98 lines
3.5 KiB
Go
98 lines
3.5 KiB
Go
// SPDX-License-Identifier: MPL-2.0
|
|
|
|
package authsqlite
|
|
|
|
import (
|
|
"bytes"
|
|
"encoding/json"
|
|
"errors"
|
|
"sync"
|
|
"sync/atomic"
|
|
"testing"
|
|
"time"
|
|
|
|
wa "gamertan.com/web/internal/webauthnvendored/webauthn"
|
|
|
|
"gamertan.com/web/auth"
|
|
"gamertan.com/web/authwebauthn"
|
|
)
|
|
|
|
func TestPasskeyCredentialDeletionPreservesConfiguredFloor(t *testing.T) {
|
|
store, err := Open(t.TempDir() + "/auth.db")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
defer store.Close()
|
|
now := time.Date(2026, 8, 19, 12, 0, 0, 0, time.UTC)
|
|
user := auth.User{ID: "passkey-user-id", Username: "passkey.user", Email: "passkey@example.test", DisplayName: "Passkey User", Status: "active", CreatedAt: now, UpdatedAt: now}
|
|
enrollment := authwebauthn.EnrollmentToken{Digest: [32]byte{1}, UserID: user.ID, CreatedAt: now, ExpiresAt: now.Add(time.Minute)}
|
|
if err = store.CreatePasskeyUser(t.Context(), user, enrollment, testAudit("bootstrap-audit", "auth.passkey.bootstrap", user.ID, now)); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
ids := [][]byte{bytes.Repeat([]byte{1}, 32), bytes.Repeat([]byte{2}, 32), bytes.Repeat([]byte{3}, 32)}
|
|
for index, id := range ids {
|
|
encoded, marshalErr := json.Marshal(wa.Credential{ID: id, PublicKey: []byte{1, 2, 3}})
|
|
if marshalErr != nil {
|
|
t.Fatal(marshalErr)
|
|
}
|
|
credential := authwebauthn.Credential{ID: id, UserID: user.ID, Label: "Credential", Data: encoded, CreatedAt: now}
|
|
if err = store.SaveCredential(t.Context(), credential, testAudit("add-audit-"+string(rune('a'+index)), "auth.passkey.add", user.ID, now)); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|
|
if err = store.DeleteCredential(t.Context(), user.ID, ids[0], 2, testAudit("delete-audit", "auth.passkey.remove", user.ID, now)); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err = store.DeleteCredential(t.Context(), user.ID, ids[1], 2, testAudit("delete-floor", "auth.passkey.remove", user.ID, now)); !errors.Is(err, authwebauthn.ErrCredentialFloor) {
|
|
t.Fatalf("credential floor err=%v", err)
|
|
}
|
|
if err = store.DeleteCredential(t.Context(), user.ID, ids[1], 1, testAudit("delete-second", "auth.passkey.remove", user.ID, now)); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err = store.DeleteCredential(t.Context(), user.ID, ids[2], 1, testAudit("delete-last", "auth.passkey.remove", user.ID, now)); !errors.Is(err, authwebauthn.ErrLastCredential) {
|
|
t.Fatalf("last credential err=%v", err)
|
|
}
|
|
}
|
|
|
|
func TestPasskeyCeremonyIsConsumedExactlyOnceConcurrently(t *testing.T) {
|
|
store, err := Open(t.TempDir() + "/auth.db")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
defer store.Close()
|
|
now := time.Date(2026, 8, 19, 12, 0, 0, 0, time.UTC)
|
|
digest := [32]byte{1, 2, 3}
|
|
if err = store.CreateCeremony(t.Context(), authwebauthn.Ceremony{Digest: digest, Kind: authwebauthn.CeremonyLogin, SessionData: []byte(`{"challenge":"example"}`), CreatedAt: now, ExpiresAt: now.Add(time.Minute)}); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
var successes atomic.Int32
|
|
unexpected := make(chan error, 16)
|
|
var group sync.WaitGroup
|
|
for range 16 {
|
|
group.Add(1)
|
|
go func() {
|
|
defer group.Done()
|
|
_, takeErr := store.TakeCeremony(t.Context(), digest, now)
|
|
if takeErr == nil {
|
|
successes.Add(1)
|
|
return
|
|
}
|
|
if !errors.Is(takeErr, authwebauthn.ErrCeremonyNotFound) {
|
|
unexpected <- takeErr
|
|
}
|
|
}()
|
|
}
|
|
group.Wait()
|
|
close(unexpected)
|
|
for value := range unexpected {
|
|
t.Fatalf("unexpected concurrent error: %v", value)
|
|
}
|
|
if successes.Load() != 1 {
|
|
t.Fatalf("successful consumes=%d", successes.Load())
|
|
}
|
|
}
|
|
|
|
func testAudit(id, action, resourceID string, now time.Time) auth.AuditEvent {
|
|
return auth.AuditEvent{ID: id, Action: action, ResourceType: "user", ResourceID: resourceID, Summary: "test", CreatedAt: now}
|
|
}
|