Aska
aee8db9b3f
- internal/platform: cross-platform path detection, 6 tests - internal/auth: JWT generation/validation + bcrypt, 8 tests - 89 total tests, build + vet clean
129 lines
3.1 KiB
Go
129 lines
3.1 KiB
Go
package auth
|
|
|
|
import (
|
|
"testing"
|
|
"time"
|
|
)
|
|
|
|
func TestGenerateAndValidate(t *testing.T) {
|
|
tm := NewTokenManager("a-very-long-secret-key-that-is-at-least-32-bytes!!", 720)
|
|
|
|
token, err := tm.Generate("user-123", "testuser", "admin")
|
|
if err != nil {
|
|
t.Fatalf("Generate error: %v", err)
|
|
}
|
|
if token == "" {
|
|
t.Fatal("token should not be empty")
|
|
}
|
|
|
|
claims, err := tm.Validate(token)
|
|
if err != nil {
|
|
t.Fatalf("Validate error: %v", err)
|
|
}
|
|
|
|
if claims.UserID != "user-123" {
|
|
t.Errorf("expected UserID=user-123, got %s", claims.UserID)
|
|
}
|
|
if claims.Username != "testuser" {
|
|
t.Errorf("expected Username=testuser, got %s", claims.Username)
|
|
}
|
|
if claims.Role != "admin" {
|
|
t.Errorf("expected Role=admin, got %s", claims.Role)
|
|
}
|
|
if !claims.IsAdmin() {
|
|
t.Error("expected IsAdmin()=true")
|
|
}
|
|
}
|
|
|
|
func TestValidateInvalidToken(t *testing.T) {
|
|
tm := NewTokenManager("the-real-secret-key-that-is-32-bytes!!", 720)
|
|
|
|
_, err := tm.Validate("invalid.token.here")
|
|
if err == nil {
|
|
t.Error("expected error for invalid token")
|
|
}
|
|
}
|
|
|
|
func TestValidateWrongSecret(t *testing.T) {
|
|
tm1 := NewTokenManager("secret-key-number-one-that-is-32-bytes!", 720)
|
|
tm2 := NewTokenManager("secret-key-number-two-that-is-32-bytes!", 720)
|
|
|
|
token, _ := tm1.Generate("user-1", "test", "user")
|
|
_, err := tm2.Validate(token)
|
|
if err == nil {
|
|
t.Error("expected error when validating with wrong secret")
|
|
}
|
|
}
|
|
|
|
func TestExpiredToken(t *testing.T) {
|
|
tm := NewTokenManager("a-very-long-secret-key-that-is-at-least-32-bytes!!", -1) // expired immediately
|
|
|
|
token, err := tm.Generate("user-1", "test", "user")
|
|
if err != nil {
|
|
t.Fatalf("Generate error: %v", err)
|
|
}
|
|
|
|
_, err = tm.Validate(token)
|
|
if err == nil {
|
|
t.Error("expected error for expired token")
|
|
}
|
|
}
|
|
|
|
func TestHashPassword(t *testing.T) {
|
|
hash, err := HashPassword("my-secure-password")
|
|
if err != nil {
|
|
t.Fatalf("HashPassword error: %v", err)
|
|
}
|
|
if hash == "" {
|
|
t.Fatal("hash should not be empty")
|
|
}
|
|
if hash == "my-secure-password" {
|
|
t.Error("hash should not be the plaintext password")
|
|
}
|
|
}
|
|
|
|
func TestCheckPassword(t *testing.T) {
|
|
hash, _ := HashPassword("correct-password")
|
|
|
|
if !CheckPassword("correct-password", hash) {
|
|
t.Error("expected password to match")
|
|
}
|
|
if CheckPassword("wrong-password", hash) {
|
|
t.Error("expected wrong password to not match")
|
|
}
|
|
}
|
|
|
|
func TestClaimsIsAdmin(t *testing.T) {
|
|
admin := &Claims{Role: "admin"}
|
|
user := &Claims{Role: "user"}
|
|
empty := &Claims{}
|
|
|
|
if !admin.IsAdmin() {
|
|
t.Error("admin claims should have IsAdmin()=true")
|
|
}
|
|
if user.IsAdmin() {
|
|
t.Error("user claims should have IsAdmin()=false")
|
|
}
|
|
if empty.IsAdmin() {
|
|
t.Error("empty claims should have IsAdmin()=false")
|
|
}
|
|
}
|
|
|
|
func TestTokenManagerExpiry(t *testing.T) {
|
|
tm := NewTokenManager("a-very-long-secret-key-that-is-at-least-32-bytes!!", 1) // 1 hour
|
|
|
|
token, _ := tm.Generate("user-1", "test", "user")
|
|
claims, err := tm.Validate(token)
|
|
if err != nil {
|
|
t.Fatalf("Validate error: %v", err)
|
|
}
|
|
|
|
issuedAt := claims.IssuedAt.Time
|
|
expiresAt := claims.ExpiresAt.Time
|
|
diff := expiresAt.Sub(issuedAt)
|
|
|
|
if diff < 59*time.Minute || diff > 61*time.Minute {
|
|
t.Errorf("expected expiry ~1 hour from issue, got %v", diff)
|
|
}
|
|
}
|