File size: 2,451 Bytes
8d3471e | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 | package auth
import (
"net/http"
"testing"
"ds2api/internal/config"
)
func TestJWTCreateVerify(t *testing.T) {
token, err := CreateJWT(1)
if err != nil {
t.Fatalf("create jwt failed: %v", err)
}
payload, err := VerifyJWT(token)
if err != nil {
t.Fatalf("verify jwt failed: %v", err)
}
if payload["role"] != "admin" {
t.Fatalf("unexpected payload: %#v", payload)
}
}
func TestVerifyAdminRequest(t *testing.T) {
token, _ := CreateJWT(1)
req, _ := http.NewRequest(http.MethodGet, "/admin/config", nil)
req.Header.Set("Authorization", "Bearer "+token)
if err := VerifyAdminRequest(req); err != nil {
t.Fatalf("expected token accepted: %v", err)
}
}
func TestVerifyJWTWithStoreValidAfter(t *testing.T) {
t.Setenv("DS2API_CONFIG_JSON", `{"admin":{"password_hash":"`+HashAdminPassword("oldpass")+`"}}`)
store := config.LoadStore()
token, err := CreateJWTWithStore(1, store)
if err != nil {
t.Fatalf("create jwt failed: %v", err)
}
if _, err := VerifyJWTWithStore(token, store); err != nil {
t.Fatalf("verify before invalidation failed: %v", err)
}
if err := store.Update(func(c *config.Config) error {
c.Admin.JWTValidAfterUnix = 1<<62 - 1
return nil
}); err != nil {
t.Fatalf("set valid-after failed: %v", err)
}
if _, err := VerifyJWTWithStore(token, store); err == nil {
t.Fatal("expected token invalid after valid-after update")
}
}
func TestVerifyJWTWithStoreSameSecondInvalidationAndRelogin(t *testing.T) {
t.Setenv("DS2API_CONFIG_JSON", `{"admin":{"password_hash":"`+HashAdminPassword("oldpass")+`"}}`)
store := config.LoadStore()
oldToken, err := CreateJWTWithStore(1, store)
if err != nil {
t.Fatalf("create old jwt failed: %v", err)
}
oldPayload, err := VerifyJWTWithStore(oldToken, store)
if err != nil {
t.Fatalf("verify old jwt before invalidation failed: %v", err)
}
oldIAT, _ := oldPayload["iat"].(float64)
if err := store.Update(func(c *config.Config) error {
c.Admin.JWTValidAfterUnix = int64(oldIAT)
return nil
}); err != nil {
t.Fatalf("set valid-after failed: %v", err)
}
if _, err := VerifyJWTWithStore(oldToken, store); err == nil {
t.Fatal("expected old token invalid when iat == valid-after")
}
newToken, err := CreateJWTWithStore(1, store)
if err != nil {
t.Fatalf("create new jwt failed: %v", err)
}
if _, err := VerifyJWTWithStore(newToken, store); err != nil {
t.Fatalf("expected new token valid after invalidation cutoff: %v", err)
}
}
|