init

internal/auth/auth_test.go

@@ -0,0 +1,39 @@
+package auth
+
+import (
+	"encoding/base64"
+	"fmt"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestPassword(t *testing.T) {
+	h, e := HashPassword("secret")
+	if e != nil || !CheckPassword(h, "secret") || CheckPassword(h, "wrong") {
+		t.Fatal("password hash check failed")
+	}
+	if !strings.HasPrefix(h, "$2") {
+		t.Fatal("new hashes must use bcrypt")
+	}
+}
+
+func TestLegacyPasswordCompatibility(t *testing.T) {
+	salt := []byte("sixteen-byte-salt")
+	password := "legacy password"
+	hash := stretch([]byte(password), salt, passwordRounds)
+	encoded := fmt.Sprintf("sha256$%d$%s$%s", passwordRounds, base64.RawStdEncoding.EncodeToString(salt), base64.RawStdEncoding.EncodeToString(hash))
+	if !CheckPassword(encoded, password) || CheckPassword(encoded, "wrong") {
+		t.Fatal("legacy hash compatibility")
+	}
+	if CheckPassword(strings.Replace(encoded, "150000", "999999999", 1), password) {
+		t.Fatal("unbounded legacy rounds")
+	}
+}
+func TestSession(t *testing.T) {
+	tok := SignSession("s", "admin", time.Now().Add(time.Hour))
+	u, ok := VerifySession("s", tok, time.Now())
+	if !ok || u != "admin" {
+		t.Fatal("session verify failed")
+	}
+}