Efremenko Arhip
c6a66747eb
- migration 0002: users.verified boolean, default false
- verified rides in the JWT (role + verified claims)
- POST /users/{id}/verify + /unverify, admin-only (403 otherwise)
- Issue now takes the whole user so trust claims travel in the token
- unit + integration + admin-flow tests
78 lines
2.1 KiB
Go
78 lines
2.1 KiB
Go
package auth
|
|
|
|
import (
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/golang-jwt/jwt/v5"
|
|
"github.com/google/uuid"
|
|
|
|
"github.com/emil28092005/SciMesh/users/internal/domain"
|
|
)
|
|
|
|
const testSecret = "test-secret-at-least-32-bytes-long!!"
|
|
|
|
func TestIssueVerifyRoundTrip(t *testing.T) {
|
|
iss := NewIssuer(testSecret, time.Hour, nil)
|
|
id := uuid.New()
|
|
|
|
token, err := iss.Issue(&domain.User{ID: id, Role: domain.RoleAdmin, Verified: true})
|
|
if err != nil {
|
|
t.Fatalf("issue: %v", err)
|
|
}
|
|
|
|
claims, err := iss.Verify(token)
|
|
if err != nil {
|
|
t.Fatalf("verify: %v", err)
|
|
}
|
|
if claims.Subject != id.String() {
|
|
t.Errorf("sub = %q, want %q", claims.Subject, id.String())
|
|
}
|
|
if claims.Role != domain.RoleAdmin {
|
|
t.Errorf("role = %q, want admin", claims.Role)
|
|
}
|
|
if !claims.Verified {
|
|
t.Error("verified claim not carried in token")
|
|
}
|
|
}
|
|
|
|
func TestVerifyRejectsExpired(t *testing.T) {
|
|
// Negative TTL: the token is already expired when issued.
|
|
iss := NewIssuer(testSecret, -time.Minute, nil)
|
|
token, _ := iss.Issue(&domain.User{ID: uuid.New(), Role: domain.RoleUser})
|
|
|
|
if _, err := iss.Verify(token); err == nil {
|
|
t.Error("expired token accepted")
|
|
}
|
|
}
|
|
|
|
func TestVerifyRejectsWrongSecret(t *testing.T) {
|
|
token, _ := NewIssuer(testSecret, time.Hour, nil).Issue(&domain.User{ID: uuid.New(), Role: domain.RoleUser})
|
|
|
|
other := NewIssuer("another-secret-also-32-bytes-long!!!", time.Hour, nil)
|
|
if _, err := other.Verify(token); err == nil {
|
|
t.Error("token verified under the wrong secret")
|
|
}
|
|
}
|
|
|
|
func TestVerifyRejectsNoneAlgorithm(t *testing.T) {
|
|
// Forge a token signed with "none" — the classic algorithm-substitution
|
|
// attack. A verifier that trusts the header's alg would accept it.
|
|
tok := jwt.NewWithClaims(jwt.SigningMethodNone, Claims{
|
|
Role: domain.RoleAdmin,
|
|
RegisteredClaims: jwt.RegisteredClaims{
|
|
Subject: uuid.New().String(),
|
|
ExpiresAt: jwt.NewNumericDate(time.Now().Add(time.Hour)),
|
|
},
|
|
})
|
|
raw, err := tok.SignedString(jwt.UnsafeAllowNoneSignatureType)
|
|
if err != nil {
|
|
t.Fatalf("sign none: %v", err)
|
|
}
|
|
|
|
iss := NewIssuer(testSecret, time.Hour, nil)
|
|
if _, err := iss.Verify(raw); err == nil {
|
|
t.Error("none-signed token accepted")
|
|
}
|
|
}
|