nexarch/dms/internal/moduleauth/scope_test.go

package moduleauth

import (
	"context"
	"testing"
	"time"
)

func scoped(k keyPair, extra map[string]any) string {
	now := time.Now()
	claims := map[string]any{"sub": "u", "tenant": "acme", "iat": now.Unix(), "exp": now.Add(time.Hour).Unix()}
	for a, b := range extra {
		if b == nil {
			delete(claims, a)
			continue
		}
		claims[a] = b
	}
	return k.token(claims, "EdDSA")
}

func TestScopeStrictRequiresMatchingAudienceAndIssuer(t *testing.T) {
	k := newKey(t, "k1")
	v := NewVerifier(time.Minute, "acme", staticKeys(k)).Expect("dms", "nexarch-core", true)
	ctx := context.Background()

	ok := []map[string]any{
		{"aud": "dms", "iss": "nexarch-core"},
		{"aud": []string{"archive", "dms"}, "iss": "nexarch-core"},
	}
	for i, c := range ok {
		if _, err := v.Verify(ctx, scoped(k, c)); err != nil {
			t.Errorf("gueltig[%d] abgewiesen: %v", i, err)
		}
	}

	bad := map[string]map[string]any{
		"token fuer anderes modul":         {"aud": "archive", "iss": "nexarch-core"},
		"liste ohne dms":                   {"aud": []string{"archive", "mail"}, "iss": "nexarch-core"},
		"aud fehlt (streng)":               {"iss": "nexarch-core"},
		"aud leer":                         {"aud": "", "iss": "nexarch-core"},
		"aud null":                         {"aud": nil, "iss": "nexarch-core"},
		"aud kein string/liste":            {"aud": 7, "iss": "nexarch-core"},
		"fremder aussteller":               {"aud": "dms", "iss": "andere-stelle"},
		"aussteller fehlt (streng)":        {"aud": "dms"},
		"aud gross geschrieben":            {"aud": "DMS", "iss": "nexarch-core"},
		"aud als praefix, nicht identisch": {"aud": "dms-extra", "iss": "nexarch-core"},
	}
	for name, c := range bad {
		if _, err := v.Verify(ctx, scoped(k, c)); err == nil {
			t.Errorf("%s: nicht abgewiesen", name)
		}
	}
}

func TestScopeTransitionAcceptsMissingAudienceButNeverForeignAudience(t *testing.T) {
	k := newKey(t, "k1")
	v := NewVerifier(time.Minute, "acme", staticKeys(k)).Expect("dms", "nexarch-core", false)
	ctx := context.Background()

	if _, err := v.Verify(ctx, scoped(k, nil)); err != nil {
		t.Errorf("altes token ohne aud im uebergang abgewiesen: %v", err)
	}
	if _, err := v.Verify(ctx, scoped(k, map[string]any{"aud": "archive", "iss": "nexarch-core"})); err == nil {
		t.Error("fremde aud im uebergang angenommen")
	}
	if _, err := v.Verify(ctx, scoped(k, map[string]any{"aud": "dms", "iss": "andere-stelle"})); err == nil {
		t.Error("fremder aussteller im uebergang angenommen")
	}
	if _, err := v.Verify(ctx, scoped(k, map[string]any{"aud": "dms", "iss": "nexarch-core"})); err != nil {
		t.Errorf("neues token abgewiesen: %v", err)
	}
}

func TestScopeWithoutExpectationKeepsLegacyBehaviour(t *testing.T) {
	k := newKey(t, "k1")
	v := NewVerifier(time.Minute, "acme", staticKeys(k))
	if _, err := v.Verify(context.Background(), scoped(k, map[string]any{"aud": "irgendwas"})); err != nil {
		t.Errorf("ohne Expect darf aud nicht geprueft werden: %v", err)
	}
}

func TestScopeTenantAndSignatureStillChecked(t *testing.T) {
	k, other := newKey(t, "k1"), newKey(t, "k1")
	v := NewVerifier(time.Minute, "acme", staticKeys(k)).Expect("dms", "nexarch-core", true)
	good := map[string]any{"aud": "dms", "iss": "nexarch-core"}
	if _, err := v.Verify(context.Background(), scoped(k, map[string]any{"aud": "dms", "iss": "nexarch-core", "tenant": "globex"})); err == nil {
		t.Error("fremder mandant angenommen")
	}
	if _, err := v.Verify(context.Background(), scoped(other, good)); err == nil {
		t.Error("fremde signatur angenommen")
	}
}