46 lines
2.0 KiB
JavaScript
46 lines
2.0 KiB
JavaScript
import { test, before } from 'node:test'
|
|
import assert from 'node:assert/strict'
|
|
import { createHmac } from 'node:crypto'
|
|
|
|
let createPushTimeToken
|
|
let verifyPushTimeToken
|
|
|
|
before(async () => {
|
|
process.env.PUSH_TIME_SECRET = 'x'.repeat(40)
|
|
// config.js liest die Umgebung beim Import
|
|
;({ createPushTimeToken, verifyPushTimeToken } = await import('../server/services/pushTimeToken.js'))
|
|
})
|
|
|
|
const DAY = 86400 * 1000
|
|
const b64 = (value) => Buffer.from(value).toString('base64url')
|
|
|
|
test('Token rundet sauber', () => {
|
|
const token = createPushTimeToken({ worksheetId: 'ws1', employeeId: 'e1' })
|
|
assert.deepEqual(verifyPushTimeToken(token), { worksheetId: 'ws1', employeeId: 'e1' })
|
|
})
|
|
|
|
test('nach 14 Tagen abgelaufen', () => {
|
|
const token = createPushTimeToken({ worksheetId: 'ws1', employeeId: 'e1' }, 0)
|
|
assert.deepEqual(verifyPushTimeToken(token, 14 * DAY + 1000), { error: 'expired' })
|
|
assert.deepEqual(verifyPushTimeToken(token, 14 * DAY - 1000), { worksheetId: 'ws1', employeeId: 'e1' })
|
|
})
|
|
|
|
test('manipulierte Nutzlast oder Signatur', () => {
|
|
const token = createPushTimeToken({ worksheetId: 'ws1', employeeId: 'e1' })
|
|
const [payload, sig] = token.split('.')
|
|
const data = JSON.parse(Buffer.from(payload, 'base64url').toString())
|
|
const forged = `${b64(JSON.stringify({ ...data, w: 'ws2' }))}.${sig}`
|
|
assert.deepEqual(verifyPushTimeToken(forged), { error: 'invalid' })
|
|
const lastChar = sig.at(-1) === 'A' ? 'B' : 'A'
|
|
assert.deepEqual(verifyPushTimeToken(`${payload}.${sig.slice(0, -1)}${lastChar}`), { error: 'invalid' })
|
|
for (const bad of ['', 'abc', 'a.b.c', undefined, null]) {
|
|
assert.deepEqual(verifyPushTimeToken(bad), { error: 'invalid' })
|
|
}
|
|
})
|
|
|
|
test('anderes Secret', () => {
|
|
const payload = b64(JSON.stringify({ w: 'ws1', e: 'e1', x: Math.floor(Date.now() / 1000) + 3600 }))
|
|
const sig = createHmac('sha256', 'y'.repeat(40)).update(payload).digest('base64url')
|
|
assert.deepEqual(verifyPushTimeToken(`${payload}.${sig}`), { error: 'invalid' })
|
|
})
|