90 lines
2.6 KiB
Go
90 lines
2.6 KiB
Go
package auth
|
|
|
|
import (
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/golang-jwt/jwt/v5"
|
|
)
|
|
|
|
func TestIssuer_IssueVerify_Roundtrip(t *testing.T) {
|
|
issuer := NewIssuer([]byte("test-secret-32-bytes-minimum!!!"), time.Hour)
|
|
|
|
token, err := issuer.Issue("user-1", "alice", RoleAdmin, "session-abc")
|
|
if err != nil {
|
|
t.Fatalf("Issue: %v", err)
|
|
}
|
|
|
|
claims, err := issuer.Verify(token)
|
|
if err != nil {
|
|
t.Fatalf("Verify: %v", err)
|
|
}
|
|
if claims.Subject != "user-1" {
|
|
t.Errorf("Subject = %q, want %q", claims.Subject, "user-1")
|
|
}
|
|
if claims.Username != "alice" {
|
|
t.Errorf("Username = %q, want %q", claims.Username, "alice")
|
|
}
|
|
if claims.Role != RoleAdmin {
|
|
t.Errorf("Role = %q, want %q", claims.Role, RoleAdmin)
|
|
}
|
|
if claims.SessionID != "session-abc" {
|
|
t.Errorf("SessionID = %q, want %q", claims.SessionID, "session-abc")
|
|
}
|
|
}
|
|
|
|
func TestIssuer_Verify_ExpiredToken(t *testing.T) {
|
|
issuer := NewIssuer([]byte("test-secret-32-bytes-minimum!!!"), -time.Hour)
|
|
|
|
token, err := issuer.Issue("user-1", "alice", RoleClient, "session-abc")
|
|
if err != nil {
|
|
t.Fatalf("Issue: %v", err)
|
|
}
|
|
|
|
if _, err := issuer.Verify(token); err != ErrInvalidToken {
|
|
t.Errorf("Verify(expired) error = %v, want ErrInvalidToken", err)
|
|
}
|
|
}
|
|
|
|
func TestIssuer_Verify_WrongSecret(t *testing.T) {
|
|
issuer := NewIssuer([]byte("test-secret-32-bytes-minimum!!!"), time.Hour)
|
|
token, err := issuer.Issue("user-1", "alice", RoleClient, "session-abc")
|
|
if err != nil {
|
|
t.Fatalf("Issue: %v", err)
|
|
}
|
|
|
|
other := NewIssuer([]byte("different-secret-32-bytes-min!!"), time.Hour)
|
|
if _, err := other.Verify(token); err != ErrInvalidToken {
|
|
t.Errorf("Verify(wrong secret) error = %v, want ErrInvalidToken", err)
|
|
}
|
|
}
|
|
|
|
func TestIssuer_Verify_RejectsNoneAlgorithm(t *testing.T) {
|
|
issuer := NewIssuer([]byte("test-secret-32-bytes-minimum!!!"), time.Hour)
|
|
|
|
claims := Claims{
|
|
Role: RoleAdmin,
|
|
Username: "attacker",
|
|
SessionID: "forged",
|
|
RegisteredClaims: jwt.RegisteredClaims{
|
|
Subject: "user-1",
|
|
ExpiresAt: jwt.NewNumericDate(time.Now().Add(time.Hour)),
|
|
},
|
|
}
|
|
forged, err := jwt.NewWithClaims(jwt.SigningMethodNone, claims).SignedString(jwt.UnsafeAllowNoneSignatureType)
|
|
if err != nil {
|
|
t.Fatalf("forge none-alg token: %v", err)
|
|
}
|
|
|
|
if _, err := issuer.Verify(forged); err != ErrInvalidToken {
|
|
t.Errorf("Verify(none-alg token) error = %v, want ErrInvalidToken (alg-confusion protection)", err)
|
|
}
|
|
}
|
|
|
|
func TestIssuer_Verify_MalformedToken(t *testing.T) {
|
|
issuer := NewIssuer([]byte("test-secret-32-bytes-minimum!!!"), time.Hour)
|
|
if _, err := issuer.Verify("not.a.token"); err != ErrInvalidToken {
|
|
t.Errorf("Verify(malformed) error = %v, want ErrInvalidToken", err)
|
|
}
|
|
}
|