chore: update

control-plane/api/internal/auth/jwt_test.go

@@ -0,0 +1,89 @@
+package auth
+
+import (
+	"testing"
+	"time"
+
+	"github.com/golang-jwt/jwt/v5"
+)
+
+func TestIssuer_IssueVerify_Roundtrip(t *testing.T) {
+	issuer := NewIssuer([]byte("test-secret-32-bytes-minimum!!!"), time.Hour)
+
+	token, err := issuer.Issue("user-1", "alice", RoleAdmin, "session-abc")
+	if err != nil {
+		t.Fatalf("Issue: %v", err)
+	}
+
+	claims, err := issuer.Verify(token)
+	if err != nil {
+		t.Fatalf("Verify: %v", err)
+	}
+	if claims.Subject != "user-1" {
+		t.Errorf("Subject = %q, want %q", claims.Subject, "user-1")
+	}
+	if claims.Username != "alice" {
+		t.Errorf("Username = %q, want %q", claims.Username, "alice")
+	}
+	if claims.Role != RoleAdmin {
+		t.Errorf("Role = %q, want %q", claims.Role, RoleAdmin)
+	}
+	if claims.SessionID != "session-abc" {
+		t.Errorf("SessionID = %q, want %q", claims.SessionID, "session-abc")
+	}
+}
+
+func TestIssuer_Verify_ExpiredToken(t *testing.T) {
+	issuer := NewIssuer([]byte("test-secret-32-bytes-minimum!!!"), -time.Hour)
+
+	token, err := issuer.Issue("user-1", "alice", RoleClient, "session-abc")
+	if err != nil {
+		t.Fatalf("Issue: %v", err)
+	}
+
+	if _, err := issuer.Verify(token); err != ErrInvalidToken {
+		t.Errorf("Verify(expired) error = %v, want ErrInvalidToken", err)
+	}
+}
+
+func TestIssuer_Verify_WrongSecret(t *testing.T) {
+	issuer := NewIssuer([]byte("test-secret-32-bytes-minimum!!!"), time.Hour)
+	token, err := issuer.Issue("user-1", "alice", RoleClient, "session-abc")
+	if err != nil {
+		t.Fatalf("Issue: %v", err)
+	}
+
+	other := NewIssuer([]byte("different-secret-32-bytes-min!!"), time.Hour)
+	if _, err := other.Verify(token); err != ErrInvalidToken {
+		t.Errorf("Verify(wrong secret) error = %v, want ErrInvalidToken", err)
+	}
+}
+
+func TestIssuer_Verify_RejectsNoneAlgorithm(t *testing.T) {
+	issuer := NewIssuer([]byte("test-secret-32-bytes-minimum!!!"), time.Hour)
+
+	claims := Claims{
+		Role:      RoleAdmin,
+		Username:  "attacker",
+		SessionID: "forged",
+		RegisteredClaims: jwt.RegisteredClaims{
+			Subject:   "user-1",
+			ExpiresAt: jwt.NewNumericDate(time.Now().Add(time.Hour)),
+		},
+	}
+	forged, err := jwt.NewWithClaims(jwt.SigningMethodNone, claims).SignedString(jwt.UnsafeAllowNoneSignatureType)
+	if err != nil {
+		t.Fatalf("forge none-alg token: %v", err)
+	}
+
+	if _, err := issuer.Verify(forged); err != ErrInvalidToken {
+		t.Errorf("Verify(none-alg token) error = %v, want ErrInvalidToken (alg-confusion protection)", err)
+	}
+}
+
+func TestIssuer_Verify_MalformedToken(t *testing.T) {
+	issuer := NewIssuer([]byte("test-secret-32-bytes-minimum!!!"), time.Hour)
+	if _, err := issuer.Verify("not.a.token"); err != ErrInvalidToken {
+		t.Errorf("Verify(malformed) error = %v, want ErrInvalidToken", err)
+	}
+}

control-plane/api/internal/auth/password_test.go

@@ -0,0 +1,62 @@
+package auth
+
+import "testing"
+
+func TestHashPassword_VerifyPassword_Roundtrip(t *testing.T) {
+	hash, err := HashPassword("correct horse battery staple")
+	if err != nil {
+		t.Fatalf("HashPassword: %v", err)
+	}
+
+	ok, err := VerifyPassword("correct horse battery staple", hash)
+	if err != nil {
+		t.Fatalf("VerifyPassword: %v", err)
+	}
+	if !ok {
+		t.Error("VerifyPassword = false, want true for correct password")
+	}
+}
+
+func TestVerifyPassword_WrongPassword(t *testing.T) {
+	hash, err := HashPassword("correct horse battery staple")
+	if err != nil {
+		t.Fatalf("HashPassword: %v", err)
+	}
+
+	ok, err := VerifyPassword("wrong password", hash)
+	if err != nil {
+		t.Fatalf("VerifyPassword: %v", err)
+	}
+	if ok {
+		t.Error("VerifyPassword = true, want false for wrong password")
+	}
+}
+
+func TestHashPassword_UniqueSaltPerCall(t *testing.T) {
+	hash1, err := HashPassword("same password")
+	if err != nil {
+		t.Fatalf("HashPassword: %v", err)
+	}
+	hash2, err := HashPassword("same password")
+	if err != nil {
+		t.Fatalf("HashPassword: %v", err)
+	}
+	if hash1 == hash2 {
+		t.Error("HashPassword produced identical hashes for two calls — salt is not random")
+	}
+}
+
+func TestVerifyPassword_InvalidHashFormat(t *testing.T) {
+	cases := []string{
+		"",
+		"not-a-hash",
+		"$argon2id$v=19$m=65536,t=1,p=4$onlyfiveparts",
+		"$bcrypt$v=19$m=65536,t=1,p=4$c2FsdA$aGFzaA",
+	}
+	for _, encoded := range cases {
+		_, err := VerifyPassword("anything", encoded)
+		if err != ErrInvalidHash {
+			t.Errorf("VerifyPassword(%q) error = %v, want ErrInvalidHash", encoded, err)
+		}
+	}
+}