346 lines
12 KiB
Go
346 lines
12 KiB
Go
package test
|
|
|
|
import (
|
|
"RenewCMS/api/pkg/authtoken"
|
|
"crypto/hmac"
|
|
"crypto/sha256"
|
|
"encoding/base64"
|
|
"errors"
|
|
"strconv"
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
)
|
|
|
|
var authTokenEpoch = time.Date(2026, time.March, 1, 12, 0, 0, 0, time.UTC)
|
|
|
|
func authTokenAt(now time.Time) *authtoken.Auth {
|
|
return authtoken.New([]byte("test-secret"), authtoken.WithClock(func() time.Time { return now }))
|
|
}
|
|
|
|
func signedAuthTokenSegments(secret string, header string, payload string) string {
|
|
encode := base64.RawURLEncoding.EncodeToString
|
|
signingInput := encode([]byte(header)) + "." + encode([]byte(payload))
|
|
mac := hmac.New(sha256.New, []byte(secret))
|
|
mac.Write([]byte(signingInput))
|
|
return signingInput + "." + encode(mac.Sum(nil))
|
|
}
|
|
|
|
func TestAuthTokenEncodeDecode(t *testing.T) {
|
|
t.Run("A token round-trips its claims", func(t *testing.T) {
|
|
auth := authTokenAt(authTokenEpoch)
|
|
|
|
encoded, err := auth.Encode(map[string]any{"user_id": uint32(7), "token_version": uint32(3)})
|
|
if err != nil {
|
|
t.Fatalf("encode failed: %v", err)
|
|
}
|
|
claims, err := auth.Decode(encoded)
|
|
if err != nil {
|
|
t.Fatalf("decode failed: %v", err)
|
|
}
|
|
|
|
if claims["user_id"] != float64(7) || claims["token_version"] != float64(3) {
|
|
t.Errorf("unexpected claims %v", claims)
|
|
}
|
|
})
|
|
|
|
t.Run("Encoding stamps iat and an exp one session lifetime ahead", func(t *testing.T) {
|
|
auth := authTokenAt(authTokenEpoch)
|
|
|
|
encoded, _ := auth.Encode(map[string]any{"user_id": 1})
|
|
claims, _ := auth.Decode(encoded)
|
|
|
|
if claims["iat"] != float64(authTokenEpoch.Unix()) {
|
|
t.Errorf("expected iat %d, got %v", authTokenEpoch.Unix(), claims["iat"])
|
|
}
|
|
if claims["exp"] != float64(authTokenEpoch.Add(authtoken.SessionLifetime).Unix()) {
|
|
t.Errorf("unexpected exp %v", claims["exp"])
|
|
}
|
|
})
|
|
|
|
t.Run("Encoding keeps an explicit exp", func(t *testing.T) {
|
|
auth := authTokenAt(authTokenEpoch)
|
|
explicit := authTokenEpoch.Add(time.Minute).Unix()
|
|
|
|
encoded, _ := auth.Encode(map[string]any{"exp": explicit})
|
|
claims, _ := auth.Decode(encoded)
|
|
|
|
if claims["exp"] != float64(explicit) {
|
|
t.Errorf("expected exp %d, got %v", explicit, claims["exp"])
|
|
}
|
|
})
|
|
|
|
t.Run("Encoding does not mutate the caller's claims", func(t *testing.T) {
|
|
input := map[string]any{"user_id": 1}
|
|
|
|
_, _ = authTokenAt(authTokenEpoch).Encode(input)
|
|
|
|
if len(input) != 1 {
|
|
t.Errorf("input was mutated: %v", input)
|
|
}
|
|
})
|
|
|
|
t.Run("Encoding nil claims still yields a decodable token", func(t *testing.T) {
|
|
auth := authTokenAt(authTokenEpoch)
|
|
|
|
encoded, err := auth.Encode(nil)
|
|
if err != nil {
|
|
t.Fatalf("encode failed: %v", err)
|
|
}
|
|
if _, err := auth.Decode(encoded); err != nil {
|
|
t.Errorf("decode failed: %v", err)
|
|
}
|
|
})
|
|
|
|
t.Run("Encoding reports claims that cannot be serialized", func(t *testing.T) {
|
|
if _, err := authTokenAt(authTokenEpoch).Encode(map[string]any{"bad": make(chan int)}); err == nil {
|
|
t.Error("expected an error")
|
|
}
|
|
})
|
|
}
|
|
|
|
func TestAuthTokenDecodeRejections(t *testing.T) {
|
|
auth := authTokenAt(authTokenEpoch)
|
|
valid, _ := auth.Encode(map[string]any{"user_id": 1})
|
|
segments := strings.Split(valid, ".")
|
|
header := `{"alg":"HS256","typ":"JWT"}`
|
|
|
|
cases := map[string]struct {
|
|
token string
|
|
want error
|
|
}{
|
|
"empty": {"", authtoken.ErrNoToken},
|
|
"one segment": {"abc", authtoken.ErrInvalid},
|
|
"four segments": {valid + ".x", authtoken.ErrInvalid},
|
|
"not base64 header": {"!!!." + segments[1] + "." + segments[2], authtoken.ErrInvalid},
|
|
"signed with another secret": {signedAuthTokenSegments("other", header, `{"user_id":1}`), authtoken.ErrInvalid},
|
|
"alg none": {signedAuthTokenSegments("test-secret", `{"alg":"none"}`, `{"user_id":1}`), authtoken.ErrInvalid},
|
|
"alg HS512": {signedAuthTokenSegments("test-secret", `{"alg":"HS512"}`, `{"user_id":1}`), authtoken.ErrInvalid},
|
|
"alg missing": {signedAuthTokenSegments("test-secret", `{}`, `{"user_id":1}`), authtoken.ErrInvalid},
|
|
"tampered payload": {segments[0] + "." + base64.RawURLEncoding.EncodeToString([]byte(`{"user_id":2}`)) + "." + segments[2], authtoken.ErrInvalid},
|
|
"truncated signature": {segments[0] + "." + segments[1] + "." + segments[2][:10], authtoken.ErrInvalid},
|
|
"empty signature": {segments[0] + "." + segments[1] + ".", authtoken.ErrInvalid},
|
|
"payload not an object": {signedAuthTokenSegments("test-secret", header, `[1]`), authtoken.ErrInvalid},
|
|
"payload null": {signedAuthTokenSegments("test-secret", header, `null`), authtoken.ErrInvalid},
|
|
"exp not a number": {signedAuthTokenSegments("test-secret", header, `{"exp":"soon"}`), authtoken.ErrInvalid},
|
|
"nbf not a number": {signedAuthTokenSegments("test-secret", header, `{"nbf":"soon"}`), authtoken.ErrInvalid},
|
|
"expired": {signedAuthTokenSegments("test-secret", header, `{"exp":`+authTokenUnix(authTokenEpoch.Add(-time.Second).Unix())+`}`), authtoken.ErrExpired},
|
|
"expiring exactly now": {signedAuthTokenSegments("test-secret", header, `{"exp":`+authTokenUnix(authTokenEpoch.Unix())+`}`), authtoken.ErrExpired},
|
|
"not yet valid": {signedAuthTokenSegments("test-secret", header, `{"exp":`+authTokenUnix(authTokenEpoch.Add(time.Hour).Unix())+`,"nbf":`+authTokenUnix(authTokenEpoch.Add(time.Second).Unix())+`}`), authtoken.ErrNotYetValid},
|
|
"without exp": {signedAuthTokenSegments("test-secret", header, `{"user_id":4,"token_version":1}`), authtoken.ErrInvalid},
|
|
"jti not a string": {signedAuthTokenSegments("test-secret", header, `{"exp":`+authTokenUnix(authTokenEpoch.Add(time.Hour).Unix())+`,"jti":7}`), authtoken.ErrInvalid},
|
|
"larger than the size budget": {strings.Repeat("a", 5000), authtoken.ErrInvalid},
|
|
}
|
|
|
|
for name, tc := range cases {
|
|
t.Run("Rejects "+name, func(t *testing.T) {
|
|
claims, err := auth.Decode(tc.token)
|
|
|
|
if !errors.Is(err, tc.want) {
|
|
t.Errorf("expected %v, got %v", tc.want, err)
|
|
}
|
|
if claims != nil {
|
|
t.Errorf("expected no claims, got %v", claims)
|
|
}
|
|
})
|
|
}
|
|
|
|
t.Run("Accepts a token whose nbf has passed", func(t *testing.T) {
|
|
token := signedAuthTokenSegments("test-secret", header, `{"exp":`+authTokenUnix(authTokenEpoch.Add(time.Hour).Unix())+`,"nbf":`+authTokenUnix(authTokenEpoch.Add(-time.Second).Unix())+`}`)
|
|
|
|
if _, err := auth.Decode(token); err != nil {
|
|
t.Errorf("expected acceptance, got %v", err)
|
|
}
|
|
})
|
|
|
|
t.Run("A token expires once the clock passes its lifetime", func(t *testing.T) {
|
|
encoded, _ := auth.Encode(map[string]any{"user_id": 1})
|
|
|
|
justBefore := authTokenAt(authTokenEpoch.Add(authtoken.SessionLifetime - time.Second))
|
|
justAfter := authTokenAt(authTokenEpoch.Add(authtoken.SessionLifetime))
|
|
|
|
if _, err := justBefore.Decode(encoded); err != nil {
|
|
t.Errorf("expected valid before expiry, got %v", err)
|
|
}
|
|
if _, err := justAfter.Decode(encoded); !errors.Is(err, authtoken.ErrExpired) {
|
|
t.Errorf("expected expired, got %v", err)
|
|
}
|
|
})
|
|
}
|
|
|
|
func authTokenUnix(value int64) string {
|
|
return strconv.FormatInt(value, 10)
|
|
}
|
|
|
|
type memoryRevocationStore struct {
|
|
revoked map[string]time.Time
|
|
failure error
|
|
}
|
|
|
|
func newMemoryRevocationStore() *memoryRevocationStore {
|
|
return &memoryRevocationStore{revoked: map[string]time.Time{}}
|
|
}
|
|
|
|
func (m *memoryRevocationStore) Revoke(id string, expiresAt time.Time) error {
|
|
if m.failure != nil {
|
|
return m.failure
|
|
}
|
|
m.revoked[id] = expiresAt
|
|
return nil
|
|
}
|
|
|
|
func (m *memoryRevocationStore) IsRevoked(id string) (bool, error) {
|
|
if m.failure != nil {
|
|
return false, m.failure
|
|
}
|
|
_, ok := m.revoked[id]
|
|
return ok, nil
|
|
}
|
|
|
|
func TestAuthTokenRevocation(t *testing.T) {
|
|
newAuth := func(store *memoryRevocationStore) *authtoken.Auth {
|
|
return authtoken.New([]byte("test-secret"), authtoken.WithClock(func() time.Time { return authTokenEpoch }), authtoken.WithRevocationStore(store))
|
|
}
|
|
|
|
t.Run("Every encoded token carries a distinct jti", func(t *testing.T) {
|
|
auth := authTokenAt(authTokenEpoch)
|
|
first, _ := auth.Encode(map[string]any{"user_id": 1})
|
|
second, _ := auth.Encode(map[string]any{"user_id": 1})
|
|
|
|
firstClaims, _ := auth.Decode(first)
|
|
secondClaims, _ := auth.Decode(second)
|
|
|
|
id, ok := firstClaims["jti"].(string)
|
|
if !ok || id == "" {
|
|
t.Fatalf("expected a jti, got %v", firstClaims["jti"])
|
|
}
|
|
if id == secondClaims["jti"] {
|
|
t.Errorf("expected distinct jti values, both were %q", id)
|
|
}
|
|
})
|
|
|
|
t.Run("An explicit jti is kept", func(t *testing.T) {
|
|
auth := authTokenAt(authTokenEpoch)
|
|
encoded, _ := auth.Encode(map[string]any{"jti": "fixed-id"})
|
|
|
|
claims, _ := auth.Decode(encoded)
|
|
|
|
if claims["jti"] != "fixed-id" {
|
|
t.Errorf("expected jti fixed-id, got %v", claims["jti"])
|
|
}
|
|
})
|
|
|
|
t.Run("A revoked token is rejected until it would have expired anyway", func(t *testing.T) {
|
|
store := newMemoryRevocationStore()
|
|
auth := newAuth(store)
|
|
encoded, _ := auth.Encode(map[string]any{"user_id": 1})
|
|
claims, err := auth.Decode(encoded)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
if err := auth.Revoke(claims); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
if _, err := auth.Decode(encoded); !errors.Is(err, authtoken.ErrRevoked) {
|
|
t.Errorf("expected ErrRevoked, got %v", err)
|
|
}
|
|
if got := store.revoked[claims["jti"].(string)]; !got.Equal(authTokenEpoch.Add(authtoken.SessionLifetime)) {
|
|
t.Errorf("expected the revocation to last until the token's exp, got %v", got)
|
|
}
|
|
})
|
|
|
|
t.Run("Revoking one token leaves the others valid", func(t *testing.T) {
|
|
auth := newAuth(newMemoryRevocationStore())
|
|
revoked, _ := auth.Encode(map[string]any{"user_id": 1})
|
|
kept, _ := auth.Encode(map[string]any{"user_id": 1})
|
|
claims, _ := auth.Decode(revoked)
|
|
|
|
_ = auth.Revoke(claims)
|
|
|
|
if _, err := auth.Decode(kept); err != nil {
|
|
t.Errorf("expected the other token to stay valid, got %v", err)
|
|
}
|
|
})
|
|
|
|
t.Run("A token is rejected when the revocation store cannot answer", func(t *testing.T) {
|
|
store := newMemoryRevocationStore()
|
|
auth := newAuth(store)
|
|
encoded, _ := auth.Encode(map[string]any{"user_id": 1})
|
|
store.failure = errors.New("database unavailable")
|
|
|
|
if _, err := auth.Decode(encoded); !errors.Is(err, authtoken.ErrInvalid) {
|
|
t.Errorf("expected ErrInvalid, got %v", err)
|
|
}
|
|
})
|
|
|
|
t.Run("Revoking surfaces a store failure", func(t *testing.T) {
|
|
store := newMemoryRevocationStore()
|
|
auth := newAuth(store)
|
|
encoded, _ := auth.Encode(map[string]any{"user_id": 1})
|
|
claims, _ := auth.Decode(encoded)
|
|
store.failure = errors.New("database unavailable")
|
|
|
|
if err := auth.Revoke(claims); err == nil {
|
|
t.Error("expected an error")
|
|
}
|
|
})
|
|
|
|
t.Run("Revoking claims without a jti is a no-op", func(t *testing.T) {
|
|
store := newMemoryRevocationStore()
|
|
|
|
if err := newAuth(store).Revoke(authtoken.Claims{"user_id": float64(1), "exp": float64(authTokenEpoch.Unix())}); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if len(store.revoked) != 0 {
|
|
t.Errorf("expected nothing revoked, got %v", store.revoked)
|
|
}
|
|
})
|
|
|
|
t.Run("Revoking claims without an exp is refused", func(t *testing.T) {
|
|
if err := newAuth(newMemoryRevocationStore()).Revoke(authtoken.Claims{"jti": "abc"}); !errors.Is(err, authtoken.ErrInvalid) {
|
|
t.Errorf("expected ErrInvalid, got %v", err)
|
|
}
|
|
})
|
|
|
|
t.Run("Without a store, revoking is a no-op and tokens stay valid", func(t *testing.T) {
|
|
auth := authTokenAt(authTokenEpoch)
|
|
encoded, _ := auth.Encode(map[string]any{"user_id": 1})
|
|
claims, _ := auth.Decode(encoded)
|
|
|
|
if err := auth.Revoke(claims); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if _, err := auth.Decode(encoded); err != nil {
|
|
t.Errorf("expected the token to stay valid, got %v", err)
|
|
}
|
|
})
|
|
}
|
|
|
|
func TestAuthTokenSizeBudget(t *testing.T) {
|
|
auth := authTokenAt(authTokenEpoch)
|
|
sized := func(target int) string {
|
|
for padding := 0; padding < 4096; padding++ {
|
|
encoded, _ := auth.Encode(map[string]any{"jti": "fixed", "pad": strings.Repeat("a", padding)})
|
|
if len(encoded) == target {
|
|
return encoded
|
|
}
|
|
}
|
|
t.Fatalf("no token of exactly %d bytes", target)
|
|
return ""
|
|
}
|
|
|
|
t.Run("A token of exactly 4096 bytes is accepted", func(t *testing.T) {
|
|
if _, err := auth.Decode(sized(4096)); err != nil {
|
|
t.Errorf("expected acceptance, got %v", err)
|
|
}
|
|
})
|
|
|
|
t.Run("A token of 4097 bytes is refused before it is parsed", func(t *testing.T) {
|
|
if _, err := auth.Decode(sized(4097)); !errors.Is(err, authtoken.ErrInvalid) {
|
|
t.Errorf("expected ErrInvalid, got %v", err)
|
|
}
|
|
})
|
|
}
|