| 1 | package calls |
| 2 | |
| 3 | import ( |
| 4 | "net/http" |
| 5 | "net/http/httptest" |
| 6 | "strings" |
| 7 | "testing" |
| 8 | "time" |
| 9 | ) |
| 10 | |
| 11 | func cookieApp(now time.Time) *app { |
| 12 | return &app{cfg: resolved{instanceKey: "k", Config: Config{Origin: "http://app.test"}}, store: &store{clk: newClock(func() time.Time { return now })}} |
| 13 | } |
| 14 | |
| 15 | func TestJoinCookieRoundTripsAndRejectsTampering(t *testing.T) { |
| 16 | now := time.Date(2026, 9, 8, 10, 0, 0, 0, time.UTC) |
| 17 | a := cookieApp(now) |
| 18 | rec := httptest.NewRecorder() |
| 19 | hash := strings.Repeat("ab", 32) |
| 20 | a.setJoinCookie(rec, hash) |
| 21 | ck := rec.Result().Cookies()[0] |
| 22 | req := httptest.NewRequest(http.MethodGet, "/", nil) |
| 23 | req.AddCookie(ck) |
| 24 | got, ok := a.readJoinCookie(req) |
| 25 | if !ok || got.TokenHash != hash { |
| 26 | t.Fatalf("round trip failed: %+v %v", got, ok) |
| 27 | } |
| 28 | bad := *ck |
| 29 | bad.Value = strings.Replace(bad.Value, ".", "x.", 1) |
| 30 | req2 := httptest.NewRequest(http.MethodGet, "/", nil) |
| 31 | req2.AddCookie(&bad) |
| 32 | if _, ok := a.readJoinCookie(req2); ok { |
| 33 | t.Fatal("tampered cookie accepted") |
| 34 | } |
| 35 | later := cookieApp(now.Add(pendingLife + time.Second)) |
| 36 | if _, ok := later.readJoinCookie(req); ok { |
| 37 | t.Fatal("expired cookie accepted") |
| 38 | } |
| 39 | } |
| 40 | |
amadan