fix(09): WR-14 let logout revoke an expired token that is still refreshable and always clear the cookie

modules/bouncer/refresh_test.go

@@ -259,3 +259,48 @@ func TestRefreshAudienceForSubject(t *testing.T) {
 		}
 	})
 }
+
+func TestVerifyRefreshableClaimsAudience(t *testing.T) {
+	now := time.Now()
+	token := func(method jwt.SigningMethod, key []byte, claims jwt.MapClaims) string {
+		return sign(t, method, claims, key)
+	}
+	base := func() jwt.MapClaims {
+		return jwt.MapClaims{"sub": "7", "jti": "rj", "aud": AudienceBackend, "iat": now.Add(-10 * time.Minute).Unix(), "exp": now.Add(-time.Minute).Unix()}
+	}
+
+	sub, iat, exp, jti, err := VerifyRefreshableClaimsAudience(token(jwt.SigningMethodHS256, []byte(secret), base()), secret, AudienceBackend, time.Hour)
+	if err != nil || sub != "7" || jti != "rj" || !exp.Before(now) || !iat.Before(exp) {
+		t.Fatalf("expired token inside the refresh window: %q %v %v %q %v", sub, iat, exp, jti, err)
+	}
+	// VerifyClaimsAudience rejects the same token: the difference is the point.
+	if _, _, _, _, err := VerifyClaimsAudience(token(jwt.SigningMethodHS256, []byte(secret), base()), secret, AudienceBackend); err == nil {
+		t.Fatal("VerifyClaimsAudience accepted an expired token")
+	}
+
+	tests := map[string]string{
+		"wrong secret": token(jwt.SigningMethodHS256, []byte("another-secret-value-for-the-test!"), base()),
+		"empty token":  "",
+		"window closed": token(jwt.SigningMethodHS256, []byte(secret), func() jwt.MapClaims {
+			c := base()
+			c["iat"] = now.Add(-2 * time.Hour).Unix()
+			return c
+		}()),
+		"wrong audience": token(jwt.SigningMethodHS256, []byte(secret), func() jwt.MapClaims { c := base(); c["aud"] = AudienceUser; return c }()),
+		"missing audience": token(jwt.SigningMethodHS256, []byte(secret), func() jwt.MapClaims {
+			c := base()
+			delete(c, "aud")
+			return c
+		}()),
+		"missing jti": token(jwt.SigningMethodHS256, []byte(secret), func() jwt.MapClaims { c := base(); delete(c, "jti"); return c }()),
+		"missing iat": token(jwt.SigningMethodHS256, []byte(secret), func() jwt.MapClaims { c := base(); delete(c, "iat"); return c }()),
+	}
+	for name, raw := range tests {
+		if _, _, _, _, err := VerifyRefreshableClaimsAudience(raw, secret, AudienceBackend, time.Hour); err == nil {
+			t.Fatalf("%s: token was accepted", name)
+		}
+	}
+	if _, _, _, _, err := VerifyRefreshableClaimsAudience("x", secret, "", time.Hour); err == nil {
+		t.Fatal("empty audience was accepted")
+	}
+}