fix

internal/rpc/auth_export_test.go

@@ -0,0 +1,51 @@
+package rpc
+
+import (
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/binary"
+	"testing"
+	"time"
+)
+
+func TestExportAuthTokenRoundTrip(t *testing.T) {
+	const userID = int64(1780243201)
+	token := signExportAuthToken(userID)
+	got, err := verifyExportAuthToken(token)
+	if err != nil {
+		t.Fatalf("verify: %v", err)
+	}
+	if got != userID {
+		t.Fatalf("got userID %d, want %d", got, userID)
+	}
+}
+
+func TestExportAuthTokenRejectsTampering(t *testing.T) {
+	token := signExportAuthToken(1780243201)
+	token[0] ^= 0xFF
+	if _, err := verifyExportAuthToken(token); err == nil {
+		t.Fatal("expected tampered token to fail verification")
+	}
+}
+
+func TestExportAuthTokenRejectsWrongLength(t *testing.T) {
+	if _, err := verifyExportAuthToken([]byte{1, 2, 3}); err == nil {
+		t.Fatal("expected short token to fail verification")
+	}
+}
+
+func TestExportAuthTokenRejectsExpired(t *testing.T) {
+	// Build a token with an already-past expiry, signed the same way
+	// signExportAuthToken does, to exercise the expiry check specifically
+	// (as opposed to the HMAC check).
+	payload := make([]byte, 16, 48)
+	binary.BigEndian.PutUint64(payload[0:8], uint64(1780243201))
+	binary.BigEndian.PutUint64(payload[8:16], uint64(time.Now().Add(-time.Minute).Unix()))
+	mac := hmac.New(sha256.New, exportAuthSecret)
+	mac.Write(payload)
+	token := mac.Sum(payload)
+
+	if _, err := verifyExportAuthToken(token); err == nil {
+		t.Fatal("expected expired token to fail verification")
+	}
+}