78 lines
2.4 KiB
Go
78 lines
2.4 KiB
Go
package identity
|
|
|
|
import (
|
|
"context"
|
|
"testing"
|
|
"time"
|
|
)
|
|
|
|
func newTestService(t *testing.T) (*Service, *MemoryStore) {
|
|
t.Helper()
|
|
store := NewMemoryStore()
|
|
service, err := NewService(store, Config{SigningKey: []byte("0123456789abcdef0123456789abcdef"), BootstrapToken: "one-time-token", SessionTTL: time.Hour})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
return service, store
|
|
}
|
|
|
|
func TestBootstrapLoginRolesAndRevocation(t *testing.T) {
|
|
service, _ := newTestService(t)
|
|
ctx := context.Background()
|
|
admin, err := service.Bootstrap(ctx, "one-time-token", "admin", "管理员", "StrongPass2026")
|
|
if err != nil {
|
|
t.Fatalf("Bootstrap() error = %v", err)
|
|
}
|
|
if _, err := service.Bootstrap(ctx, "one-time-token", "another", "", "SecondStrong2026"); err != ErrBootstrapDone {
|
|
t.Fatalf("second Bootstrap() error = %v", err)
|
|
}
|
|
principal, raw, err := service.Login(ctx, "admin", "StrongPass2026")
|
|
if err != nil {
|
|
t.Fatalf("Login() error = %v", err)
|
|
}
|
|
if principal.Role != RoleAdministrator || !HasPermission(principal.Role, PermissionUsersWrite) {
|
|
t.Fatalf("unexpected principal: %#v", principal)
|
|
}
|
|
authenticated, err := service.Authenticate(ctx, raw)
|
|
if err != nil || authenticated.UserID != admin.ID {
|
|
t.Fatalf("Authenticate() = %#v, %v", authenticated, err)
|
|
}
|
|
if err := service.Logout(ctx, authenticated); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if _, err := service.Authenticate(ctx, raw); err == nil {
|
|
t.Fatal("revoked token remained valid")
|
|
}
|
|
}
|
|
|
|
func TestInvalidLoginIsUniformAndAudited(t *testing.T) {
|
|
service, _ := newTestService(t)
|
|
ctx := context.Background()
|
|
if _, _, err := service.Login(ctx, "missing", "WrongPass2026"); err == nil {
|
|
t.Fatal("missing user login succeeded")
|
|
}
|
|
entries, err := service.ListAudit(ctx)
|
|
if err != nil || len(entries) != 1 || entries[0].Outcome != "failure" {
|
|
t.Fatalf("audit entries = %#v, %v", entries, err)
|
|
}
|
|
}
|
|
|
|
func TestBellTokenIsRejected(t *testing.T) {
|
|
service, _ := newTestService(t)
|
|
if _, err := service.Authenticate(context.Background(), "not-a-sense-token"); err == nil {
|
|
t.Fatal("foreign token accepted")
|
|
}
|
|
}
|
|
|
|
func TestRoleMatrix(t *testing.T) {
|
|
if HasPermission(RoleViewer, PermissionDeviceWrite) {
|
|
t.Fatal("viewer received write permission")
|
|
}
|
|
if !HasPermission(RoleOperator, PermissionMediaWrite) {
|
|
t.Fatal("operator missing media write permission")
|
|
}
|
|
if HasPermission(RoleSiteAdmin, PermissionUsersWrite) {
|
|
t.Fatal("site admin received user write permission")
|
|
}
|
|
}
|