mirror of
https://github.com/Dvorinka/Bookra.git
synced 2026-10-28 15:51:15 +00:00
Tomas DvorakandDevin
f2f7439050
- Finish Paddle-to-Stripe billing migration; drop paddle/stripe libs - Renumber migrations; add 00012 memberships+manage_token, 00013 location_type_capacity - Add tests: admin, auth, bookings customer service - Remove graphify-out artifacts and stale env files Authored By: TDvorak <[email protected]> Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
70 lines
2.0 KiB
Go
70 lines
2.0 KiB
Go
package auth
|
|
|
|
import (
|
|
"context"
|
|
"testing"
|
|
|
|
"bookra/apps/backend/internal/db"
|
|
)
|
|
|
|
func TestLocalTokensVerifyWithIssuerAndAudience(t *testing.T) {
|
|
repo := db.NewMemoryRepository()
|
|
secret := "test-secret-that-is-long-enough"
|
|
svc := NewService(repo, secret)
|
|
|
|
_, tokens, err := svc.RegisterWithPassword(context.Background(), "[email protected]", "password123", "Test User")
|
|
if err != nil {
|
|
t.Fatalf("register: %v", err)
|
|
}
|
|
|
|
verifier, err := NewVerifier("", secret)
|
|
if err != nil {
|
|
t.Fatalf("create verifier: %v", err)
|
|
}
|
|
defer verifier.Close()
|
|
|
|
claims, err := verifier.Verify(tokens.AccessToken)
|
|
if err != nil {
|
|
t.Fatalf("verify access token: %v", err)
|
|
}
|
|
if iss, _ := claims["iss"].(string); iss != tokenIssuer {
|
|
t.Fatalf("expected issuer %s, got %v", tokenIssuer, claims["iss"])
|
|
}
|
|
if sub, _ := claims["sub"].(string); sub == "" {
|
|
t.Fatal("expected non-empty sub")
|
|
}
|
|
}
|
|
|
|
func TestLocalVerifierRejectsTamperedAndWrongTypeTokens(t *testing.T) {
|
|
repo := db.NewMemoryRepository()
|
|
secret := "test-secret-that-is-long-enough"
|
|
svc := NewService(repo, secret)
|
|
|
|
_, tokens, err := svc.RegisterWithPassword(context.Background(), "[email protected]", "password123", "Test User")
|
|
if err != nil {
|
|
t.Fatalf("register: %v", err)
|
|
}
|
|
|
|
verifier, err := NewVerifier("", secret)
|
|
if err != nil {
|
|
t.Fatalf("create verifier: %v", err)
|
|
}
|
|
defer verifier.Close()
|
|
|
|
// Refresh tokens carry type=refresh and must not authenticate API calls.
|
|
if _, err := verifier.Verify(tokens.RefreshToken); err == nil {
|
|
t.Fatal("expected refresh token to be rejected as access token")
|
|
}
|
|
|
|
// Token signed with a different secret must fail.
|
|
other := NewService(repo, "different-secret")
|
|
otherUser, otherTokens, err := other.RegisterWithPassword(context.Background(), "[email protected]", "password123", "Other")
|
|
if err != nil {
|
|
t.Fatalf("register other: %v", err)
|
|
}
|
|
_ = otherUser
|
|
if _, err := verifier.Verify(otherTokens.AccessToken); err == nil {
|
|
t.Fatal("expected token signed with a different secret to be rejected")
|
|
}
|
|
}
|