149 lines
3.5 KiB
Go
149 lines
3.5 KiB
Go
package auth
|
|
|
|
import (
|
|
"crypto/ed25519"
|
|
"crypto/rand"
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
|
|
gossh "golang.org/x/crypto/ssh"
|
|
)
|
|
|
|
const testSecret = "test-secret-key-for-jwt-testing"
|
|
|
|
func TestGenerateToken(t *testing.T) {
|
|
mgr := NewJWTManager(testSecret, 30*time.Minute)
|
|
|
|
token, err := mgr.GenerateToken(1, "test@example.com", "testuser")
|
|
if err != nil {
|
|
t.Fatalf("expected no error, got %v", err)
|
|
}
|
|
if token == "" {
|
|
t.Fatal("expected non-empty token")
|
|
}
|
|
}
|
|
|
|
func TestValidateTokenRoundTrip(t *testing.T) {
|
|
mgr := NewJWTManager(testSecret, 30*time.Minute)
|
|
|
|
token, err := mgr.GenerateToken(42, "user@test.com", "myuser")
|
|
if err != nil {
|
|
t.Fatalf("generate failed: %v", err)
|
|
}
|
|
|
|
claims, err := mgr.ValidateToken(token)
|
|
if err != nil {
|
|
t.Fatalf("validate failed: %v", err)
|
|
}
|
|
|
|
if claims.UserID != 42 {
|
|
t.Errorf("expected UserID 42, got %d", claims.UserID)
|
|
}
|
|
if claims.Email != "user@test.com" {
|
|
t.Errorf("expected Email user@test.com, got %s", claims.Email)
|
|
}
|
|
if claims.Username != "myuser" {
|
|
t.Errorf("expected Username myuser, got %s", claims.Username)
|
|
}
|
|
}
|
|
|
|
func TestValidateTokenIssuer(t *testing.T) {
|
|
mgr := NewJWTManager(testSecret, 30*time.Minute)
|
|
|
|
token, _ := mgr.GenerateToken(1, "", "")
|
|
claims, err := mgr.ValidateToken(token)
|
|
if err != nil {
|
|
t.Fatalf("validate failed: %v", err)
|
|
}
|
|
|
|
if claims.Issuer != "terminalshop" {
|
|
t.Errorf("expected issuer terminalshop, got %s", claims.Issuer)
|
|
}
|
|
}
|
|
|
|
func TestValidateTokenExpired(t *testing.T) {
|
|
// Token that expired 1 second ago
|
|
mgr := NewJWTManager(testSecret, -1*time.Second)
|
|
|
|
token, err := mgr.GenerateToken(1, "", "")
|
|
if err != nil {
|
|
t.Fatalf("generate failed: %v", err)
|
|
}
|
|
|
|
_, err = mgr.ValidateToken(token)
|
|
if err == nil {
|
|
t.Fatal("expected error for expired token")
|
|
}
|
|
}
|
|
|
|
func TestValidateTokenWrongSecret(t *testing.T) {
|
|
generator := NewJWTManager("secret-a", 30*time.Minute)
|
|
validator := NewJWTManager("secret-b", 30*time.Minute)
|
|
|
|
token, _ := generator.GenerateToken(1, "", "")
|
|
|
|
_, err := validator.ValidateToken(token)
|
|
if err == nil {
|
|
t.Fatal("expected error when validating with wrong secret")
|
|
}
|
|
}
|
|
|
|
func TestValidateTokenMalformed(t *testing.T) {
|
|
mgr := NewJWTManager(testSecret, 30*time.Minute)
|
|
|
|
_, err := mgr.ValidateToken("not.a.valid.jwt")
|
|
if err == nil {
|
|
t.Fatal("expected error for malformed token")
|
|
}
|
|
}
|
|
|
|
func TestValidateTokenEmptyString(t *testing.T) {
|
|
mgr := NewJWTManager(testSecret, 30*time.Minute)
|
|
|
|
_, err := mgr.ValidateToken("")
|
|
if err == nil {
|
|
t.Fatal("expected error for empty token string")
|
|
}
|
|
}
|
|
|
|
func TestGetSSHKeyFingerprint(t *testing.T) {
|
|
pubKey := generateTestSSHKey(t)
|
|
|
|
fp := GetSSHKeyFingerprint(pubKey)
|
|
if !strings.HasPrefix(fp, "SHA256:") {
|
|
t.Errorf("expected fingerprint to start with SHA256:, got %s", fp)
|
|
}
|
|
|
|
// Should be deterministic
|
|
fp2 := GetSSHKeyFingerprint(pubKey)
|
|
if fp != fp2 {
|
|
t.Errorf("fingerprint not deterministic: %s vs %s", fp, fp2)
|
|
}
|
|
}
|
|
|
|
func TestFormatSSHPublicKey(t *testing.T) {
|
|
pubKey := generateTestSSHKey(t)
|
|
|
|
formatted := FormatSSHPublicKey(pubKey)
|
|
if !strings.HasPrefix(formatted, "ssh-ed25519 ") {
|
|
t.Errorf("expected formatted key to start with ssh-ed25519, got %s", formatted[:20])
|
|
}
|
|
}
|
|
|
|
// generateTestSSHKey creates an ed25519 SSH key pair for testing.
|
|
func generateTestSSHKey(t *testing.T) gossh.PublicKey {
|
|
t.Helper()
|
|
pub, _, err := ed25519.GenerateKey(rand.Reader)
|
|
if err != nil {
|
|
t.Fatalf("failed to generate ed25519 key: %v", err)
|
|
}
|
|
|
|
sshPub, err := gossh.NewPublicKey(pub)
|
|
if err != nil {
|
|
t.Fatalf("failed to convert to ssh public key: %v", err)
|
|
}
|
|
|
|
return sshPub
|
|
}
|