Rogeeandrogee
f719529d66
* fix(security): harden auth and credential handling (HH-444) * fix(security): address HH-444 review blockers * fix(security): close remaining HH-444 review blockers --------- Co-authored-by: Rogee <rogee@ipao.vip>
36 lines
1.5 KiB
Go
36 lines
1.5 KiB
Go
package service
|
|
|
|
import (
|
|
"context"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/require"
|
|
"gorm.io/driver/sqlite"
|
|
"gorm.io/gorm"
|
|
|
|
"github.com/gochat/gochat/internal/auth"
|
|
"github.com/gochat/gochat/internal/config"
|
|
"github.com/gochat/gochat/internal/model"
|
|
)
|
|
|
|
func TestRevokedSessionRejectsExistingAccessToken(t *testing.T) {
|
|
db, err := gorm.Open(sqlite.Open("file:revoked-session?mode=memory&cache=shared"), &gorm.Config{})
|
|
require.NoError(t, err)
|
|
require.NoError(t, db.AutoMigrate(&model.User{}, &model.UserSession{}))
|
|
user := model.User{Base: model.Base{ID: 77}, AccountID: 3, Name: "Agent", Email: "agent@example.test", Provider: "email", Active: true}
|
|
require.NoError(t, db.Create(&user).Error)
|
|
|
|
cfg := &config.JWTConfig{Secret: "test-secret", AccessExpiryMinutes: 15, RefreshExpiryHours: 168}
|
|
jwtService := auth.NewJWTService(cfg)
|
|
refreshStore := auth.NewRefreshTokenStore(nil, cfg)
|
|
service := NewAuthService(db, jwtService, refreshStore)
|
|
login := &LoginOutput{User: &user, AccountID: 3, Role: "agent"}
|
|
require.NoError(t, service.TrackChatwootSession(context.Background(), login, "browser", "127.0.0.1", "test"))
|
|
|
|
_, err = service.ValidateAccessToken(context.Background(), login.TokenPair.AccessToken)
|
|
require.NoError(t, err)
|
|
require.NoError(t, service.RevokeChatwootSession(context.Background(), user.ID, login.ClientID))
|
|
_, err = service.ValidateAccessToken(context.Background(), login.TokenPair.AccessToken)
|
|
require.ErrorContains(t, err, "session revoked")
|
|
}
|