Stop retrying a PKCS#11 PIN the token rejected

client/internal/certproof/pinlatch_test.go

@@ -0,0 +1,29 @@
+package certproof
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestRejectedPINKey_ScopesToModuleTokenAndPIN(t *testing.T) {
+	base := rejectedPINKey("/lib/a.so", "netbird", []byte("1234"))
+
+	assert.Equal(t, base, rejectedPINKey("/lib/a.so", "netbird", []byte("1234")), "the same PIN on the same token is the same key")
+	assert.NotEqual(t, base, rejectedPINKey("/lib/a.so", "netbird", []byte("4321")), "a corrected PIN must be tried")
+	assert.NotEqual(t, base, rejectedPINKey("/lib/a.so", "piv", []byte("1234")), "a PIN rejected by one token is still tried on another")
+	assert.NotEqual(t, base, rejectedPINKey("/lib/b.so", "netbird", []byte("1234")), "a PIN rejected through one module is still tried through another")
+	assert.NotEqual(t, rejectedPINKey("ab", "", []byte("1")), rejectedPINKey("a", "b", []byte("1")),
+		"field boundaries are part of the key, so shifted fields do not collide")
+}
+
+func TestPINLatch_RemembersRejectedKeys(t *testing.T) {
+	latch := &pinLatch{keys: map[[32]byte]struct{}{}}
+	rejected := rejectedPINKey("/lib/a.so", "netbird", []byte("0000"))
+	other := rejectedPINKey("/lib/a.so", "netbird", []byte("1234"))
+
+	assert.False(t, latch.has(rejected), "nothing is rejected before a login fails")
+	latch.add(rejected)
+	assert.True(t, latch.has(rejected), "a rejected PIN is not tried again")
+	assert.False(t, latch.has(other), "other PINs are unaffected")
+}