Initial commit.

internal/authproxy/crypto_test.go

@@ -0,0 +1,57 @@
+package authproxy
+
+import (
+	"encoding/base64"
+	"strings"
+	"testing"
+)
+
+func TestBoxRoundtrip(t *testing.T) {
+	b, err := newBox(strings.Repeat("s", 32))
+	if err != nil {
+		t.Fatal(err)
+	}
+	in := stateClaims{Host: "app.example.com", RD: "/x?a=1&b=2", Proto: "https", Nonce: "n", Exp: 123}
+	tok, err := b.seal("state", in)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var out stateClaims
+	if err := b.open("state", tok, &out); err != nil {
+		t.Fatal(err)
+	}
+	if out != in {
+		t.Fatalf("roundtrip mismatch: %+v != %+v", out, in)
+	}
+}
+
+func TestBoxRejectsWrongPurpose(t *testing.T) {
+	b, _ := newBox(strings.Repeat("s", 32))
+	tok, _ := b.seal("state", stateClaims{Host: "a"})
+	var out stateClaims
+	if err := b.open("session", tok, &out); err == nil {
+		t.Fatal("expected purpose mismatch to fail")
+	}
+}
+
+func TestBoxRejectsTampering(t *testing.T) {
+	b, _ := newBox(strings.Repeat("s", 32))
+	tok, _ := b.seal("state", stateClaims{Host: "a"})
+	raw, _ := base64.RawURLEncoding.DecodeString(tok)
+	raw[len(raw)-1] ^= 0x01
+	tampered := base64.RawURLEncoding.EncodeToString(raw)
+	var out stateClaims
+	if err := b.open("state", tampered, &out); err == nil {
+		t.Fatal("expected tampered token to fail")
+	}
+}
+
+func TestBoxRejectsWrongKey(t *testing.T) {
+	b1, _ := newBox(strings.Repeat("a", 32))
+	b2, _ := newBox(strings.Repeat("b", 32))
+	tok, _ := b1.seal("state", stateClaims{Host: "a"})
+	var out stateClaims
+	if err := b2.open("state", tok, &out); err == nil {
+		t.Fatal("expected wrong key to fail")
+	}
+}