Ilia Denisov
564 lines
15 KiB
Go
564 lines
15 KiB
Go
package challengestore
|
|
|
|
import (
|
|
"context"
|
|
"crypto/ed25519"
|
|
"encoding/json"
|
|
"testing"
|
|
"time"
|
|
|
|
"galaxy/authsession/internal/adapters/contracttest"
|
|
"galaxy/authsession/internal/domain/challenge"
|
|
"galaxy/authsession/internal/domain/common"
|
|
"galaxy/authsession/internal/ports"
|
|
|
|
"github.com/alicebob/miniredis/v2"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestStoreContract(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
contracttest.RunChallengeStoreContractTests(t, func(t *testing.T) ports.ChallengeStore {
|
|
t.Helper()
|
|
|
|
server := miniredis.RunT(t)
|
|
return newTestStore(t, server, Config{})
|
|
})
|
|
}
|
|
|
|
func TestNew(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
server := miniredis.RunT(t)
|
|
|
|
tests := []struct {
|
|
name string
|
|
cfg Config
|
|
wantErr string
|
|
}{
|
|
{
|
|
name: "valid config",
|
|
cfg: Config{
|
|
Addr: server.Addr(),
|
|
DB: 2,
|
|
KeyPrefix: "authsession:challenge:",
|
|
OperationTimeout: 250 * time.Millisecond,
|
|
},
|
|
},
|
|
{
|
|
name: "empty addr",
|
|
cfg: Config{
|
|
KeyPrefix: "authsession:challenge:",
|
|
OperationTimeout: 250 * time.Millisecond,
|
|
},
|
|
wantErr: "redis addr must not be empty",
|
|
},
|
|
{
|
|
name: "negative db",
|
|
cfg: Config{
|
|
Addr: server.Addr(),
|
|
DB: -1,
|
|
KeyPrefix: "authsession:challenge:",
|
|
OperationTimeout: 250 * time.Millisecond,
|
|
},
|
|
wantErr: "redis db must not be negative",
|
|
},
|
|
{
|
|
name: "empty key prefix",
|
|
cfg: Config{
|
|
Addr: server.Addr(),
|
|
OperationTimeout: 250 * time.Millisecond,
|
|
},
|
|
wantErr: "redis key prefix must not be empty",
|
|
},
|
|
{
|
|
name: "non-positive operation timeout",
|
|
cfg: Config{
|
|
Addr: server.Addr(),
|
|
KeyPrefix: "authsession:challenge:",
|
|
},
|
|
wantErr: "operation timeout must be positive",
|
|
},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
tt := tt
|
|
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
store, err := New(tt.cfg)
|
|
if tt.wantErr != "" {
|
|
require.Error(t, err)
|
|
assert.ErrorContains(t, err, tt.wantErr)
|
|
return
|
|
}
|
|
|
|
require.NoError(t, err)
|
|
t.Cleanup(func() {
|
|
assert.NoError(t, store.Close())
|
|
})
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestStorePing(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
server := miniredis.RunT(t)
|
|
store := newTestStore(t, server, Config{})
|
|
|
|
require.NoError(t, store.Ping(context.Background()))
|
|
}
|
|
|
|
func TestStoreCreateAndGet(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
server := miniredis.RunT(t)
|
|
store := newTestStore(t, server, Config{})
|
|
now := time.Unix(1_775_130_000, 0).UTC()
|
|
|
|
record := testChallenge(now)
|
|
|
|
require.NoError(t, store.Create(context.Background(), record))
|
|
|
|
got, err := store.Get(context.Background(), record.ID)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, record, got)
|
|
|
|
got.CodeHash[0] = 0xFF
|
|
keyBytes := got.Confirmation.ClientPublicKey.PublicKey()
|
|
keyBytes[0] = 0xFE
|
|
|
|
again, err := store.Get(context.Background(), record.ID)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, record.CodeHash, again.CodeHash)
|
|
require.NotNil(t, again.Confirmation)
|
|
assert.Equal(t, record.Confirmation.ClientPublicKey.String(), again.Confirmation.ClientPublicKey.String())
|
|
}
|
|
|
|
func TestStoreCreateAndGetPendingChallenge(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
server := miniredis.RunT(t)
|
|
store := newTestStore(t, server, Config{})
|
|
now := time.Unix(1_775_130_100, 0).UTC()
|
|
|
|
record := testPendingChallenge(now)
|
|
|
|
require.NoError(t, store.Create(context.Background(), record))
|
|
|
|
got, err := store.Get(context.Background(), record.ID)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, record, got)
|
|
}
|
|
|
|
func TestStoreCreateAndGetThrottledChallenge(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
server := miniredis.RunT(t)
|
|
store := newTestStore(t, server, Config{})
|
|
now := time.Unix(1_775_130_150, 0).UTC()
|
|
|
|
record := testPendingChallenge(now)
|
|
record.Status = challenge.StatusDeliveryThrottled
|
|
record.DeliveryState = challenge.DeliveryThrottled
|
|
record.Attempts.Send = 1
|
|
record.Abuse.LastAttemptAt = timePointer(now)
|
|
require.NoError(t, record.Validate())
|
|
|
|
require.NoError(t, store.Create(context.Background(), record))
|
|
|
|
got, err := store.Get(context.Background(), record.ID)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, record, got)
|
|
}
|
|
|
|
func TestStoreGetStrictDecode(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
now := time.Unix(1_775_130_200, 0).UTC()
|
|
baseRecord := testChallenge(now)
|
|
baseStored, err := redisRecordFromChallenge(baseRecord)
|
|
require.NoError(t, err)
|
|
|
|
tests := []struct {
|
|
name string
|
|
mutate func(redisRecord) string
|
|
wantErrText string
|
|
}{
|
|
{
|
|
name: "malformed json",
|
|
mutate: func(_ redisRecord) string {
|
|
return "{"
|
|
},
|
|
wantErrText: "decode redis challenge record",
|
|
},
|
|
{
|
|
name: "trailing json input",
|
|
mutate: func(record redisRecord) string {
|
|
return mustMarshalJSON(t, record) + "{}"
|
|
},
|
|
wantErrText: "unexpected trailing JSON input",
|
|
},
|
|
{
|
|
name: "unknown field",
|
|
mutate: func(record redisRecord) string {
|
|
payload := map[string]any{
|
|
"challenge_id": record.ChallengeID,
|
|
"email": record.Email,
|
|
"code_hash_base64": record.CodeHashBase64,
|
|
"status": record.Status,
|
|
"delivery_state": record.DeliveryState,
|
|
"created_at": record.CreatedAt,
|
|
"expires_at": record.ExpiresAt,
|
|
"send_attempt_count": record.SendAttemptCount,
|
|
"confirm_attempt_count": record.ConfirmAttemptCount,
|
|
"last_attempt_at": record.LastAttemptAt,
|
|
"confirmed_session_id": record.ConfirmedSessionID,
|
|
"confirmed_client_public_key": record.ConfirmedClientPublicKey,
|
|
"confirmed_at": record.ConfirmedAt,
|
|
"unexpected": true,
|
|
}
|
|
return mustMarshalJSON(t, payload)
|
|
},
|
|
wantErrText: "unknown field",
|
|
},
|
|
{
|
|
name: "unsupported status",
|
|
mutate: func(record redisRecord) string {
|
|
record.Status = challenge.Status("paused")
|
|
return mustMarshalJSON(t, record)
|
|
},
|
|
wantErrText: `status "paused" is unsupported`,
|
|
},
|
|
{
|
|
name: "unsupported delivery state",
|
|
mutate: func(record redisRecord) string {
|
|
record.DeliveryState = challenge.DeliveryState("queued")
|
|
return mustMarshalJSON(t, record)
|
|
},
|
|
wantErrText: `delivery state "queued" is unsupported`,
|
|
},
|
|
{
|
|
name: "missing required email",
|
|
mutate: func(record redisRecord) string {
|
|
record.Email = ""
|
|
return mustMarshalJSON(t, record)
|
|
},
|
|
wantErrText: "challenge email",
|
|
},
|
|
{
|
|
name: "challenge id mismatch",
|
|
mutate: func(record redisRecord) string {
|
|
record.ChallengeID = "other-challenge"
|
|
return mustMarshalJSON(t, record)
|
|
},
|
|
wantErrText: `does not match requested`,
|
|
},
|
|
{
|
|
name: "non canonical utc timestamp",
|
|
mutate: func(record redisRecord) string {
|
|
record.CreatedAt = "2026-04-04T12:00:00+03:00"
|
|
return mustMarshalJSON(t, record)
|
|
},
|
|
wantErrText: "canonical UTC RFC3339Nano timestamp",
|
|
},
|
|
{
|
|
name: "partial confirmation metadata",
|
|
mutate: func(record redisRecord) string {
|
|
record.ConfirmedAt = nil
|
|
return mustMarshalJSON(t, record)
|
|
},
|
|
wantErrText: "confirmation metadata must be either fully present or fully absent",
|
|
},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
tt := tt
|
|
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
server := miniredis.RunT(t)
|
|
store := newTestStore(t, server, Config{})
|
|
server.Set(store.lookupKey(baseRecord.ID), tt.mutate(baseStored))
|
|
|
|
_, err := store.Get(context.Background(), baseRecord.ID)
|
|
require.Error(t, err)
|
|
assert.ErrorContains(t, err, tt.wantErrText)
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestStoreKeySchemeAndTTL(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
server := miniredis.RunT(t)
|
|
store := newTestStore(t, server, Config{KeyPrefix: "authsession:challenge:"})
|
|
now := time.Now().UTC()
|
|
|
|
prefixed := testPendingChallenge(now)
|
|
prefixed.ID = common.ChallengeID("challenge:opaque/id?value")
|
|
require.NoError(t, store.Create(context.Background(), prefixed))
|
|
|
|
key := store.lookupKey(prefixed.ID)
|
|
assert.Equal(t, "authsession:challenge:"+encodeKeyComponent(prefixed.ID.String()), key)
|
|
assert.True(t, server.Exists(key))
|
|
|
|
freshTTL := server.TTL(key)
|
|
assert.LessOrEqual(t, freshTTL, challenge.InitialTTL+expirationGracePeriod)
|
|
assert.GreaterOrEqual(t, freshTTL, challenge.InitialTTL+expirationGracePeriod-2*time.Second)
|
|
|
|
expired := testPendingChallenge(now.Add(-10 * time.Minute))
|
|
expired.ID = common.ChallengeID("expired-challenge")
|
|
expired.CreatedAt = now.Add(-20 * time.Minute)
|
|
expired.ExpiresAt = now.Add(-1 * time.Minute)
|
|
require.NoError(t, store.Create(context.Background(), expired))
|
|
|
|
expiredTTL := server.TTL(store.lookupKey(expired.ID))
|
|
assert.LessOrEqual(t, expiredTTL, expirationGracePeriod)
|
|
assert.GreaterOrEqual(t, expiredTTL, expirationGracePeriod-2*time.Second)
|
|
}
|
|
|
|
func TestStoreCreateConflict(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
server := miniredis.RunT(t)
|
|
store := newTestStore(t, server, Config{})
|
|
record := testPendingChallenge(time.Unix(1_775_130_300, 0).UTC())
|
|
|
|
require.NoError(t, store.Create(context.Background(), record))
|
|
|
|
err := store.Create(context.Background(), record)
|
|
require.Error(t, err)
|
|
assert.ErrorIs(t, err, ports.ErrConflict)
|
|
}
|
|
|
|
func TestStoreGetNotFound(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
server := miniredis.RunT(t)
|
|
store := newTestStore(t, server, Config{})
|
|
|
|
_, err := store.Get(context.Background(), common.ChallengeID("missing-challenge"))
|
|
require.Error(t, err)
|
|
assert.ErrorIs(t, err, ports.ErrNotFound)
|
|
}
|
|
|
|
func TestStoreCompareAndSwap(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
now := time.Unix(1_775_130_400, 0).UTC()
|
|
|
|
t.Run("success", func(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
server := miniredis.RunT(t)
|
|
store := newTestStore(t, server, Config{})
|
|
previous := testPendingChallenge(now)
|
|
next := previous
|
|
next.Status = challenge.StatusSent
|
|
next.DeliveryState = challenge.DeliverySent
|
|
next.Attempts.Send = 1
|
|
next.Abuse.LastAttemptAt = timePointer(now.Add(1 * time.Minute))
|
|
|
|
require.NoError(t, store.Create(context.Background(), previous))
|
|
require.NoError(t, store.CompareAndSwap(context.Background(), previous, next))
|
|
|
|
got, err := store.Get(context.Background(), previous.ID)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, next, got)
|
|
})
|
|
|
|
t.Run("conflict when stored record differs", func(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
server := miniredis.RunT(t)
|
|
store := newTestStore(t, server, Config{})
|
|
stored := testPendingChallenge(now)
|
|
previous := stored
|
|
previous.Attempts.Send = 99
|
|
next := stored
|
|
next.Status = challenge.StatusSent
|
|
next.DeliveryState = challenge.DeliverySent
|
|
|
|
require.NoError(t, store.Create(context.Background(), stored))
|
|
|
|
err := store.CompareAndSwap(context.Background(), previous, next)
|
|
require.Error(t, err)
|
|
assert.ErrorIs(t, err, ports.ErrConflict)
|
|
})
|
|
|
|
t.Run("not found", func(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
server := miniredis.RunT(t)
|
|
store := newTestStore(t, server, Config{})
|
|
previous := testPendingChallenge(now)
|
|
next := previous
|
|
next.Status = challenge.StatusSent
|
|
next.DeliveryState = challenge.DeliverySent
|
|
|
|
err := store.CompareAndSwap(context.Background(), previous, next)
|
|
require.Error(t, err)
|
|
assert.ErrorIs(t, err, ports.ErrNotFound)
|
|
})
|
|
|
|
t.Run("corrupt stored record returns adapter error", func(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
server := miniredis.RunT(t)
|
|
store := newTestStore(t, server, Config{})
|
|
previous := testPendingChallenge(now)
|
|
next := previous
|
|
next.Status = challenge.StatusSent
|
|
next.DeliveryState = challenge.DeliverySent
|
|
|
|
server.Set(store.lookupKey(previous.ID), "{")
|
|
|
|
err := store.CompareAndSwap(context.Background(), previous, next)
|
|
require.Error(t, err)
|
|
assert.NotErrorIs(t, err, ports.ErrConflict)
|
|
assert.ErrorContains(t, err, "decode redis challenge record")
|
|
})
|
|
}
|
|
|
|
func newTestStore(t *testing.T, server *miniredis.Miniredis, cfg Config) *Store {
|
|
t.Helper()
|
|
|
|
if cfg.Addr == "" {
|
|
cfg.Addr = server.Addr()
|
|
}
|
|
if cfg.KeyPrefix == "" {
|
|
cfg.KeyPrefix = "authsession:challenge:"
|
|
}
|
|
if cfg.OperationTimeout == 0 {
|
|
cfg.OperationTimeout = 250 * time.Millisecond
|
|
}
|
|
|
|
store, err := New(cfg)
|
|
require.NoError(t, err)
|
|
|
|
t.Cleanup(func() {
|
|
assert.NoError(t, store.Close())
|
|
})
|
|
|
|
return store
|
|
}
|
|
|
|
func testPendingChallenge(now time.Time) challenge.Challenge {
|
|
return challenge.Challenge{
|
|
ID: common.ChallengeID("challenge-pending"),
|
|
Email: common.Email("pilot@example.com"),
|
|
CodeHash: []byte("hashed-pending-code"),
|
|
PreferredLanguage: "en",
|
|
Status: challenge.StatusPendingSend,
|
|
DeliveryState: challenge.DeliveryPending,
|
|
CreatedAt: now,
|
|
ExpiresAt: now.Add(challenge.InitialTTL),
|
|
}
|
|
}
|
|
|
|
func testChallenge(now time.Time) challenge.Challenge {
|
|
clientPublicKey, err := common.NewClientPublicKey(ed25519.PublicKey{
|
|
0, 1, 2, 3, 4, 5, 6, 7,
|
|
8, 9, 10, 11, 12, 13, 14, 15,
|
|
16, 17, 18, 19, 20, 21, 22, 23,
|
|
24, 25, 26, 27, 28, 29, 30, 31,
|
|
})
|
|
if err != nil {
|
|
panic(err)
|
|
}
|
|
|
|
return challenge.Challenge{
|
|
ID: common.ChallengeID("challenge-confirmed"),
|
|
Email: common.Email("pilot@example.com"),
|
|
CodeHash: []byte("hashed-code"),
|
|
PreferredLanguage: "en",
|
|
Status: challenge.StatusConfirmedPendingExpire,
|
|
DeliveryState: challenge.DeliverySent,
|
|
CreatedAt: now,
|
|
ExpiresAt: now.Add(challenge.ConfirmedRetention),
|
|
Attempts: challenge.AttemptCounters{
|
|
Send: 1,
|
|
Confirm: 2,
|
|
},
|
|
Abuse: challenge.AbuseMetadata{
|
|
LastAttemptAt: timePointer(now.Add(30 * time.Second)),
|
|
},
|
|
Confirmation: &challenge.Confirmation{
|
|
SessionID: common.DeviceSessionID("device-session-1"),
|
|
ClientPublicKey: clientPublicKey,
|
|
ConfirmedAt: now.Add(1 * time.Minute),
|
|
},
|
|
}
|
|
}
|
|
|
|
func TestStoreGetDefaultsMissingPreferredLanguageToEnglish(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
server := miniredis.RunT(t)
|
|
store := newTestStore(t, server, Config{})
|
|
now := time.Unix(1_775_130_250, 0).UTC()
|
|
|
|
record := testPendingChallenge(now)
|
|
stored, err := redisRecordFromChallenge(record)
|
|
require.NoError(t, err)
|
|
stored.PreferredLanguage = ""
|
|
|
|
payload := mustMarshalJSON(t, map[string]any{
|
|
"challenge_id": stored.ChallengeID,
|
|
"email": stored.Email,
|
|
"code_hash_base64": stored.CodeHashBase64,
|
|
"status": stored.Status,
|
|
"delivery_state": stored.DeliveryState,
|
|
"created_at": stored.CreatedAt,
|
|
"expires_at": stored.ExpiresAt,
|
|
"send_attempt_count": stored.SendAttemptCount,
|
|
"confirm_attempt_count": stored.ConfirmAttemptCount,
|
|
})
|
|
server.Set(store.lookupKey(record.ID), payload)
|
|
|
|
got, err := store.Get(context.Background(), record.ID)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, "en", got.PreferredLanguage)
|
|
}
|
|
|
|
func timePointer(value time.Time) *time.Time {
|
|
return &value
|
|
}
|
|
|
|
func mustMarshalJSON(t *testing.T, value any) string {
|
|
t.Helper()
|
|
|
|
payload, err := json.Marshal(value)
|
|
require.NoError(t, err)
|
|
|
|
return string(payload)
|
|
}
|
|
|
|
func TestStorePingNilContext(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
server := miniredis.RunT(t)
|
|
store := newTestStore(t, server, Config{})
|
|
|
|
err := store.Ping(nil)
|
|
require.Error(t, err)
|
|
assert.ErrorContains(t, err, "nil context")
|
|
}
|
|
|
|
func TestStoreGetNilContext(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
server := miniredis.RunT(t)
|
|
store := newTestStore(t, server, Config{})
|
|
|
|
_, err := store.Get(nil, common.ChallengeID("challenge"))
|
|
require.Error(t, err)
|
|
assert.ErrorContains(t, err, "nil context")
|
|
}
|