Push-Zeitmail: signierter Token für Zeit-Links

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test/pushTimeToken.test.js

@@ -0,0 +1,45 @@
+import { test, before } from 'node:test'
+import assert from 'node:assert/strict'
+import { createHmac } from 'node:crypto'
+
+let createPushTimeToken
+let verifyPushTimeToken
+
+before(async () => {
+  process.env.PUSH_TIME_SECRET = 'x'.repeat(40)
+  // config.js liest die Umgebung beim Import
+  ;({ createPushTimeToken, verifyPushTimeToken } = await import('../server/services/pushTimeToken.js'))
+})
+
+const DAY = 86400 * 1000
+const b64 = (value) => Buffer.from(value).toString('base64url')
+
+test('Token rundet sauber', () => {
+  const token = createPushTimeToken({ worksheetId: 'ws1', employeeId: 'e1' })
+  assert.deepEqual(verifyPushTimeToken(token), { worksheetId: 'ws1', employeeId: 'e1' })
+})
+
+test('nach 14 Tagen abgelaufen', () => {
+  const token = createPushTimeToken({ worksheetId: 'ws1', employeeId: 'e1' }, 0)
+  assert.deepEqual(verifyPushTimeToken(token, 14 * DAY + 1000), { error: 'expired' })
+  assert.deepEqual(verifyPushTimeToken(token, 14 * DAY - 1000), { worksheetId: 'ws1', employeeId: 'e1' })
+})
+
+test('manipulierte Nutzlast oder Signatur', () => {
+  const token = createPushTimeToken({ worksheetId: 'ws1', employeeId: 'e1' })
+  const [payload, sig] = token.split('.')
+  const data = JSON.parse(Buffer.from(payload, 'base64url').toString())
+  const forged = `${b64(JSON.stringify({ ...data, w: 'ws2' }))}.${sig}`
+  assert.deepEqual(verifyPushTimeToken(forged), { error: 'invalid' })
+  const lastChar = sig.at(-1) === 'A' ? 'B' : 'A'
+  assert.deepEqual(verifyPushTimeToken(`${payload}.${sig.slice(0, -1)}${lastChar}`), { error: 'invalid' })
+  for (const bad of ['', 'abc', 'a.b.c', undefined, null]) {
+    assert.deepEqual(verifyPushTimeToken(bad), { error: 'invalid' })
+  }
+})
+
+test('anderes Secret', () => {
+  const payload = b64(JSON.stringify({ w: 'ws1', e: 'e1', x: Math.floor(Date.now() / 1000) + 3600 }))
+  const sig = createHmac('sha256', 'y'.repeat(40)).update(payload).digest('base64url')
+  assert.deepEqual(verifyPushTimeToken(`${payload}.${sig}`), { error: 'invalid' })
+})