45 lines
1.4 KiB
Go
45 lines
1.4 KiB
Go
package creator_auth_test
|
|
|
|
import (
|
|
"encoding/json"
|
|
"git.cin.su/m/Assistant/modules/identity/domain"
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
)
|
|
|
|
func TestCreatorSessionIsTimeBoundAndDoesNotCarryAuthority(t *testing.T) {
|
|
now := time.Unix(1000, 0)
|
|
token, session, err := domain.IssueCreatorSession([]byte("01234567890123456789012345678901"), now, time.Minute)
|
|
if err != nil || session.ExpiresAtUnix != 1060 {
|
|
t.Fatal("issue failed")
|
|
}
|
|
if _, err = domain.ValidateCreatorSession([]byte("01234567890123456789012345678901"), token, now); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if _, err = domain.ValidateCreatorSession([]byte("01234567890123456789012345678901"), token, now.Add(time.Minute)); err == nil {
|
|
t.Fatal("expired session accepted")
|
|
}
|
|
if _, err = domain.ValidateCreatorSession([]byte("01234567890123456789012345678901"), token+"tampered", now); err == nil {
|
|
t.Fatal("tampered session accepted")
|
|
}
|
|
payload, err := json.Marshal(session)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if strings.Contains(string(payload), "Grant") || strings.Contains(string(payload), "Scope") {
|
|
t.Fatal("identity session must not carry authority")
|
|
}
|
|
}
|
|
|
|
func TestCreatorBootstrapCredentialMustMatch(t *testing.T) {
|
|
if !domain.BootstrapMatches("expected", "expected") {
|
|
t.Fatal("matching bootstrap credential rejected")
|
|
}
|
|
for _, supplied := range []string{"", "wrong"} {
|
|
if domain.BootstrapMatches("expected", supplied) {
|
|
t.Fatalf("invalid bootstrap credential %q accepted", supplied)
|
|
}
|
|
}
|
|
}
|