96 lines
2.8 KiB
Go
96 lines
2.8 KiB
Go
package token
|
|
|
|
import (
|
|
"encoding/json"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/tinode/chat/server/auth"
|
|
"github.com/tinode/chat/server/store/types"
|
|
)
|
|
|
|
func newTestAuthenticator(t *testing.T) *authenticator {
|
|
t.Helper()
|
|
conf, err := json.Marshal(map[string]any{
|
|
"key": []byte("0123456789abcdef0123456789abcdef"),
|
|
"serial_num": 3,
|
|
"expire_in": 3600,
|
|
})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
ta := &authenticator{}
|
|
if err = ta.Init(conf, "token-test"); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
return ta
|
|
}
|
|
|
|
func TestTokenV2TenantRoundTrip(t *testing.T) {
|
|
ta := newTestAuthenticator(t)
|
|
rec := &auth.Rec{
|
|
TenantID: 7,
|
|
Uid: 42,
|
|
AuthLevel: auth.LevelAuth,
|
|
Lifetime: auth.Duration(time.Hour),
|
|
Features: auth.FeatureValidated,
|
|
}
|
|
token, _, err := ta.GenSecret(rec)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if got, want := len(token), 59; got != want {
|
|
t.Fatalf("token length: got %d, want %d", got, want)
|
|
}
|
|
|
|
got, challenge, err := ta.Authenticate(auth.AuthContext{TenantID: 7}, token)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if challenge != nil {
|
|
t.Fatal("unexpected challenge")
|
|
}
|
|
if got.TenantID != rec.TenantID || got.Uid != rec.Uid || got.AuthLevel != rec.AuthLevel || got.Features != rec.Features {
|
|
t.Fatalf("round trip mismatch: got %+v, want %+v", got, rec)
|
|
}
|
|
|
|
// HTTP authentication may recover the tenant from the signed token.
|
|
got, _, err = ta.Authenticate(auth.AuthContext{}, token)
|
|
if err != nil || got.TenantID != rec.TenantID {
|
|
t.Fatalf("tenant recovery failed: rec=%+v err=%v", got, err)
|
|
}
|
|
}
|
|
|
|
func TestTokenV2RejectsWrongOrTamperedTenant(t *testing.T) {
|
|
ta := newTestAuthenticator(t)
|
|
token, _, err := ta.GenSecret(&auth.Rec{
|
|
TenantID: 7, Uid: 42, AuthLevel: auth.LevelAuth, Lifetime: auth.Duration(time.Hour),
|
|
})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
if _, _, err = ta.Authenticate(auth.AuthContext{TenantID: 8}, token); err != types.ErrFailed {
|
|
t.Fatalf("wrong tenant: got %v, want %v", err, types.ErrFailed)
|
|
}
|
|
|
|
tampered := append([]byte(nil), token...)
|
|
tampered[1] ^= 1 // First byte of tenant_id in the little-endian payload.
|
|
if _, _, err = ta.Authenticate(auth.AuthContext{}, tampered); err != types.ErrFailed {
|
|
t.Fatalf("tampered tenant: got %v, want %v", err, types.ErrFailed)
|
|
}
|
|
}
|
|
|
|
func TestTokenV2RejectsLegacyAndMissingIdentity(t *testing.T) {
|
|
ta := newTestAuthenticator(t)
|
|
if _, _, err := ta.Authenticate(auth.AuthContext{}, make([]byte, 50)); err != types.ErrMalformed {
|
|
t.Fatalf("legacy token: got %v, want %v", err, types.ErrMalformed)
|
|
}
|
|
if _, _, err := ta.GenSecret(&auth.Rec{Uid: 42, AuthLevel: auth.LevelAuth}); err != types.ErrMalformed {
|
|
t.Fatalf("missing tenant: got %v, want %v", err, types.ErrMalformed)
|
|
}
|
|
if _, _, err := ta.GenSecret(&auth.Rec{TenantID: 7, AuthLevel: auth.LevelAuth}); err != types.ErrMalformed {
|
|
t.Fatalf("missing uid: got %v, want %v", err, types.ErrMalformed)
|
|
}
|
|
}
|