FilesExpand file tree

main

/

integration_test.go

Copy path

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

130 lines (121 loc) · 3.61 KB

main

/

integration_test.go

Copy path

Top

File metadata and controls

• Code
• Blame

130 lines (121 loc) · 3.61 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

package fcaptcha

import (

"context"

"crypto/hmac"

"crypto/rand"

"crypto/sha256"

"encoding/base64"

"encoding/hex"

"encoding/json"

"errors"

"os"

"testing"

"time"

)

// The fake server in fcaptcha_test.go encodes what this package believes the

// verify contract is. These tests check that belief against a real server:

//

// FCAPTCHA_SECRET=<32+ random bytes> go run ./server-go # from server-go/

// FCAPTCHA_TEST_URL=http://localhost:3000 FCAPTCHA_TEST_SECRET=<same> go test .

//

// FCAPTCHA_TEST_SECRET is the signing secret, which is also the verify secret

// when FCAPTCHA_VERIFY_SECRET is unset. Holding it lets the test mint tokens

// directly instead of driving a browser through a challenge.

func integrationClient(t *testing.T) (*Client, string) {

t.Helper()

url, secret := os.Getenv("FCAPTCHA_TEST_URL"), os.Getenv("FCAPTCHA_TEST_SECRET")

if url == "" || secret == "" {

t.Skip("FCAPTCHA_TEST_URL and FCAPTCHA_TEST_SECRET not set")

}

return New(url, secret), secret

}

// mintToken builds a token the way server-go's generateToken does: HMAC-SHA256

// over the sorted-key JSON payload, then unpadded base64url of the payload

// with the signature added.

func mintToken(t *testing.T, secret string, issued time.Time) string {

t.Helper()

jti := make([]byte, 16)

rand.Read(jti)

data := map[string]any{

"site_key": "integration",

"jti": hex.EncodeToString(jti),

"timestamp": issued.Unix(),

"score": 0.125,

"ip_hash": "",

"hostname": "example.com",

"action": "login",

"cdata": "order-42",

}

payload, err := json.Marshal(data)

if err != nil {

t.Fatal(err)

}

mac := hmac.New(sha256.New, []byte(secret))

mac.Write(payload)

data["sig"] = hex.EncodeToString(mac.Sum(nil))

token, err := json.Marshal(data)

if err != nil {

t.Fatal(err)

}

return base64.RawURLEncoding.EncodeToString(token)

}

func TestIntegrationVerify(t *testing.T) {

c, secret := integrationClient(t)

ctx := context.Background()

issued := time.Now().Truncate(time.Second)

token := mintToken(t, secret, issued)

got, err := c.Verify(ctx, token, "")

if err != nil {

t.Fatal(err)

}

want := Result{

Valid: true,

Score: 0.125,

SiteKey: "integration",

Hostname: "example.com",

Action: "login",

CData: "order-42",

IssuedAt: issued.UTC(),

}

if *got != want {

t.Errorf("Verify = %+v, want %+v", *got, want)

}

again, err := c.Verify(ctx, token, "")

if err != nil {

t.Fatal(err)

}

if again.Valid || again.Reason != "token_already_used" {

t.Errorf("replayed Verify = %+v, want token_already_used", again)

}

}

func TestIntegrationRejections(t *testing.T) {

c, secret := integrationClient(t)

ctx := context.Background()

tests := []struct {

name, token, remoteIP, reason string

}{

{"forged", mintToken(t, "not-the-secret", time.Now()), "", "invalid_signature"},

{"expired", mintToken(t, secret, time.Now().Add(-10*time.Minute)), "", "expired"},

// The minted token has an empty ip_hash, which matches no address.

{"wrong IP", mintToken(t, secret, time.Now()), "203.0.113.10", "ip_mismatch"},

{"garbage", "!!!", "", "invalid_encoding"},

}

for _, tt := range tests {

t.Run(tt.name, func(t *testing.T) {

got, err := c.Verify(ctx, tt.token, tt.remoteIP)

if err != nil {

t.Fatal(err)

}

if got.Valid || got.Reason != tt.reason {

t.Errorf("Verify = %+v, want reason %q", got, tt.reason)

}

})

}

}

func TestIntegrationWrongSecret(t *testing.T) {

c, secret := integrationClient(t)

_, err := New(c.baseURL, secret+"x").Verify(context.Background(), mintToken(t, secret, time.Now()), "")

if !errors.Is(err, ErrUnauthorized) {

t.Fatalf("err = %v, want ErrUnauthorized", err)

}

}