server läuft
This commit is contained in:
br committed
1 parent
c8df9d7651
commit
42f0c0accb
21 files changed
+4185
-10
No files matched your search
@@ -0,0 +1,239 @@
|
||||
package license
|
||||
|
||||
import (
|
||||
"crypto/ed25519"
|
||||
"crypto/rand"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"reflect"
|
||||
"strings"
|
||||
"testing"
|
||||
"time"
|
||||
)
|
||||
|
||||
func newIssuer(t *testing.T) (*Issuer, ed25519.PublicKey) {
|
||||
t.Helper()
|
||||
pub, priv, err := ed25519.GenerateKey(rand.Reader)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
return &Issuer{Key: priv}, pub
|
||||
}
|
||||
|
||||
func sample() License {
|
||||
return License{
|
||||
TenantID: "kunde_schmidt",
|
||||
Tier: TierPro,
|
||||
MaxRoutes: 10,
|
||||
AllowedDomains: []string{"*.firma.de", "shop.de"},
|
||||
Features: []Feature{FeatureWebsockets, FeatureTCPStream},
|
||||
ValidUntil: time.Date(2026, 12, 15, 0, 0, 0, 0, time.UTC),
|
||||
}
|
||||
}
|
||||
|
||||
func TestIssueAndVerify(t *testing.T) {
|
||||
iss, pub := newIssuer(t)
|
||||
l, err := iss.Issue(sample())
|
||||
if err != nil {
|
||||
t.Fatalf("Issue: %v", err)
|
||||
}
|
||||
if l.Signature == "" {
|
||||
t.Fatal("keine Signatur gesetzt")
|
||||
}
|
||||
if err := l.Verify(pub); err != nil {
|
||||
t.Errorf("Verify: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestIssue_NormalizesAndDoesNotMutateInput(t *testing.T) {
|
||||
iss, _ := newIssuer(t)
|
||||
in := sample()
|
||||
in.ValidUntil = time.Date(2026, 12, 15, 1, 30, 0, 999_000_000, time.FixedZone("CET", 3600))
|
||||
in.Signature = "alt"
|
||||
l, err := iss.Issue(in)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
want := time.Date(2026, 12, 15, 0, 30, 0, 0, time.UTC)
|
||||
if !l.ValidUntil.Equal(want) || l.ValidUntil.Location() != time.UTC {
|
||||
t.Errorf("ValidUntil = %v, erwartet %v (UTC, ganze Sekunden)", l.ValidUntil, want)
|
||||
}
|
||||
if in.Signature != "alt" || in.ValidUntil.Location() == time.UTC {
|
||||
t.Error("Eingabe wurde verändert")
|
||||
}
|
||||
}
|
||||
|
||||
// Feldnamen gemäß Spec Abschnitt 4.1.
|
||||
func TestJSONFormat(t *testing.T) {
|
||||
iss, _ := newIssuer(t)
|
||||
l, _ := iss.Issue(sample())
|
||||
b, err := json.Marshal(l)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
var m map[string]any
|
||||
json.Unmarshal(b, &m)
|
||||
for _, key := range []string{"tenant_id", "tier", "max_routes", "allowed_domains", "features", "valid_until", "signature"} {
|
||||
if _, ok := m[key]; !ok {
|
||||
t.Errorf("Feld %q fehlt in %s", key, b)
|
||||
}
|
||||
}
|
||||
if len(m) != 7 {
|
||||
t.Errorf("unerwartete Felder: %s", b)
|
||||
}
|
||||
if m["valid_until"] != "2026-12-15T00:00:00Z" {
|
||||
t.Errorf("valid_until = %v, erwartet RFC 3339", m["valid_until"])
|
||||
}
|
||||
}
|
||||
|
||||
func TestParse_RoundTrip(t *testing.T) {
|
||||
iss, pub := newIssuer(t)
|
||||
l, _ := iss.Issue(sample())
|
||||
b, _ := json.MarshalIndent(l, "", " ")
|
||||
|
||||
got, err := Parse(b, pub)
|
||||
if err != nil {
|
||||
t.Fatalf("Parse: %v", err)
|
||||
}
|
||||
if !reflect.DeepEqual(got, l) {
|
||||
t.Errorf("Round-Trip weicht ab\n got: %+v\nwant: %+v", got, l)
|
||||
}
|
||||
}
|
||||
|
||||
func TestParse_Errors(t *testing.T) {
|
||||
iss, pub := newIssuer(t)
|
||||
l, _ := iss.Issue(sample())
|
||||
good, _ := json.Marshal(l)
|
||||
otherPub, _, _ := ed25519.GenerateKey(rand.Reader)
|
||||
|
||||
if _, err := Parse(good, otherPub); !errors.Is(err, ErrInvalidSignature) {
|
||||
t.Errorf("fremder Schlüssel: erwartet ErrInvalidSignature, bekommen %v", err)
|
||||
}
|
||||
tests := map[string]string{
|
||||
"kein JSON": "lizenz",
|
||||
"unbekanntes Feld": strings.Replace(string(good), `"tier"`, `"admin":true,"tier"`, 1),
|
||||
"Signatur fehlt": strings.Replace(string(good), `"signature":"`+l.Signature+`"`, `"signature":""`, 1),
|
||||
"Pflichtfeld fehlt": strings.Replace(string(good), `"tenant_id":"kunde_schmidt",`, ``, 1),
|
||||
}
|
||||
for name, data := range tests {
|
||||
t.Run(name, func(t *testing.T) {
|
||||
_, err := Parse([]byte(data), pub)
|
||||
if !errors.Is(err, ErrInvalid) && !errors.Is(err, ErrInvalidSignature) {
|
||||
t.Errorf("erwartet ErrInvalid oder ErrInvalidSignature, bekommen %v", err)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestVerify_Tampering(t *testing.T) {
|
||||
tests := map[string]func(*License){
|
||||
"Mandant": func(l *License) { l.TenantID = "fremd" },
|
||||
"Tier": func(l *License) { l.Tier = TierEnterprise },
|
||||
"MaxRoutes": func(l *License) { l.MaxRoutes = -1 },
|
||||
"Domain ergänzt": func(l *License) { l.AllowedDomains = append(l.AllowedDomains, "bank.de") },
|
||||
"Domains vertauscht": func(l *License) { l.AllowedDomains[0], l.AllowedDomains[1] = l.AllowedDomains[1], l.AllowedDomains[0] },
|
||||
"Feature ergänzt": func(l *License) { l.Features = append(l.Features, FeatureCustomMiddleware) },
|
||||
"Ablauf +1s": func(l *License) { l.ValidUntil = l.ValidUntil.Add(time.Second) },
|
||||
"Signatur Müll": func(l *License) { l.Signature = "!!!" },
|
||||
"Signatur leer": func(l *License) { l.Signature = "" },
|
||||
}
|
||||
for name, tamper := range tests {
|
||||
t.Run(name, func(t *testing.T) {
|
||||
iss, pub := newIssuer(t)
|
||||
l, _ := iss.Issue(sample())
|
||||
l.AllowedDomains = append([]string(nil), l.AllowedDomains...)
|
||||
tamper(&l)
|
||||
if err := l.Verify(pub); !errors.Is(err, ErrInvalidSignature) {
|
||||
t.Errorf("erwartet ErrInvalidSignature, bekommen %v", err)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestIssue_Validation(t *testing.T) {
|
||||
tests := map[string]func(*License){
|
||||
"Mandant leer": func(l *License) { l.TenantID = " " },
|
||||
"unbekannter Tier": func(l *License) { l.Tier = "gold" },
|
||||
"MaxRoutes < -1": func(l *License) { l.MaxRoutes = -2 },
|
||||
"keine Domains": func(l *License) { l.AllowedDomains = nil },
|
||||
"Domain ungültig": func(l *License) { l.AllowedDomains = []string{"foo bar.de"} },
|
||||
"Wildcard allein": func(l *License) { l.AllowedDomains = []string{"*"} },
|
||||
"Wildcard auf TLD": func(l *License) { l.AllowedDomains = []string{"*.de"} },
|
||||
"Wildcard in der Mitte": func(l *License) { l.AllowedDomains = []string{"a.*.de"} },
|
||||
"unbekanntes Feature": func(l *License) { l.Features = []Feature{"teleport"} },
|
||||
"ValidUntil fehlt": func(l *License) { l.ValidUntil = time.Time{} },
|
||||
}
|
||||
for name, mutate := range tests {
|
||||
t.Run(name, func(t *testing.T) {
|
||||
iss, _ := newIssuer(t)
|
||||
in := sample()
|
||||
mutate(&in)
|
||||
if _, err := iss.Issue(in); !errors.Is(err, ErrInvalid) {
|
||||
t.Errorf("erwartet ErrInvalid, bekommen %v", err)
|
||||
}
|
||||
})
|
||||
}
|
||||
if _, err := (&Issuer{}).Issue(sample()); err == nil {
|
||||
t.Error("Issuer ohne Schlüssel: erwartet Fehler")
|
||||
}
|
||||
}
|
||||
|
||||
func TestIssue_DomainsNormalized(t *testing.T) {
|
||||
iss, _ := newIssuer(t)
|
||||
in := sample()
|
||||
in.AllowedDomains = []string{"Shop.DE.", " *.Firma.de "}
|
||||
l, err := iss.Issue(in)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if !reflect.DeepEqual(l.AllowedDomains, []string{"shop.de", "*.firma.de"}) {
|
||||
t.Errorf("AllowedDomains = %v", l.AllowedDomains)
|
||||
}
|
||||
}
|
||||
|
||||
func TestExpiry(t *testing.T) {
|
||||
l := sample() // gültig bis 2026-12-15T00:00:00Z
|
||||
tests := []struct {
|
||||
now time.Time
|
||||
expired bool
|
||||
daysLeft int
|
||||
}{
|
||||
{l.ValidUntil.AddDate(0, 0, -74), false, 74},
|
||||
{l.ValidUntil.Add(-12 * time.Hour), false, 0},
|
||||
{l.ValidUntil, true, 0},
|
||||
{l.ValidUntil.Add(time.Hour), true, -1},
|
||||
{l.ValidUntil.Add(25 * time.Hour), true, -2},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
if got := l.Expired(tt.now); got != tt.expired {
|
||||
t.Errorf("Expired(%v) = %v", tt.now, got)
|
||||
}
|
||||
if got := l.DaysLeft(tt.now); got != tt.daysLeft {
|
||||
t.Errorf("DaysLeft(%v) = %d, erwartet %d", tt.now, got, tt.daysLeft)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestAllowsRoutes(t *testing.T) {
|
||||
tests := []struct {
|
||||
max, n int
|
||||
want bool
|
||||
}{
|
||||
{-1, 0, true}, {-1, 10_000, true},
|
||||
{0, 0, true}, {0, 1, false},
|
||||
{5, 5, true}, {5, 6, false},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
l := License{MaxRoutes: tt.max}
|
||||
if got := l.AllowsRoutes(tt.n); got != tt.want {
|
||||
t.Errorf("max=%d AllowsRoutes(%d) = %v", tt.max, tt.n, got)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestHasFeature(t *testing.T) {
|
||||
l := sample()
|
||||
if !l.HasFeature(FeatureTCPStream) || l.HasFeature(FeatureCustomMiddleware) {
|
||||
t.Errorf("HasFeature falsch für %v", l.Features)
|
||||
}
|
||||
}
|
||||
Reference in new issue
Block a user