@@ -1,14 +1,87 @@
11package encryption
22
33import (
4+ "crypto/rand"
45 "crypto/sha1"
56 "crypto/sha256"
67 "encoding/base64"
8+ "fmt"
9+ "io"
710 "testing"
811
912 "github.com/stretchr/testify/assert"
1013)
1114
15+func TestSecretBytesEncoded(t *testing.T) {
16+ for _, secretSize := range []int{16, 24, 32} {
17+ t.Run(fmt.Sprintf("%d", secretSize), func(t *testing.T) {
18+ secret := make([]byte, secretSize)
19+ _, err := io.ReadFull(rand.Reader, secret)
20+ assert.Equal(t, nil, err)
21+
22+ // We test both padded & raw Base64 to ensure we handle both
23+ // potential user input routes for Base64
24+ base64Padded := base64.URLEncoding.EncodeToString(secret)
25+ sb := SecretBytes(base64Padded)
26+ assert.Equal(t, secret, sb)
27+ assert.Equal(t, len(sb), secretSize)
28+
29+ base64Raw := base64.RawURLEncoding.EncodeToString(secret)
30+ sb = SecretBytes(base64Raw)
31+ assert.Equal(t, secret, sb)
32+ assert.Equal(t, len(sb), secretSize)
33+ })
34+ }
35+}
36+
37+// A string that isn't intended as Base64 and still decodes (but to unintended length)
38+// will return the original secret as bytes
39+func TestSecretBytesEncodedWrongSize(t *testing.T) {
40+ for _, secretSize := range []int{15, 20, 28, 33, 44} {
41+ t.Run(fmt.Sprintf("%d", secretSize), func(t *testing.T) {
42+ secret := make([]byte, secretSize)
43+ _, err := io.ReadFull(rand.Reader, secret)
44+ assert.Equal(t, nil, err)
45+
46+ // We test both padded & raw Base64 to ensure we handle both
47+ // potential user input routes for Base64
48+ base64Padded := base64.URLEncoding.EncodeToString(secret)
49+ sb := SecretBytes(base64Padded)
50+ assert.NotEqual(t, secret, sb)
51+ assert.NotEqual(t, len(sb), secretSize)
52+ // The given secret is returned as []byte
53+ assert.Equal(t, base64Padded, string(sb))
54+
55+ base64Raw := base64.RawURLEncoding.EncodeToString(secret)
56+ sb = SecretBytes(base64Raw)
57+ assert.NotEqual(t, secret, sb)
58+ assert.NotEqual(t, len(sb), secretSize)
59+ // The given secret is returned as []byte
60+ assert.Equal(t, base64Raw, string(sb))
61+ })
62+ }
63+}
64+
65+func TestSecretBytesNonBase64(t *testing.T) {
66+ trailer := "equals=========="
67+ assert.Equal(t, trailer, string(SecretBytes(trailer)))
68+
69+ raw16 := "asdflkjhqwer)(*&"
70+ sb16 := SecretBytes(raw16)
71+ assert.Equal(t, raw16, string(sb16))
72+ assert.Equal(t, 16, len(sb16))
73+
74+ raw24 := "asdflkjhqwer)(*&CJEN#$%^"
75+ sb24 := SecretBytes(raw24)
76+ assert.Equal(t, raw24, string(sb24))
77+ assert.Equal(t, 24, len(sb24))
78+
79+ raw32 := "asdflkjhqwer)(*&1234lkjhqwer)(*&"
80+ sb32 := SecretBytes(raw32)
81+ assert.Equal(t, raw32, string(sb32))
82+ assert.Equal(t, 32, len(sb32))
83+}
84+
1285func TestSignAndValidate(t *testing.T) {
1386 seed := "0123456789abcdef"
1487 key := "cookie-name"