108 lines
3.4 KiB
Go
108 lines
3.4 KiB
Go
package bouncer
|
|
|
|
import (
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/golang-jwt/jwt/v5"
|
|
)
|
|
|
|
func TestRefreshWithinWindow(t *testing.T) {
|
|
old := sign(t, jwt.SigningMethodHS256, jwt.MapClaims{
|
|
"sub": "42",
|
|
"iss": "https://app.test/_user/api/v1/login",
|
|
"prv": "a867434cbc213adfbe78a02bed7082a6bd99c883",
|
|
"jti": "old-jti",
|
|
"iat": time.Now().Add(-10 * time.Minute).Unix(),
|
|
"nbf": time.Now().Add(-10 * time.Minute).Unix(),
|
|
"exp": time.Now().Add(-time.Minute).Unix(),
|
|
}, []byte(secret))
|
|
next, err := Refresh(secret, old, time.Hour, NewMemoryBlacklist(), 0, "https://app.test/_user/api/v1/refresh")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
claims := decodeClaims(t, next, secret)
|
|
if claims["sub"] != "42" || claims["prv"] != "a867434cbc213adfbe78a02bed7082a6bd99c883" {
|
|
t.Fatalf("claims = %#v", claims)
|
|
}
|
|
if claims["iss"] != "https://app.test/_user/api/v1/refresh" {
|
|
t.Fatalf("iss = %v", claims["iss"])
|
|
}
|
|
if claims["jti"] == "old-jti" || claims["jti"] == "" {
|
|
t.Fatalf("jti = %v", claims["jti"])
|
|
}
|
|
iat := claimUnix(t, claims, "iat")
|
|
if time.Since(iat) > 5*time.Second {
|
|
t.Fatalf("iat not fresh: %s", iat)
|
|
}
|
|
}
|
|
|
|
func TestRefreshPastTTL(t *testing.T) {
|
|
old := sign(t, jwt.SigningMethodHS256, jwt.MapClaims{
|
|
"sub": "42",
|
|
"jti": "stale",
|
|
"iat": time.Now().Add(-2 * time.Hour).Unix(),
|
|
"exp": time.Now().Add(-time.Hour).Unix(),
|
|
}, []byte(secret))
|
|
if _, err := Refresh(secret, old, time.Hour, NewMemoryBlacklist(), 0, "https://app.test/_user/api/v1/refresh"); err == nil {
|
|
t.Fatal("want error past refresh TTL")
|
|
}
|
|
}
|
|
|
|
func TestRefreshRejectsBadSignature(t *testing.T) {
|
|
old := sign(t, jwt.SigningMethodHS256, jwt.MapClaims{
|
|
"sub": "42",
|
|
"jti": "x",
|
|
"iat": time.Now().Unix(),
|
|
"exp": time.Now().Add(time.Hour).Unix(),
|
|
}, []byte("other-secret"))
|
|
if _, err := Refresh(secret, old, time.Hour, nil, 0, "https://app.test/_user/api/v1/refresh"); err == nil {
|
|
t.Fatal("want signature error")
|
|
}
|
|
}
|
|
|
|
func TestRefreshBlacklistsOldJTI(t *testing.T) {
|
|
old := sign(t, jwt.SigningMethodHS256, jwt.MapClaims{
|
|
"sub": "42",
|
|
"jti": "rotate-me",
|
|
"iat": time.Now().Add(-time.Minute).Unix(),
|
|
"exp": time.Now().Add(-time.Second).Unix(),
|
|
}, []byte(secret))
|
|
bl := NewMemoryBlacklist()
|
|
if _, err := Refresh(secret, old, time.Hour, bl, 0, "https://app.test/_user/api/v1/refresh"); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
blocked, err := bl.IsBlacklisted(t.Context(), "rotate-me")
|
|
if err != nil || !blocked {
|
|
t.Fatalf("grace 0 blacklisted=%t err=%v", blocked, err)
|
|
}
|
|
|
|
old2 := sign(t, jwt.SigningMethodHS256, jwt.MapClaims{
|
|
"sub": "42",
|
|
"jti": "grace-me",
|
|
"iat": time.Now().Add(-time.Minute).Unix(),
|
|
"exp": time.Now().Add(-time.Second).Unix(),
|
|
}, []byte(secret))
|
|
bl2 := NewMemoryBlacklist()
|
|
if _, err := Refresh(secret, old2, time.Hour, bl2, time.Hour, "https://app.test/_user/api/v1/refresh"); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
blocked, err = bl2.IsBlacklisted(t.Context(), "grace-me")
|
|
if err != nil || blocked {
|
|
t.Fatalf("inside grace blacklisted=%t err=%v", blocked, err)
|
|
}
|
|
|
|
forever := sign(t, jwt.SigningMethodHS256, jwt.MapClaims{
|
|
"sub": "42",
|
|
"jti": "logged-out",
|
|
"iat": time.Now().Unix(),
|
|
"exp": time.Now().Add(time.Hour).Unix(),
|
|
}, []byte(secret))
|
|
if err := bl.Add(t.Context(), "logged-out", time.Now().Add(2*time.Hour), time.Now().Add(-time.Second)); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if _, err := Refresh(secret, forever, time.Hour, bl, 0, "https://app.test/_user/api/v1/refresh"); err == nil {
|
|
t.Fatal("blacklisted token must not refresh")
|
|
}
|
|
}
|