mlogclub
87 lines
2.4 KiB
Go
87 lines
2.4 KiB
Go
package openidentity
|
|
|
|
import (
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/golang-jwt/jwt/v5"
|
|
)
|
|
|
|
func TestVerifyUserTokenOK(t *testing.T) {
|
|
token := signTestUserToken(t, jwt.SigningMethodHS256, map[string]any{
|
|
"userId": "u_10001",
|
|
"name": "张三",
|
|
"exp": time.Now().Add(time.Hour).Unix(),
|
|
}, "secret")
|
|
|
|
claims, err := verifyUserToken(token, "secret")
|
|
if err != nil {
|
|
t.Fatalf("expected token to verify: %v", err)
|
|
}
|
|
if claims.UserID != "u_10001" || claims.Name != "张三" {
|
|
t.Fatalf("unexpected claims: %#v", claims)
|
|
}
|
|
}
|
|
|
|
func TestVerifyUserTokenUsesJWTHeaderAlgorithm(t *testing.T) {
|
|
token := signTestUserToken(t, jwt.SigningMethodHS384, map[string]any{
|
|
"userId": "u_10001",
|
|
"name": "张三",
|
|
"exp": time.Now().Add(time.Hour).Unix(),
|
|
}, "secret")
|
|
|
|
claims, err := verifyUserToken(token, "secret")
|
|
if err != nil {
|
|
t.Fatalf("expected HS384 token to verify from JWT header: %v", err)
|
|
}
|
|
if claims.UserID != "u_10001" || claims.Name != "张三" {
|
|
t.Fatalf("unexpected claims: %#v", claims)
|
|
}
|
|
}
|
|
|
|
func TestVerifyUserTokenRejectsInvalidSignature(t *testing.T) {
|
|
token := signTestUserToken(t, jwt.SigningMethodHS256, map[string]any{
|
|
"userId": "u_10001",
|
|
"name": "张三",
|
|
"exp": time.Now().Add(time.Hour).Unix(),
|
|
}, "secret")
|
|
|
|
if _, err := verifyUserToken(token, "other-secret"); err == nil {
|
|
t.Fatalf("expected invalid signature to fail")
|
|
}
|
|
}
|
|
|
|
func TestVerifyUserTokenRejectsExpiredToken(t *testing.T) {
|
|
token := signTestUserToken(t, jwt.SigningMethodHS256, map[string]any{
|
|
"userId": "u_10001",
|
|
"name": "张三",
|
|
"exp": time.Now().Add(-time.Minute).Unix(),
|
|
}, "secret")
|
|
|
|
if _, err := verifyUserToken(token, "secret"); err == nil {
|
|
t.Fatalf("expected expired token to fail")
|
|
}
|
|
}
|
|
|
|
func TestVerifyUserTokenRequiresUserIDAndName(t *testing.T) {
|
|
tests := []map[string]any{
|
|
{"name": "张三", "exp": time.Now().Add(time.Hour).Unix()},
|
|
{"userId": "u_10001", "exp": time.Now().Add(time.Hour).Unix()},
|
|
}
|
|
for _, payload := range tests {
|
|
token := signTestUserToken(t, jwt.SigningMethodHS256, payload, "secret")
|
|
if _, err := verifyUserToken(token, "secret"); err == nil {
|
|
t.Fatalf("expected payload %#v to fail", payload)
|
|
}
|
|
}
|
|
}
|
|
|
|
func signTestUserToken(t *testing.T, method jwt.SigningMethod, payload map[string]any, secret string) string {
|
|
t.Helper()
|
|
token, err := jwt.NewWithClaims(method, jwt.MapClaims(payload)).SignedString([]byte(secret))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
return token
|
|
}
|