51 lines
1.4 KiB
Go
51 lines
1.4 KiB
Go
package rpc
|
|
|
|
import (
|
|
"crypto/hmac"
|
|
"crypto/sha256"
|
|
"encoding/binary"
|
|
"testing"
|
|
"time"
|
|
)
|
|
|
|
func TestExportAuthTokenRoundTrip(t *testing.T) {
|
|
const userID = int64(1780243201)
|
|
token := signExportAuthToken(userID)
|
|
got, err := verifyExportAuthToken(token)
|
|
if err != nil {
|
|
t.Fatalf("verify: %v", err)
|
|
}
|
|
if got != userID {
|
|
t.Fatalf("got userID %d, want %d", got, userID)
|
|
}
|
|
}
|
|
|
|
func TestExportAuthTokenRejectsTampering(t *testing.T) {
|
|
token := signExportAuthToken(1780243201)
|
|
token[0] ^= 0xFF
|
|
if _, err := verifyExportAuthToken(token); err == nil {
|
|
t.Fatal("expected tampered token to fail verification")
|
|
}
|
|
}
|
|
|
|
func TestExportAuthTokenRejectsWrongLength(t *testing.T) {
|
|
if _, err := verifyExportAuthToken([]byte{1, 2, 3}); err == nil {
|
|
t.Fatal("expected short token to fail verification")
|
|
}
|
|
}
|
|
|
|
func TestExportAuthTokenRejectsExpired(t *testing.T) {
|
|
// Build a token with an already-past expiry, signed the same way
|
|
// signExportAuthToken does, to exercise the expiry check specifically
|
|
// (as opposed to the HMAC check).
|
|
payload := make([]byte, 16, 48)
|
|
binary.BigEndian.PutUint64(payload[0:8], uint64(1780243201))
|
|
binary.BigEndian.PutUint64(payload[8:16], uint64(time.Now().Add(-time.Minute).Unix()))
|
|
mac := hmac.New(sha256.New, exportAuthSecret)
|
|
mac.Write(payload)
|
|
token := mac.Sum(payload)
|
|
|
|
if _, err := verifyExportAuthToken(token); err == nil {
|
|
t.Fatal("expected expired token to fail verification")
|
|
}
|
|
}
|