8936: update go tests to use a blob-signature-ttl different than 1s.

[arvados.git] / services / keepstore / perms_test.go

diff --git a/services/keepstore/perms_test.go b/services/keepstore/perms_test.go
index 9b4e30abe3db2de2caae82e2e13ee59dcbcbb148..43717b23720d8c71b32c126810f8e39dd41a0429 100644 (file)
--- a/services/keepstore/perms_test.go
+++ b/services/keepstore/perms_test.go
@@ -17,110 +17,51 @@ const (
                "gokee3eamvjy8qq1fvy238838enjmy5wzy2md7yvsitp5vztft6j4q866efym7e6" +
                "vu5wm9fpnwjyxfldw3vbo01mgjs75rgo7qioh8z8ij7jpyp8508okhgbbex3ceei" +
                "786u5rw2a9gx743dj3fgq2irk"
-       knownSignature     = "257f3f5f5f0a4e4626a18fc74bd42ec34dcb228a"
+       knownSignatureTTL  = 1209600 * time.Second
+       knownSignature     = "89118b78732c33104a4d6231e8b5a5fa1e4301e3"
        knownTimestamp     = "7fffffff"
        knownSigHint       = "+A" + knownSignature + "@" + knownTimestamp
        knownSignedLocator = knownLocator + knownSigHint
 )
 
 func TestSignLocator(t *testing.T) {
-       PermissionSecret = []byte(knownKey)
-       defer func() { PermissionSecret = nil }()
+       defer func(b []byte) {
+               PermissionSecret = b
+       }(PermissionSecret)
 
        tsInt, err := strconv.ParseInt(knownTimestamp, 16, 0)
        if err != nil {
-               t.Fail()
-       }
-       if knownSignedLocator != SignLocator(knownLocator, knownToken, time.Unix(tsInt, 0)) {
-               t.Fail()
+               t.Fatal(err)
        }
-}
+       t0 := time.Unix(tsInt, 0)
 
-func TestVerifySignature(t *testing.T) {
-       PermissionSecret = []byte(knownKey)
-       defer func() { PermissionSecret = nil }()
+       blobSignatureTTL = knownSignatureTTL
 
-       if VerifySignature(knownSignedLocator, knownToken) != nil {
-               t.Fail()
-       }
-}
-
-func TestVerifySignatureExtraHints(t *testing.T) {
        PermissionSecret = []byte(knownKey)
-       defer func() { PermissionSecret = nil }()
-
-       if VerifySignature(knownLocator+"+K@xyzzy"+knownSigHint, knownToken) != nil {
-               t.Fatal("Verify cannot handle hint before permission signature")
+       if x := SignLocator(knownLocator, knownToken, t0); x != knownSignedLocator {
+               t.Fatalf("Got %+q, expected %+q", x, knownSignedLocator)
        }
 
-       if VerifySignature(knownLocator+knownSigHint+"+Zfoo", knownToken) != nil {
-               t.Fatal("Verify cannot handle hint after permission signature")
-       }
-
-       if VerifySignature(knownLocator+"+K@xyzzy"+knownSigHint+"+Zfoo", knownToken) != nil {
-               t.Fatal("Verify cannot handle hints around permission signature")
+       PermissionSecret = []byte("arbitrarykey")
+       if x := SignLocator(knownLocator, knownToken, t0); x == knownSignedLocator {
+               t.Fatalf("Got same signature %+q, even though PermissionSecret changed", x)
        }
 }
 
-// The size hint on the locator string should not affect signature validation.
-func TestVerifySignatureWrongSize(t *testing.T) {
-       PermissionSecret = []byte(knownKey)
-       defer func() { PermissionSecret = nil }()
-
-       if VerifySignature(knownHash+"+999999"+knownSigHint, knownToken) != nil {
-               t.Fatal("Verify cannot handle incorrect size hint")
-       }
+func TestVerifyLocator(t *testing.T) {
+       defer func(b []byte) {
+               PermissionSecret = b
+       }(PermissionSecret)
 
-       if VerifySignature(knownHash+knownSigHint, knownToken) != nil {
-               t.Fatal("Verify cannot handle missing size hint")
-       }
-}
+       blobSignatureTTL = knownSignatureTTL
 
-func TestVerifySignatureBadSig(t *testing.T) {
        PermissionSecret = []byte(knownKey)
-       defer func() { PermissionSecret = nil }()
-
-       badLocator := knownLocator + "+Aaaaaaaaaaaaaaaa@" + knownTimestamp
-       if VerifySignature(badLocator, knownToken) != PermissionError {
-               t.Fail()
+       if err := VerifySignature(knownSignedLocator, knownToken); err != nil {
+               t.Fatal(err)
        }
-}
-
-func TestVerifySignatureBadTimestamp(t *testing.T) {
-       PermissionSecret = []byte(knownKey)
-       defer func() { PermissionSecret = nil }()
-
-       badLocator := knownLocator + "+A" + knownSignature + "@OOOOOOOl"
-       if VerifySignature(badLocator, knownToken) != PermissionError {
-               t.Fail()
-       }
-}
-
-func TestVerifySignatureBadSecret(t *testing.T) {
-       PermissionSecret = []byte("00000000000000000000")
-       defer func() { PermissionSecret = nil }()
-
-       if VerifySignature(knownSignedLocator, knownToken) != PermissionError {
-               t.Fail()
-       }
-}
-
-func TestVerifySignatureBadToken(t *testing.T) {
-       PermissionSecret = []byte(knownKey)
-       defer func() { PermissionSecret = nil }()
-
-       if VerifySignature(knownSignedLocator, "00000000") != PermissionError {
-               t.Fail()
-       }
-}
-
-func TestVerifySignatureExpired(t *testing.T) {
-       PermissionSecret = []byte(knownKey)
-       defer func() { PermissionSecret = nil }()
 
-       yesterday := time.Now().AddDate(0, 0, -1)
-       expiredLocator := SignLocator(knownHash, knownToken, yesterday)
-       if VerifySignature(expiredLocator, knownToken) != ExpiredError {
-               t.Fail()
+       PermissionSecret = []byte("arbitrarykey")
+       if err := VerifySignature(knownSignedLocator, knownToken); err == nil {
+               t.Fatal("Verified signature even with wrong PermissionSecret")
        }
 }