72 lines
1.9 KiB
Go
72 lines
1.9 KiB
Go
package security_test
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"backend/internal/platform/security"
|
|
)
|
|
|
|
func TestHashAndVerifyPassword_RoundTrip(t *testing.T) {
|
|
hash, err := security.HashPassword("correct-horse-battery-staple")
|
|
if err != nil {
|
|
t.Fatalf("HashPassword() error = %v", err)
|
|
}
|
|
|
|
ok, err := security.VerifyPassword(hash, "correct-horse-battery-staple")
|
|
if err != nil {
|
|
t.Fatalf("VerifyPassword() error = %v", err)
|
|
}
|
|
if !ok {
|
|
t.Fatal("VerifyPassword() = false, want true for the correct password")
|
|
}
|
|
}
|
|
|
|
func TestVerifyPassword_WrongPassword(t *testing.T) {
|
|
hash, err := security.HashPassword("correct-horse-battery-staple")
|
|
if err != nil {
|
|
t.Fatalf("HashPassword() error = %v", err)
|
|
}
|
|
|
|
ok, err := security.VerifyPassword(hash, "wrong-password")
|
|
if err != nil {
|
|
t.Fatalf("VerifyPassword() error = %v", err)
|
|
}
|
|
if ok {
|
|
t.Fatal("VerifyPassword() = true, want false for a wrong password")
|
|
}
|
|
}
|
|
|
|
func TestHashPassword_UniqueSaltPerCall(t *testing.T) {
|
|
hash1, err := security.HashPassword("same-password")
|
|
if err != nil {
|
|
t.Fatalf("HashPassword() error = %v", err)
|
|
}
|
|
hash2, err := security.HashPassword("same-password")
|
|
if err != nil {
|
|
t.Fatalf("HashPassword() error = %v", err)
|
|
}
|
|
if hash1 == hash2 {
|
|
t.Fatal("two hashes of the same password with random salts must differ")
|
|
}
|
|
}
|
|
|
|
func TestVerifyPassword_InvalidFormat(t *testing.T) {
|
|
_, err := security.VerifyPassword("not-a-valid-hash", "whatever")
|
|
if err == nil {
|
|
t.Fatal("VerifyPassword() error = nil, want error for malformed hash")
|
|
}
|
|
}
|
|
|
|
func TestVerifyPassword_TamperedHash(t *testing.T) {
|
|
hash, err := security.HashPassword("correct-horse-battery-staple")
|
|
if err != nil {
|
|
t.Fatalf("HashPassword() error = %v", err)
|
|
}
|
|
|
|
tampered := hash[:len(hash)-4] + "abcd"
|
|
ok, _ := security.VerifyPassword(tampered, "correct-horse-battery-staple")
|
|
if ok {
|
|
t.Fatal("VerifyPassword() = true for a tampered hash, want false")
|
|
}
|
|
}
|