test(06-14): regression coverage for surf and bouncer gap closure

bouncer/jwt_test.go

@@ -252,3 +252,43 @@ func TestVerifyRejectsFractionalSubject(t *testing.T) {
 		t.Fatalf("whole sub: %q %v", sub, err)
 	}
 }
+
+func TestVerifySubjectMatrix(t *testing.T) {
+	exp := time.Now().Add(time.Hour).Unix()
+	cases := []struct {
+		name string
+		sub  any
+		want string
+	}{
+		{"fractional", 12.5, ""},
+		{"huge float", 1e300, ""},
+		{"2^60 float", float64(1 << 60), ""},
+		{"negative", -1, ""},
+		{"zero", 0, ""},
+		{"whole number", 12, "12"},
+		{"string", "12", "12"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			tok := sign(t, jwt.SigningMethodHS256, jwt.MapClaims{"sub": tc.sub, "exp": exp}, []byte(secret))
+			sub, err := Verify(tok, secret)
+			if tc.want == "" {
+				if err == nil || sub != "" {
+					t.Fatalf("sub %v accepted: %q", tc.sub, sub)
+				}
+				return
+			}
+			if err != nil || sub != tc.want {
+				t.Fatalf("sub %v: %q %v", tc.sub, sub, err)
+			}
+		})
+	}
+}
+
+func TestSubjectJSONNumber(t *testing.T) {
+	for in, want := range map[string]string{"1.5": "", "-3": "", "0": "", "12": "12"} {
+		if got := subject(jwt.MapClaims{"sub": json.Number(in)}); got != want {
+			t.Errorf("json.Number(%q) = %q, want %q", in, got, want)
+		}
+	}
+}

bouncer/registry_test.go

@@ -245,3 +245,47 @@ func TestRegisterRejectsTypedNilGuard(t *testing.T) {
 type credPtrGuard struct{}
 
 func (*credPtrGuard) Authenticate(*http.Request) (*Principal, error) { return nil, nil }
+
+type nilFuncGuard func(*http.Request) (*Principal, error)
+
+func (f nilFuncGuard) Authenticate(r *http.Request) (*Principal, error) { return f(r) }
+
+type nilMapGuard map[string]string
+
+func (nilMapGuard) Authenticate(*http.Request) (*Principal, error) { return nil, nil }
+
+func TestRegisterRejectsTypedNilPointerFuncMapGuards(t *testing.T) {
+	var (
+		ptr *credPtrGuard
+		fn  nilFuncGuard
+		mp  nilMapGuard
+	)
+	for name, g := range map[string]any{"pointer": ptr, "func": fn, "map": mp} {
+		t.Run(name, func(t *testing.T) {
+			var reg Registry
+			err := reg.Register("golem15.p", "g", g)
+			if err == nil || !strings.Contains(err.Error(), "golem15.p") || !strings.Contains(err.Error(), `"g"`) {
+				t.Fatalf("typed-nil %s guard: err = %v", name, err)
+			}
+			if _, err := reg.Middleware("g"); err == nil {
+				t.Fatal("rejected guard must not be resolvable")
+			}
+		})
+	}
+}
+
+func TestRegisterAcceptsValidGuards(t *testing.T) {
+	var reg Registry
+	if err := reg.Register("p", "ptr", &credPtrGuard{}); err != nil {
+		t.Fatal(err)
+	}
+	if err := reg.Register("p", "fn", nilFuncGuard(func(*http.Request) (*Principal, error) { return nil, nil })); err != nil {
+		t.Fatal(err)
+	}
+	if err := reg.Register("p", "map", nilMapGuard{}); err != nil {
+		t.Fatal(err)
+	}
+	if err := reg.Register("p", "w", writerGuard{}); err != nil {
+		t.Fatal(err)
+	}
+}