63 lines
2.1 KiB
Go
63 lines
2.1 KiB
Go
package creator_auth_test
|
|
|
|
import (
|
|
"encoding/json"
|
|
"git.cin.su/m/Assistant/contracts/identity"
|
|
"git.cin.su/m/Assistant/modules/identity/domain"
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
)
|
|
|
|
func TestCreatorSessionIsTimeBoundAndDoesNotCarryAuthority(t *testing.T) {
|
|
now := time.Unix(1000, 0)
|
|
token, session, err := domain.IssueCreatorSession([]byte("01234567890123456789012345678901"), now, time.Minute)
|
|
if err != nil || session.ExpiresAtUnix != 1060 {
|
|
t.Fatal("issue failed")
|
|
}
|
|
if _, err = domain.ValidateCreatorSession([]byte("01234567890123456789012345678901"), token, now); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if _, err = domain.ValidateCreatorSession([]byte("01234567890123456789012345678901"), token, now.Add(time.Minute)); err == nil {
|
|
t.Fatal("expired session accepted")
|
|
}
|
|
if _, err = domain.ValidateCreatorSession([]byte("01234567890123456789012345678901"), token+"tampered", now); err == nil {
|
|
t.Fatal("tampered session accepted")
|
|
}
|
|
payload, err := json.Marshal(session)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if strings.Contains(string(payload), "Grant") || strings.Contains(string(payload), "Scope") {
|
|
t.Fatal("identity session must not carry authority")
|
|
}
|
|
}
|
|
|
|
func TestCreatorUsernameAndPasswordMustBothMatch(t *testing.T) {
|
|
if !domain.CreatorCredentialsMatch("m", "password", identity.CreatorCredentials{Username: "m", Password: "password"}) {
|
|
t.Fatal("matching Creator credentials rejected")
|
|
}
|
|
for _, supplied := range []identity.CreatorCredentials{
|
|
{},
|
|
{Username: "m", Password: "wrong"},
|
|
{Username: "wrong", Password: "password"},
|
|
{Username: "m"},
|
|
{Password: "password"},
|
|
} {
|
|
if domain.CreatorCredentialsMatch("m", "password", supplied) {
|
|
t.Fatalf("invalid Creator credentials accepted: username=%q", supplied.Username)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestCreatorBootstrapCredentialMustMatch(t *testing.T) {
|
|
if !domain.BootstrapMatches("expected", "expected") {
|
|
t.Fatal("matching bootstrap credential rejected")
|
|
}
|
|
for _, supplied := range []string{"", "wrong"} {
|
|
if domain.BootstrapMatches("expected", supplied) {
|
|
t.Fatalf("invalid bootstrap credential %q accepted", supplied)
|
|
}
|
|
}
|
|
}
|