gamertan
5905fe6fb2
verify / verify (push) Successful in 3m14s
Publish the reviewed Web Foundations v0.1.0-preview.3 snapshot with cryptographic temporary credentials, explicit forced-rotation state, atomic password replacement and session revocation, additive SQLite migration, tests, and application-boundary documentation. Exported from reviewed private source b8fb4ff3cd012859f2d307dfb2a1cc783a38f6db after trusted CI run 257 and exact Go 1.26.6 verification. Material implementation assistance provided by OpenAI Codex; reviewed and verified through the maintainer workflow. Signed-off-by: Cole Speelman <crspeelman@gmail.com>
81 lines
2.7 KiB
Go
81 lines
2.7 KiB
Go
// SPDX-License-Identifier: MPL-2.0
|
|
|
|
package auth
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
)
|
|
|
|
func TestSessionDistinguishesMissingFromUnavailableStorage(t *testing.T) {
|
|
service, err := New(repositoryStub{sessionErr: ErrSessionNotFound}, Options{})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if _, err = service.Session(t.Context(), strings.Repeat("x", 43)); !errors.Is(err, ErrSessionNotFound) {
|
|
t.Fatalf("missing err=%v", err)
|
|
}
|
|
|
|
storageErr := errors.New("storage offline")
|
|
service, err = New(repositoryStub{sessionErr: storageErr}, Options{})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if _, err = service.Session(t.Context(), strings.Repeat("x", 43)); !errors.Is(err, storageErr) || errors.Is(err, ErrSessionNotFound) {
|
|
t.Fatalf("storage err=%v", err)
|
|
}
|
|
}
|
|
|
|
func TestRevokeSessionRejectsInvalidTokenBeforeStorage(t *testing.T) {
|
|
repository := &recordingRepository{}
|
|
service, err := New(repository, Options{})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err = service.RevokeSession(t.Context(), "short"); !errors.Is(err, ErrSessionNotFound) {
|
|
t.Fatalf("err=%v", err)
|
|
}
|
|
if repository.deleted {
|
|
t.Fatal("storage called for invalid token")
|
|
}
|
|
}
|
|
|
|
type recordingRepository struct {
|
|
repositoryStub
|
|
deleted bool
|
|
}
|
|
|
|
func (repository *recordingRepository) DeleteSession(context.Context, [32]byte) error {
|
|
repository.deleted = true
|
|
return nil
|
|
}
|
|
|
|
type repositoryStub struct{ sessionErr error }
|
|
|
|
func (repositoryStub) CreateUser(context.Context, User, string) error { return nil }
|
|
func (repositoryStub) CredentialByIdentifier(context.Context, string) (User, string, error) {
|
|
return User{}, "", ErrUserNotFound
|
|
}
|
|
func (repositoryStub) CredentialByUserID(context.Context, string) (User, string, error) {
|
|
return User{}, "", ErrUserNotFound
|
|
}
|
|
func (repositoryStub) ReplacePasswordAndRevokeSessions(context.Context, string, string, string, time.Time) error {
|
|
return nil
|
|
}
|
|
func (repositoryStub) UpdateLastLogin(context.Context, string, time.Time) error { return nil }
|
|
func (repositoryStub) CreateSession(context.Context, Session) error { return nil }
|
|
func (repository repositoryStub) PrincipalBySession(context.Context, [32]byte, time.Time) (Principal, Session, error) {
|
|
return Principal{}, Session{}, repository.sessionErr
|
|
}
|
|
func (repositoryStub) TouchSession(context.Context, [32]byte, time.Time) error { return nil }
|
|
func (repositoryStub) DeleteSession(context.Context, [32]byte) error { return nil }
|
|
func (repositoryStub) RevokeUserSessions(context.Context, string) error { return nil }
|
|
func (repositoryStub) SeedPolicy(context.Context, PolicySeed) error { return nil }
|
|
func (repositoryStub) GrantRole(context.Context, string, string, time.Time) error {
|
|
return nil
|
|
}
|
|
func (repositoryStub) AppendAudit(context.Context, AuditEvent) error { return nil }
|