root
b16e9f0bd1
Plan 0 (workspaces): add workspaces + workspace_memberships schema, extend JWT/Actor/claims with primary_workspace_id, seed default workspace per tenant, thread workspace_id through tenant monitoring quota. Plan A (desktop skeleton): new Electron app (apps/desktop-client) with main/ preload/renderer, shared Vue component package (packages/ui-shared), and server surface — desktop client registration + token rotation + heartbeat, SSE task event stream, desktop accounts/tasks/content handlers, publish job endpoint, and supporting repositories, services, sqlc queries, and migrations. Hard cutover per plan: remove browser-extension monitoring callback endpoints, stub legacy media API in admin-web, and delete monitoring_callback_handler.go.
87 lines
2.3 KiB
Go
87 lines
2.3 KiB
Go
package auth
|
|
|
|
import (
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestIssueAndParse(t *testing.T) {
|
|
mgr := NewManager("test-secret-key", 15*time.Minute, 7*24*time.Hour)
|
|
|
|
pair, err := mgr.Issue(42, 10, 100, "tenant_admin")
|
|
require.NoError(t, err)
|
|
assert.NotEmpty(t, pair.AccessToken)
|
|
assert.NotEmpty(t, pair.RefreshToken)
|
|
assert.NotEmpty(t, pair.AccessJTI)
|
|
assert.NotEmpty(t, pair.RefreshJTI)
|
|
assert.NotZero(t, pair.ExpiresAt)
|
|
|
|
claims, err := mgr.Parse(pair.AccessToken)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, int64(42), claims.UserID)
|
|
assert.Equal(t, int64(10), claims.TenantID)
|
|
assert.Equal(t, int64(100), claims.PrimaryWorkspaceID)
|
|
assert.Equal(t, "tenant_admin", claims.Role)
|
|
assert.Equal(t, "access", claims.Subject)
|
|
assert.Equal(t, pair.AccessJTI, claims.ID)
|
|
}
|
|
|
|
func TestParseRefreshToken(t *testing.T) {
|
|
mgr := NewManager("test-secret-key", 15*time.Minute, 7*24*time.Hour)
|
|
|
|
pair, err := mgr.Issue(1, 1, 10, "viewer")
|
|
require.NoError(t, err)
|
|
|
|
claims, err := mgr.Parse(pair.RefreshToken)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, "refresh", claims.Subject)
|
|
assert.Equal(t, pair.RefreshJTI, claims.ID)
|
|
}
|
|
|
|
func TestParseExpired(t *testing.T) {
|
|
mgr := NewManager("test-secret-key", -1*time.Second, -1*time.Second)
|
|
|
|
pair, err := mgr.Issue(1, 1, 10, "viewer")
|
|
require.NoError(t, err)
|
|
|
|
_, err = mgr.Parse(pair.AccessToken)
|
|
assert.Error(t, err)
|
|
}
|
|
|
|
func TestParseWrongSecret(t *testing.T) {
|
|
mgr1 := NewManager("secret-one", 15*time.Minute, 7*24*time.Hour)
|
|
mgr2 := NewManager("secret-two", 15*time.Minute, 7*24*time.Hour)
|
|
|
|
pair, err := mgr1.Issue(1, 1, 10, "viewer")
|
|
require.NoError(t, err)
|
|
|
|
_, err = mgr2.Parse(pair.AccessToken)
|
|
assert.Error(t, err)
|
|
}
|
|
|
|
func TestParseGarbage(t *testing.T) {
|
|
mgr := NewManager("test-secret-key", 15*time.Minute, 7*24*time.Hour)
|
|
|
|
_, err := mgr.Parse("not-a-real-token")
|
|
assert.Error(t, err)
|
|
}
|
|
|
|
func TestHashToken(t *testing.T) {
|
|
h1 := HashToken("some-token")
|
|
h2 := HashToken("some-token")
|
|
h3 := HashToken("different-token")
|
|
|
|
assert.Equal(t, h1, h2)
|
|
assert.NotEqual(t, h1, h3)
|
|
assert.Len(t, h1, 64) // SHA-256 hex
|
|
}
|
|
|
|
func TestAccessAndRefreshTTL(t *testing.T) {
|
|
mgr := NewManager("s", 15*time.Minute, 24*time.Hour)
|
|
assert.Equal(t, 15*time.Minute, mgr.AccessTTL())
|
|
assert.Equal(t, 24*time.Hour, mgr.RefreshTTL())
|
|
}
|