94 lines
3.3 KiB
Go
94 lines
3.3 KiB
Go
package store
|
|
|
|
import (
|
|
"bytes"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/tinode/chat/server/store/types"
|
|
)
|
|
|
|
func TestMessageCryptoRoundTrip(t *testing.T) {
|
|
tenantID := types.TenantID(9001)
|
|
key := bytes.Repeat([]byte{7}, 32)
|
|
messageKeyCache.Lock()
|
|
expires := time.Now().Add(time.Minute)
|
|
messageKeyCache.items[messageKeyCacheID(tenantID, 0)] = cachedMessageKey{enabled: true, version: 3, key: key, expires: expires}
|
|
messageKeyCache.items[messageKeyCacheID(tenantID, 3)] = cachedMessageKey{enabled: true, version: 3, key: key, expires: expires}
|
|
messageKeyCache.Unlock()
|
|
defer InvalidateMessageEncryptionKeys(tenantID)
|
|
|
|
original := &types.Message{TenantID: tenantID, Topic: "p2p-test", SeqId: 42, Content: map[string]any{"txt": "hello"}}
|
|
stored, err := encryptMessageContent(original)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if stored.KeyVersion != 3 || len(stored.ContentNonce) != 12 || stored.Content == original.Content {
|
|
t.Fatalf("message was not encrypted: %#v", stored)
|
|
}
|
|
if err = decryptMessageContent(stored); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
content, ok := stored.Content.(map[string]any)
|
|
if !ok || content["txt"] != "hello" {
|
|
t.Fatalf("unexpected plaintext: %#v", stored.Content)
|
|
}
|
|
}
|
|
|
|
func TestMessageCryptoPlaintextWhenDisabled(t *testing.T) {
|
|
tenantID := types.TenantID(9002)
|
|
messageKeyCache.Lock()
|
|
messageKeyCache.items[messageKeyCacheID(tenantID, 0)] = cachedMessageKey{expires: time.Now().Add(time.Minute)}
|
|
messageKeyCache.Unlock()
|
|
defer InvalidateMessageEncryptionKeys(tenantID)
|
|
|
|
original := &types.Message{TenantID: tenantID, Topic: "grp-test", SeqId: 7, Content: "plain"}
|
|
stored, err := encryptMessageContent(original)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if stored.KeyVersion != 0 || stored.Content != "plain" || len(stored.ContentNonce) != 0 {
|
|
t.Fatalf("unexpected encrypted message: %#v", stored)
|
|
}
|
|
}
|
|
|
|
func TestMessageCryptoRejectsTampering(t *testing.T) {
|
|
tenantID := types.TenantID(9003)
|
|
key := bytes.Repeat([]byte{9}, 32)
|
|
expires := time.Now().Add(time.Minute)
|
|
messageKeyCache.Lock()
|
|
messageKeyCache.items[messageKeyCacheID(tenantID, 0)] = cachedMessageKey{enabled: true, version: 4, key: key, expires: expires}
|
|
messageKeyCache.items[messageKeyCacheID(tenantID, 4)] = cachedMessageKey{enabled: true, version: 4, key: key, expires: expires}
|
|
messageKeyCache.Unlock()
|
|
defer InvalidateMessageEncryptionKeys(tenantID)
|
|
|
|
original := &types.Message{TenantID: tenantID, Topic: "p2p-secure", SeqId: 8, Content: map[string]any{"txt": "secret"}}
|
|
stored, err := encryptMessageContent(original)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
stored.Topic = "p2p-tampered"
|
|
if err = decryptMessageContent(stored); err == nil {
|
|
t.Fatal("expected authenticated decryption to reject changed topic")
|
|
}
|
|
|
|
stored, err = encryptMessageContent(original)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
stored.ContentNonce = stored.ContentNonce[:len(stored.ContentNonce)-1]
|
|
if err = decryptMessageContent(stored); err == nil {
|
|
t.Fatal("expected invalid nonce length to be rejected")
|
|
}
|
|
}
|
|
|
|
func TestMessageCryptoSearchMatchesDecryptedContent(t *testing.T) {
|
|
content := map[string]any{"txt": "项目 验收通过", "nested": map[string]any{"title": "日报"}}
|
|
if !messageContentMatchesSearch(content, "验收") {
|
|
t.Fatal("expected plaintext keyword to match")
|
|
}
|
|
if messageContentMatchesSearch(content, "不存在") {
|
|
t.Fatal("unexpected keyword match")
|
|
}
|
|
}
|