Add session-bound personal profile editing

auth/profile_test.go

@@ -0,0 +1,43 @@
+// SPDX-License-Identifier: MPL-2.0
+
+package auth
+
+import "testing"
+
+func TestNormalizeProfileValue(t *testing.T) {
+	for _, value := range []struct{ field, value, want string }{
+		{"username", "  Reader.One ", "Reader.One"}, {"display_name", " Émilie ★ ", "Émilie ★"},
+	} {
+		got, err := NormalizeProfileValue(value.field, value.value)
+		if err != nil || got != value.want {
+			t.Fatalf("normalization: %q %v", got, err)
+		}
+	}
+	for _, value := range []struct{ field, value string }{
+		{"email", "new@example.test"}, {"role", "owner"}, {"username", "a"}, {"username", "foo@bar"},
+		{"display_name", ""}, {"display_name", "hello\x00world"}, {"display_name", "hello\nworld"}, {"display_name", string([]byte{0xff})},
+	} {
+		if _, err := NormalizeProfileValue(value.field, value.value); err == nil {
+			t.Fatalf("invalid field accepted: %s", value.field)
+		}
+	}
+}
+
+func FuzzProfileValue(f *testing.F) {
+	f.Add("username", "reader.one")
+	f.Add("display_name", "Émilie")
+	f.Add("email", "a@example.test")
+	f.Fuzz(func(t *testing.T, field, value string) {
+		normal, err := NormalizeProfileValue(field, value)
+		if err != nil {
+			return
+		}
+		if len(normal) == 0 || len(normal) > 128 {
+			t.Fatal("unbounded value")
+		}
+		again, err := NormalizeProfileValue(field, normal)
+		if err != nil || again != normal {
+			t.Fatal("unstable normalization")
+		}
+	})
+}