| 1 | package idear |
| 2 | |
| 3 | import "testing" |
| 4 | |
| 5 | // TestNewToken_Distinct checks that two calls don't hand back the same |
| 6 | // value — the one property that matters most for a credential, and the |
| 7 | // cheapest way to catch a broken or unseeded random source. |
| 8 | func TestNewToken_Distinct(t *testing.T) { |
| 9 | a, err := newToken() |
| 10 | if err != nil { |
| 11 | t.Fatalf("newToken() error = %v", err) |
| 12 | } |
| 13 | b, err := newToken() |
| 14 | if err != nil { |
| 15 | t.Fatalf("newToken() error = %v", err) |
| 16 | } |
| 17 | if a == b { |
| 18 | t.Fatalf("newToken() returned the same value twice: %q", a) |
| 19 | } |
| 20 | } |
| 21 | |
| 22 | // TestNewToken_Shape checks the encoding: 32 bytes of crypto/rand, |
| 23 | // hex-encoded, is 64 hex characters. |
| 24 | func TestNewToken_Shape(t *testing.T) { |
| 25 | tok, err := newToken() |
| 26 | if err != nil { |
| 27 | t.Fatalf("newToken() error = %v", err) |
| 28 | } |
| 29 | if len(tok) != 64 { |
| 30 | t.Fatalf("newToken() length = %d, want 64", len(tok)) |
| 31 | } |
| 32 | for _, c := range tok { |
| 33 | if !isLowerHex(c) { |
| 34 | t.Fatalf("newToken() = %q, contains non-lowercase-hex character %q", tok, c) |
| 35 | } |
| 36 | } |
| 37 | } |
| 38 | |
| 39 | // TestHashToken_Stable checks that hashing the same token twice gives |
| 40 | // the same digest — hashToken must be a pure function of its input. |
| 41 | func TestHashToken_Stable(t *testing.T) { |
| 42 | tok, err := newToken() |
| 43 | if err != nil { |
| 44 | t.Fatalf("newToken() error = %v", err) |
| 45 | } |
| 46 | if hashToken(tok) != hashToken(tok) { |
| 47 | t.Fatalf("hashToken(%q) is not stable across calls", tok) |
| 48 | } |
| 49 | } |
| 50 | |
| 51 | // TestHashToken_Shape checks the encoding: SHA-256, hex-encoded, is 64 |
| 52 | // hex characters, lowercase. |
| 53 | func TestHashToken_Shape(t *testing.T) { |
| 54 | tok, err := newToken() |
| 55 | if err != nil { |
| 56 | t.Fatalf("newToken() error = %v", err) |
| 57 | } |
| 58 | h := hashToken(tok) |
| 59 | if len(h) != 64 { |
| 60 | t.Fatalf("hashToken(%q) length = %d, want 64", tok, len(h)) |
| 61 | } |
| 62 | for _, c := range h { |
| 63 | if !isLowerHex(c) { |
| 64 | t.Fatalf("hashToken(%q) = %q, contains non-lowercase-hex character %q", tok, h, c) |
| 65 | } |
| 66 | } |
| 67 | } |
| 68 | |
| 69 | // TestHashToken_DiffersFromInput checks that the hash is not just an |
| 70 | // echo of the token — a bug that would defeat the entire point of |
| 71 | // storing only the hash. |
| 72 | func TestHashToken_DiffersFromInput(t *testing.T) { |
| 73 | tok, err := newToken() |
| 74 | if err != nil { |
| 75 | t.Fatalf("newToken() error = %v", err) |
| 76 | } |
| 77 | if hashToken(tok) == tok { |
| 78 | t.Fatalf("hashToken(%q) == input token; hash must differ from its input", tok) |
| 79 | } |
| 80 | } |
| 81 | |
| 82 | func isLowerHex(c rune) bool { |
| 83 | return (c >= '0' && c <= '9') || (c >= 'a' && c <= 'f') |
| 84 | } |
| 85 | |
amadan