mirror of
https://github.com/gotify/server.git
synced 2026-09-06 15:57:32 +08:00
ad977d3d9c
* feat: EdDSA token for database leakage/index mitigation * [skip ci]: remove token from api output * fix: e2e tests * fixup! fix: e2e tests * doc: document tokens are now optional fields for app and aclient * fixup(doc): swagger version again * address review comments * address review comments
56 lines
1.7 KiB
Go
56 lines
1.7 KiB
Go
package auth
|
|
|
|
import (
|
|
"crypto/rand"
|
|
"errors"
|
|
"strings"
|
|
"testing"
|
|
"testing/iotest"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
func TestNewComplexToken(t *testing.T) {
|
|
token := NewEnhancedToken("a")
|
|
canonicalizedExpected := token.PublicForm()
|
|
tokenParsed, err := ParseEnhancedToken(token.String())
|
|
assert.NoError(t, err)
|
|
tokenSigned, err := tokenParsed.Sign(12345)
|
|
assert.NoError(t, err)
|
|
tokenSignedStr := tokenSigned.String()
|
|
assert.True(t, tokenSigned.ValidateTimestamp(12345+1))
|
|
assert.False(t, tokenSigned.ValidateTimestamp(12345+maxTimestampDiffSeconds+1))
|
|
canonicalizedActual := tokenSigned.PublicForm()
|
|
assert.Equal(t, canonicalizedExpected, canonicalizedActual)
|
|
|
|
tokenParsed, err = ParseEnhancedToken(tokenSignedStr)
|
|
assert.NoError(t, err)
|
|
canonicalizedActual = tokenParsed.PublicForm()
|
|
assert.Equal(t, canonicalizedExpected, canonicalizedActual)
|
|
_, err = tokenSigned.Sign(12345)
|
|
assert.ErrorIs(t, err, errNoPrivateKey)
|
|
tokenParsed, err = ParseEnhancedToken(tokenSignedStr)
|
|
assert.NoError(t, err)
|
|
canonicalizedActual = tokenParsed.PublicForm()
|
|
assert.Equal(t, canonicalizedExpected, canonicalizedActual)
|
|
var tokenSignedStrMutated string
|
|
lastDotIdx := strings.LastIndex(tokenSignedStr, ".")
|
|
if tokenSignedStr[lastDotIdx+1] != 'A' {
|
|
tokenSignedStrMutated = tokenSignedStr[:lastDotIdx+1] + "A" + tokenSignedStr[lastDotIdx+2:]
|
|
} else {
|
|
tokenSignedStrMutated = tokenSignedStr[:lastDotIdx+1] + "B" + tokenSignedStr[lastDotIdx+2:]
|
|
}
|
|
_, err = ParseEnhancedToken(tokenSignedStrMutated)
|
|
assert.ErrorIs(t, err, errInvalidToken)
|
|
}
|
|
|
|
func TestBadCryptoReaderPanics(t *testing.T) {
|
|
assert.Panics(t, func() {
|
|
randReader = iotest.ErrReader(errors.New("this reader cannot be read"))
|
|
defer func() {
|
|
randReader = rand.Reader
|
|
}()
|
|
randIntn(2)
|
|
})
|
|
}
|