135 lines
4.5 KiB
Go
135 lines
4.5 KiB
Go
package security
|
|
|
|
import (
|
|
"context"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/alicebob/miniredis/v2"
|
|
"github.com/gochat/gochat/internal/config"
|
|
"github.com/redis/go-redis/v9"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestTestWrite_Cov3(t *testing.T) {
|
|
TestWrite()
|
|
}
|
|
|
|
func TestTokenBlacklistService_IsBlacklisted_NotBlacklisted_Cov3(t *testing.T) {
|
|
mr := miniredis.RunT(t)
|
|
rdb := redis.NewClient(&redis.Options{Addr: mr.Addr()})
|
|
cfg := &config.JWTConfig{Secret: "test-secret", AccessExpiryMinutes: 60}
|
|
svc := NewTokenBlacklistService(rdb, cfg)
|
|
|
|
bl, err := svc.IsBlacklisted(context.Background(), "some-token")
|
|
require.NoError(t, err)
|
|
assert.False(t, bl)
|
|
}
|
|
|
|
func TestTokenBlacklistService_IsBlacklisted_Blacklisted_Cov3(t *testing.T) {
|
|
mr := miniredis.RunT(t)
|
|
rdb := redis.NewClient(&redis.Options{Addr: mr.Addr()})
|
|
cfg := &config.JWTConfig{Secret: "test-secret", AccessExpiryMinutes: 60}
|
|
svc := NewTokenBlacklistService(rdb, cfg)
|
|
|
|
// Manually set blacklist entry
|
|
mr.Set("gochat:token_blacklist:"+hashToken("some-token"), "1")
|
|
|
|
bl, err := svc.IsBlacklisted(context.Background(), "some-token")
|
|
require.NoError(t, err)
|
|
assert.True(t, bl)
|
|
}
|
|
|
|
func TestTokenBlacklistService_IsBlacklisted_NotOne_Cov3(t *testing.T) {
|
|
mr := miniredis.RunT(t)
|
|
rdb := redis.NewClient(&redis.Options{Addr: mr.Addr()})
|
|
cfg := &config.JWTConfig{Secret: "test-secret", AccessExpiryMinutes: 60}
|
|
svc := NewTokenBlacklistService(rdb, cfg)
|
|
|
|
// Set blacklist entry to something other than "1"
|
|
mr.Set("gochat:token_blacklist:"+hashToken("some-token"), "0")
|
|
|
|
bl, err := svc.IsBlacklisted(context.Background(), "some-token")
|
|
require.NoError(t, err)
|
|
assert.False(t, bl)
|
|
}
|
|
|
|
func TestTokenBlacklistService_BlacklistAllUserTokens_Cov3(t *testing.T) {
|
|
mr := miniredis.RunT(t)
|
|
rdb := redis.NewClient(&redis.Options{Addr: mr.Addr()})
|
|
cfg := &config.JWTConfig{Secret: "test-secret", AccessExpiryMinutes: 60}
|
|
svc := NewTokenBlacklistService(rdb, cfg)
|
|
|
|
err := svc.BlacklistAllUserTokens(context.Background(), 42)
|
|
require.NoError(t, err)
|
|
|
|
// Verify the key was set
|
|
assert.True(t, mr.Exists("gochat:user_revoke:42"))
|
|
}
|
|
|
|
func TestTokenBlacklistService_IsUserFullyRevoked_NotRevoked_Cov3(t *testing.T) {
|
|
mr := miniredis.RunT(t)
|
|
rdb := redis.NewClient(&redis.Options{Addr: mr.Addr()})
|
|
cfg := &config.JWTConfig{Secret: "test-secret", AccessExpiryMinutes: 60}
|
|
svc := NewTokenBlacklistService(rdb, cfg)
|
|
|
|
revoked, err := svc.IsUserFullyRevoked(context.Background(), 42, time.Now())
|
|
require.NoError(t, err)
|
|
assert.False(t, revoked)
|
|
}
|
|
|
|
func TestTokenBlacklistService_IsUserFullyRevoked_Revoked_Cov3(t *testing.T) {
|
|
mr := miniredis.RunT(t)
|
|
rdb := redis.NewClient(&redis.Options{Addr: mr.Addr()})
|
|
cfg := &config.JWTConfig{Secret: "test-secret", AccessExpiryMinutes: 60}
|
|
svc := NewTokenBlacklistService(rdb, cfg)
|
|
|
|
// Set revoke marker to a future timestamp
|
|
mr.Set("gochat:user_revoke:42", "9999999999")
|
|
|
|
// Token issued before the revoke timestamp → should be revoked
|
|
revoked, err := svc.IsUserFullyRevoked(context.Background(), 42, time.Now().Add(-time.Hour))
|
|
require.NoError(t, err)
|
|
assert.True(t, revoked)
|
|
}
|
|
|
|
func TestTokenBlacklistService_IsUserFullyRevoked_TokenAfterRevoke_Cov3(t *testing.T) {
|
|
mr := miniredis.RunT(t)
|
|
rdb := redis.NewClient(&redis.Options{Addr: mr.Addr()})
|
|
cfg := &config.JWTConfig{Secret: "test-secret", AccessExpiryMinutes: 60}
|
|
svc := NewTokenBlacklistService(rdb, cfg)
|
|
|
|
// Set revoke marker to 0 (epoch)
|
|
mr.Set("gochat:user_revoke:42", "0")
|
|
|
|
// Token issued after the revoke → should NOT be revoked
|
|
revoked, err := svc.IsUserFullyRevoked(context.Background(), 42, time.Now())
|
|
require.NoError(t, err)
|
|
assert.False(t, revoked)
|
|
}
|
|
|
|
func TestValidateTokenWithChecks_InvalidToken_Cov3(t *testing.T) {
|
|
mr := miniredis.RunT(t)
|
|
rdb := redis.NewClient(&redis.Options{Addr: mr.Addr()})
|
|
cfg := &config.JWTConfig{Secret: "test-secret", AccessExpiryMinutes: 60}
|
|
svc := NewTokenBlacklistService(rdb, cfg)
|
|
|
|
_, err := ValidateTokenWithChecks("invalid-token", cfg, svc, context.Background())
|
|
require.Error(t, err)
|
|
}
|
|
|
|
func TestValidateTokenWithChecks_NilBlacklist_Cov3(t *testing.T) {
|
|
cfg := &config.JWTConfig{Secret: "test-secret", AccessExpiryMinutes: 60}
|
|
|
|
_, err := ValidateTokenWithChecks("invalid-token", cfg, nil, context.Background())
|
|
require.Error(t, err)
|
|
}
|
|
|
|
func TestValidateTokenWithChecks_EmptyToken_Cov3(t *testing.T) {
|
|
cfg := &config.JWTConfig{Secret: "test-secret", AccessExpiryMinutes: 60}
|
|
|
|
_, err := ValidateTokenWithChecks("", cfg, nil, context.Background())
|
|
require.Error(t, err)
|
|
}
|