84 lines
2.8 KiB
Go
84 lines
2.8 KiB
Go
package handler
|
|
|
|
import (
|
|
"net/http/httptest"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/DATA-DOG/go-sqlmock"
|
|
"github.com/gin-gonic/gin"
|
|
"github.com/wmms/wmms/internal/model"
|
|
"github.com/wmms/wmms/internal/service"
|
|
)
|
|
|
|
func TestLogoutRevokesOnlyCurrentSession(t *testing.T) {
|
|
mock := contextMock(t)
|
|
expectContextPrincipal(mock, "warehouse_admin")
|
|
mock.ExpectExec("INSERT INTO revoked_tokens").WithArgs(sqlmock.AnyArg(), int64(7), sqlmock.AnyArg()).WillReturnResult(sqlmock.NewResult(0, 1))
|
|
auth := service.NewAuthService()
|
|
user := &model.User{ID: 7, Username: "session-user"}
|
|
first, err := auth.GenerateToken(user)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
second, err := auth.GenerateToken(user)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
principal, err := auth.ValidateToken(first)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
tickets := service.NewWebSocketTicketService()
|
|
ticket, err := tickets.Issue(7, 2, first)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
hub := newHub(newFakeVerifier())
|
|
go hub.run()
|
|
client := testClient(hub, 7, 2)
|
|
client.sessionID = service.TokenSessionID(first)
|
|
client.sessionExpiresAt = principal.Exp
|
|
hub.register <- client
|
|
hub.BroadcastStockUpdate(2, "inbound", 1, nil)
|
|
expectMessage(t, client, time.Second)
|
|
router := gin.New()
|
|
NewHandler().RegisterRoutes(router)
|
|
request := httptest.NewRequest("POST", "/api/auth/logout", nil)
|
|
request.Header.Set("Authorization", "Bearer "+first)
|
|
recorder := httptest.NewRecorder()
|
|
router.ServeHTTP(recorder, request)
|
|
if recorder.Code != 200 {
|
|
t.Fatalf("logout: %d %s", recorder.Code, recorder.Body.String())
|
|
}
|
|
if _, err := auth.ValidateToken(first); err == nil {
|
|
t.Fatal("logged-out session still authenticates")
|
|
}
|
|
if _, err := auth.ValidateToken(second); err != nil {
|
|
t.Fatalf("other session revoked: %v", err)
|
|
}
|
|
if _, err := tickets.Consume(ticket.Ticket); err == nil {
|
|
t.Fatal("pending ticket survived logout")
|
|
}
|
|
hub.BroadcastStockUpdate(2, "inbound", 2, nil)
|
|
expectClosed(t, client, time.Second)
|
|
// A process restart reloads persisted fingerprints, retaining revocation.
|
|
mock.ExpectQuery("SELECT jti, expires_at FROM revoked_tokens").WithArgs(sqlmock.AnyArg()).WillReturnRows(sqlmock.NewRows([]string{"jti", "expires_at"}))
|
|
if err := service.LoadRevokedSessions(); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if _, err := auth.ValidateToken(first); err != nil {
|
|
t.Fatalf("restart simulation did not clear cache: %v", err)
|
|
}
|
|
mock.ExpectQuery("SELECT jti, expires_at FROM revoked_tokens").WithArgs(sqlmock.AnyArg()).WillReturnRows(sqlmock.NewRows([]string{"jti", "expires_at"}).AddRow(service.TokenSessionID(first), time.Unix(principal.Exp, 0)))
|
|
if err := service.LoadRevokedSessions(); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if _, err := auth.ValidateToken(first); err == nil {
|
|
t.Fatal("session reactivated after reload")
|
|
}
|
|
if err := mock.ExpectationsWereMet(); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|