115 lines
5.0 KiB
Erlang
115 lines
5.0 KiB
Erlang
-module(logic_auth_session_tests).
|
|
-include_lib("eunit/include/eunit.hrl").
|
|
-include("records.hrl").
|
|
|
|
-define(ADMIN_JWT_SECRET, <<"test-admin-secret-key-32-b">>).
|
|
-define(USER_JWT_SECRET, <<"test-user-secret-key-32-by">>).
|
|
|
|
setup() ->
|
|
ok = meck:new(core_admin, [non_strict]),
|
|
ok = meck:new(core_user, [non_strict]),
|
|
mnesia:start(),
|
|
catch ets:new(eventhub_counters, [named_table, public, set, {write_concurrency, true}]),
|
|
mnesia:create_table(auth_session, [
|
|
{attributes, record_info(fields, auth_session)},
|
|
{ram_copies, [node()]}
|
|
]),
|
|
mnesia:add_table_index(auth_session, #auth_session.family_id),
|
|
mnesia:add_table_index(auth_session, #auth_session.subject_id),
|
|
application:set_env(eventhub, admin_jwt_secret, ?ADMIN_JWT_SECRET),
|
|
application:set_env(eventhub, jwt_secret, ?USER_JWT_SECRET),
|
|
{ok, _} = application:ensure_all_started(jose),
|
|
ok.
|
|
|
|
cleanup(_) ->
|
|
application:unset_env(eventhub, admin_jwt_secret),
|
|
application:unset_env(eventhub, jwt_secret),
|
|
application:stop(jose),
|
|
meck:unload(core_admin),
|
|
meck:unload(core_user),
|
|
catch mnesia:delete_table(auth_session),
|
|
catch ets:delete(eventhub_counters),
|
|
mnesia:stop(),
|
|
ok.
|
|
|
|
logic_auth_session_test_() ->
|
|
{foreach, fun setup/0, fun cleanup/1, [
|
|
{"Issue and refresh admin tokens", fun test_issue_and_refresh_admin/0},
|
|
{"Refresh admin reuse revokes family", fun test_admin_reuse_revokes/0},
|
|
{"Issue and refresh user tokens", fun test_issue_and_refresh_user/0},
|
|
{"Refresh user reuse revokes family", fun test_user_reuse_revokes/0}
|
|
]}.
|
|
|
|
test_issue_and_refresh_admin() ->
|
|
AdminId = <<"adm1">>,
|
|
Admin = #admin{
|
|
id = AdminId, email = <<"a@test.com">>, role = superadmin,
|
|
password_hash = <<>>, status = active, nickname = <<>>,
|
|
avatar_url = default, timezone = <<"UTC">>, language = <<"ru">>,
|
|
phone = <<>>, preferences = #{}, last_login = undefined,
|
|
created_at = undefined, updated_at = undefined
|
|
},
|
|
ok = meck:expect(core_admin, get_by_id, fun(Id) ->
|
|
?assertEqual(AdminId, Id), {ok, Admin}
|
|
end),
|
|
{ok, Access1, Refresh1} = logic_auth_session:issue_admin_tokens(AdminId, <<"superadmin">>),
|
|
?assert(is_binary(Access1)),
|
|
{ok, _, _} = eventhub_auth:verify_admin_token(Access1),
|
|
{ok, Access2, Refresh2} = logic_auth_session:refresh_admin(Refresh1),
|
|
?assert(is_binary(Access2)),
|
|
?assertNotEqual(Refresh1, Refresh2),
|
|
{ok, _, _} = eventhub_auth:verify_admin_token(Access2).
|
|
|
|
test_admin_reuse_revokes() ->
|
|
AdminId = <<"adm1">>,
|
|
Admin = #admin{
|
|
id = AdminId, email = <<"a@test.com">>, role = admin,
|
|
password_hash = <<>>, status = active, nickname = <<>>,
|
|
avatar_url = default, timezone = <<"UTC">>, language = <<"ru">>,
|
|
phone = <<>>, preferences = #{}, last_login = undefined,
|
|
created_at = undefined, updated_at = undefined
|
|
},
|
|
ok = meck:expect(core_admin, get_by_id, fun(_) -> {ok, Admin} end),
|
|
{ok, _, Refresh1} = logic_auth_session:issue_admin_tokens(AdminId, <<"admin">>),
|
|
{ok, _, Refresh2} = logic_auth_session:refresh_admin(Refresh1),
|
|
?assertMatch({error, reuse_detected}, logic_auth_session:refresh_admin(Refresh1)),
|
|
?assertMatch({error, revoked}, logic_auth_session:refresh_admin(Refresh2)).
|
|
|
|
test_issue_and_refresh_user() ->
|
|
UserId = <<"usr1">>,
|
|
User = #user{
|
|
id = UserId, email = <<"u@test.com">>, role = user,
|
|
password_hash = <<>>, status = active, nickname = <<>>,
|
|
avatar_url = default, timezone = <<"UTC">>, language = <<"ru">>,
|
|
phone = <<>>, preferences = #{}, last_login = undefined,
|
|
created_at = undefined, updated_at = undefined
|
|
},
|
|
ok = meck:expect(core_user, get_by_id, fun(Id) ->
|
|
?assertEqual(UserId, Id), {ok, User}
|
|
end),
|
|
{ok, Access1, Refresh1} = logic_auth_session:issue_user_tokens(UserId, <<"user">>),
|
|
?assert(is_binary(Access1)),
|
|
{ok, _, _} = eventhub_auth:verify_user_token(Access1),
|
|
{ok, Claims} = eventhub_auth:verify_user_refresh_token(Refresh1),
|
|
?assertEqual(<<"user">>, maps:get(<<"aud">>, Claims)),
|
|
?assertEqual(<<"web">>, maps:get(<<"client">>, Claims)),
|
|
{ok, Access2, Refresh2} = logic_auth_session:refresh_user(Refresh1),
|
|
?assert(is_binary(Access2)),
|
|
?assertNotEqual(Refresh1, Refresh2),
|
|
{ok, _, _} = eventhub_auth:verify_user_token(Access2).
|
|
|
|
test_user_reuse_revokes() ->
|
|
UserId = <<"usr1">>,
|
|
User = #user{
|
|
id = UserId, email = <<"u@test.com">>, role = user,
|
|
password_hash = <<>>, status = active, nickname = <<>>,
|
|
avatar_url = default, timezone = <<"UTC">>, language = <<"ru">>,
|
|
phone = <<>>, preferences = #{}, last_login = undefined,
|
|
created_at = undefined, updated_at = undefined
|
|
},
|
|
ok = meck:expect(core_user, get_by_id, fun(_) -> {ok, User} end),
|
|
{ok, _, Refresh1} = logic_auth_session:issue_user_tokens(UserId, <<"user">>),
|
|
{ok, _, Refresh2} = logic_auth_session:refresh_user(Refresh1),
|
|
?assertMatch({error, reuse_detected}, logic_auth_session:refresh_user(Refresh1)),
|
|
?assertMatch({error, revoked}, logic_auth_session:refresh_user(Refresh2)).
|