summercms/modules/bouncer/blacklist_test.go

package bouncer

import (
	"testing"
	"time"
)

func TestBlacklistGraceWindow(t *testing.T) {
	bl := NewMemoryBlacklist()
	now := time.Now()
	if err := bl.Add(t.Context(), "jti", now.Add(time.Hour), now.Add(time.Minute)); err != nil {
		t.Fatal(err)
	}
	blocked, err := bl.IsBlacklisted(t.Context(), "jti")
	if err != nil || blocked {
		t.Fatalf("before validUntil: blocked=%t err=%v", blocked, err)
	}
	if err := bl.Add(t.Context(), "due", now.Add(time.Hour), now.Add(-time.Second)); err != nil {
		t.Fatal(err)
	}
	blocked, err = bl.IsBlacklisted(t.Context(), "due")
	if err != nil || !blocked {
		t.Fatalf("after validUntil: blocked=%t err=%v", blocked, err)
	}
	if err := bl.Add(t.Context(), "now", now.Add(time.Hour), time.Now()); err != nil {
		t.Fatal(err)
	}
	blocked, err = bl.IsBlacklisted(t.Context(), "now")
	if err != nil || !blocked {
		t.Fatalf("at validUntil: blocked=%t err=%v", blocked, err)
	}
}

func TestBlacklistSweep(t *testing.T) {
	bl := NewMemoryBlacklist()
	now := time.Now()
	if err := bl.Add(t.Context(), "gone", now.Add(-time.Minute), now.Add(-time.Minute)); err != nil {
		t.Fatal(err)
	}
	if err := bl.Add(t.Context(), "stay", now.Add(time.Hour), now.Add(-time.Second)); err != nil {
		t.Fatal(err)
	}
	if err := bl.Sweep(t.Context(), now); err != nil {
		t.Fatal(err)
	}
	gone, err := bl.IsBlacklisted(t.Context(), "gone")
	if err != nil || gone {
		t.Fatalf("swept row still present: %t %v", gone, err)
	}
	stay, err := bl.IsBlacklisted(t.Context(), "stay")
	if err != nil || !stay {
		t.Fatalf("live row = %t %v", stay, err)
	}
}

func TestPostgresBlacklistRejectsUnsafeTable(t *testing.T) {
	bl := NewPostgresBlacklist(nil, "user_jwt;drop")
	if err := bl.Add(t.Context(), "j", time.Now(), time.Now()); err == nil {
		t.Fatal("want identifier error")
	}
}