
|
||||
t.Run("Encoding nil claims still yields a decodable token", func(t *testing.T) {
|
||||
auth := authTokenAt(authTokenEpoch)
|
||||
|
||||
encoded, err := auth.Encode(nil)
|
||||
if err != nil {
|
||||
t.Fatalf("encode failed: %v", err)
|
||||
}
|
||||
if _, err := auth.Decode(encoded); err != nil {
|
||||
t.Errorf("decode failed: %v", err)
|
||||
}
|
||||
})
|
||||
|
||||
t.Run("Encoding reports claims that cannot be serialized", func(t *testing.T) {
|
||||
if _, err := authTokenAt(authTokenEpoch).Encode(map[string]any{"bad": make(chan int)}); err == nil {
|
||||
t.Error("expected an error")
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
func TestAuthTokenDecodeRejections(t *testing.T) {
|
||||
auth := authTokenAt(authTokenEpoch)
|
||||
valid, _ := auth.Encode(map[string]any{"user_id": 1})
|
||||
segments := strings.Split(valid, ".")
|
||||
header := `{"alg":"HS256","typ":"JWT"}`
|
||||
|
||||
cases := map[string]struct {
|
||||
token string
|
||||
want error
|
||||
}{
|
||||
"empty": {"", authtoken.ErrNoToken},
|
||||
"one segment": {"abc", authtoken.ErrInvalid},
|
||||
"four segments": {valid + ".x", authtoken.ErrInvalid},
|
||||
"not base64 header": {"!!!." + segments[1] + "." + segments[2], authtoken.ErrInvalid},
|
||||
"signed with another secret": {signedAuthTokenSegments("other", header, `{"user_id":1}`), authtoken.ErrInvalid},
|
||||
"alg none": {signedAuthTokenSegments("test-secret", `{"alg":"none"}`, `{"user_id":1}`), authtoken.ErrInvalid},
|
||||
"alg HS512": {signedAuthTokenSegments("test-secret", `{"alg":"HS512"}`, `{"user_id":1}`), authtoken.ErrInvalid},
|
||||
"alg missing": {signedAuthTokenSegments("test-secret", `{}`, `{"user_id":1}`), authtoken.ErrInvalid},
|
||||
"tampered payload": {segments[0] + "." + base64.RawURLEncoding.EncodeToString([]byte(`{"user_id":2}`)) + "." + segments[2], authtoken.ErrInvalid},
|
||||
"truncated signature": {segments[0] + "." + segments[1] + "." + segments[2][:10], authtoken.ErrInvalid},
|
||||
"empty signature": {segments[0] + "." + segments[1] + ".", authtoken.ErrInvalid},
|
||||
"payload not an object": {signedAuthTokenSegments("test-secret", header, `[1]`), authtoken.ErrInvalid},
|
||||
"payload null": {signedAuthTokenSegments("test-secret", header, `null`), authtoken.ErrInvalid},
|
||||
"exp not a number": {signedAuthTokenSegments("test-secret", header, `{"exp":"soon"}`), authtoken.ErrInvalid},
|
||||
"nbf not a number": {signedAuthTokenSegments("test-secret", header, `{"nbf":"soon"}`), authtoken.ErrInvalid},
|
||||
"expired": {signedAuthTokenSegments("test-secret", header, `{"exp":`+authTokenUnix(authTokenEpoch.Add(-time.Second).Unix())+`}`), authtoken.ErrExpired},
|
||||
"expiring exactly now": {signedAuthTokenSegments("test-secret", header, `{"exp":`+authTokenUnix(authTokenEpoch.Unix())+`}`), authtoken.ErrExpired},
|
||||
"not yet valid": {signedAuthTokenSegments("test-secret", header, `{"nbf":`+authTokenUnix(authTokenEpoch.Add(time.Second).Unix())+`}`), authtoken.ErrNotYetValid},
|
||||
"larger than the size budget": {strings.Repeat("a", 5000), authtoken.ErrInvalid},
|
||||
}
|
||||
|
||||
for name, tc := range cases {
|
||||
t.Run("Rejects "+name, func(t *testing.T) {
|
||||
claims, err := auth.Decode(tc.token)
|
||||
|
||||
if !errors.Is(err, tc.want) {
|
||||
t.Errorf("expected %v, got %v", tc.want, err)
|
||||
}
|
||||
if claims != nil {
|
||||
t.Errorf("expected no claims, got %v", claims)
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
t.Run("Accepts a token with no exp so sessions issued before expiry existed keep working", func(t *testing.T) {
|
||||
legacy := signedAuthTokenSegments("test-secret", header, `{"user_id":4,"token_version":1}`)
|
||||
|
||||
claims, err := auth.Decode(legacy)
|
||||
|
||||
if err != nil || claims["user_id"] != float64(4) {
|
||||
t.Errorf("expected legacy token accepted, got %v, %v", claims, err)
|
||||
}
|
||||
})
|
||||
|
||||
t.Run("Accepts a token whose nbf has passed", func(t *testing.T) {
|
||||
token := signedAuthTokenSegments("test-secret", header, `{"nbf":`+authTokenUnix(authTokenEpoch.Add(-time.Second).Unix())+`}`)
|
||||
|
||||
if _, err := auth.Decode(token); err != nil {
|
||||
t.Errorf("expected acceptance, got %v", err)
|
||||
}
|
||||
})
|
||||
|
||||
t.Run("A token expires once the clock passes its lifetime", func(t *testing.T) {
|
||||
encoded, _ := auth.Encode(map[string]any{"user_id": 1})
|
||||
|
||||
justBefore := authTokenAt(authTokenEpoch.Add(authtoken.SessionLifetime - time.Second))
|
||||
justAfter := authTokenAt(authTokenEpoch.Add(authtoken.SessionLifetime))
|
||||
|
||||
if _, err := justBefore.Decode(encoded); err != nil {
|
||||
t.Errorf("expected valid before expiry, got %v", err)
|
||||
}
|
||||
if _, err := justAfter.Decode(encoded); !errors.Is(err, authtoken.ErrExpired) {
|
||||
t.Errorf("expected expired, got %v", err)
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
func authTokenUnix(value int64) string {
|
||||
return strconv.FormatInt(value, 10)
|
||||
}
|
||||
Reference in new issue
Block a user