sysopsandClaude Sonnet 5
34bc8f76f9
- TOTP (RFC 6238, stdlib-only) enrollment in profile, login step-up, admin emergency reset. - Admins can grant a user visibility into individual clients (User.ClientIDs) in addition to whole-server access (User.ServerIDs). - New "My Access" page: non-admin users see only their assigned clients (view/QR/download only, no management), reachable from the main nav. - GetUser/GetUsers now redact TOTPSecret before returning JSON. No Go toolchain was available while writing this - not yet build-verified. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PvrfUytqd74H6WcQkRzFM4
86 lines
2.3 KiB
Go
86 lines
2.3 KiB
Go
package auth
|
|
|
|
import (
|
|
"testing"
|
|
"time"
|
|
)
|
|
|
|
// TestRoundTrip verifies that a code generated for a given secret/time
|
|
// validates successfully against that same secret/time. We deliberately
|
|
// don't chase the exact RFC 6238 8-digit test vector digits here since
|
|
// this implementation standardizes on 6-digit codes; self-consistency of
|
|
// generate -> validate is what matters for correctness of our HOTP/TOTP
|
|
// math and step handling.
|
|
func TestRoundTrip(t *testing.T) {
|
|
secret, err := GenerateSecret()
|
|
if err != nil {
|
|
t.Fatalf("GenerateSecret failed: %v", err)
|
|
}
|
|
|
|
// Fixed reference time so the test is deterministic (corresponds to
|
|
// RFC 6238's T=59 test instant).
|
|
refTime := time.Unix(59, 0).UTC()
|
|
|
|
code, err := GenerateCode(secret, refTime)
|
|
if err != nil {
|
|
t.Fatalf("GenerateCode failed: %v", err)
|
|
}
|
|
|
|
if len(code) != 6 {
|
|
t.Fatalf("expected 6-digit code, got %q", code)
|
|
}
|
|
|
|
if !Validate(secret, code, refTime) {
|
|
t.Fatalf("Validate failed to accept code %q generated for the same secret/time", code)
|
|
}
|
|
}
|
|
|
|
func TestWrongCodeRejected(t *testing.T) {
|
|
secret, err := GenerateSecret()
|
|
if err != nil {
|
|
t.Fatalf("GenerateSecret failed: %v", err)
|
|
}
|
|
|
|
refTime := time.Unix(59, 0).UTC()
|
|
|
|
code, err := GenerateCode(secret, refTime)
|
|
if err != nil {
|
|
t.Fatalf("GenerateCode failed: %v", err)
|
|
}
|
|
|
|
wrong := "000000"
|
|
if code == wrong {
|
|
wrong = "111111"
|
|
}
|
|
|
|
if Validate(secret, wrong, refTime) {
|
|
t.Fatalf("Validate incorrectly accepted a wrong code")
|
|
}
|
|
}
|
|
|
|
func TestClockSkewToleranceAndRejection(t *testing.T) {
|
|
secret, err := GenerateSecret()
|
|
if err != nil {
|
|
t.Fatalf("GenerateSecret failed: %v", err)
|
|
}
|
|
|
|
refTime := time.Unix(1_000_000, 0).UTC()
|
|
code, err := GenerateCode(secret, refTime)
|
|
if err != nil {
|
|
t.Fatalf("GenerateCode failed: %v", err)
|
|
}
|
|
|
|
// One step (30s) away should still validate (skew tolerance).
|
|
oneStepLater := refTime.Add(30 * time.Second)
|
|
if !Validate(secret, code, oneStepLater) {
|
|
t.Fatalf("Validate should tolerate +-1 step (30s) of clock skew")
|
|
}
|
|
|
|
// Two steps (60s, i.e. > 1 step tolerance) away should NOT validate.
|
|
// Use 120s to be unambiguous with respect to step boundaries.
|
|
farLater := refTime.Add(120 * time.Second)
|
|
if Validate(secret, code, farLater) {
|
|
t.Fatalf("Validate should reject a code more than 1 step (30s) away")
|
|
}
|
|
}
|