38 lines
1.1 KiB
Go
38 lines
1.1 KiB
Go
package credential
|
|
|
|
import (
|
|
"crypto/rand"
|
|
"testing"
|
|
)
|
|
|
|
func TestVaultSeparatesDeviceAndPurpose(t *testing.T) {
|
|
key := make([]byte, 32)
|
|
if _, err := rand.Read(key); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
vault, err := NewVault(key)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
ciphertext, err := vault.Encrypt("device-a", PurposeONVIF, "synthetic-user", "synthetic-password")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
username, password, err := vault.Decrypt("device-a", PurposeONVIF, ciphertext)
|
|
if err != nil || username != "synthetic-user" || password != "synthetic-password" {
|
|
t.Fatalf("credential round trip failed: username=%q err=%v", username, err)
|
|
}
|
|
if _, _, err = vault.Decrypt("device-a", PurposeRTSP, ciphertext); err == nil {
|
|
t.Fatal("credential ciphertext was reusable for another purpose")
|
|
}
|
|
if _, _, err = vault.Decrypt("device-b", PurposeONVIF, ciphertext); err == nil {
|
|
t.Fatal("credential ciphertext was reusable for another device")
|
|
}
|
|
}
|
|
|
|
func TestVaultRejectsInvalidKeyLength(t *testing.T) {
|
|
if _, err := NewVault(make([]byte, 16)); err == nil {
|
|
t.Fatal("short credential key accepted")
|
|
}
|
|
}
|