205 lines
7.7 KiB
Go
205 lines
7.7 KiB
Go
package public
|
|
|
|
import (
|
|
"context"
|
|
sessionmodel "git.sendico.io/tech/sxchnge/product/sessions/model"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"sync"
|
|
"testing"
|
|
"time"
|
|
|
|
"git.sendico.io/tech/sxchnge/product/sessions/browser"
|
|
"git.sendico.io/tech/sxchnge/product/sessions/store"
|
|
"git.sendico.io/tech/sxchnge/shared/errors"
|
|
"git.sendico.io/tech/sxchnge/shared/service"
|
|
"github.com/stretchr/testify/require"
|
|
"go.mongodb.org/mongo-driver/v2/bson"
|
|
"go.uber.org/zap"
|
|
)
|
|
|
|
type logoutDB struct {
|
|
refreshtokens.DB
|
|
mu sync.Mutex
|
|
tokens map[string]*sessionmodel.RefreshToken
|
|
lookupErr error
|
|
revokeErr error
|
|
}
|
|
|
|
func (db *logoutDB) RevokeToken(_ context.Context, request *sessionmodel.ClientRefreshToken) (bool, error) {
|
|
db.mu.Lock()
|
|
defer db.mu.Unlock()
|
|
if db.lookupErr != nil {
|
|
return false, db.lookupErr
|
|
}
|
|
token := db.tokens[request.DeviceID]
|
|
if token == nil || token.IsRevoked || token.RefreshToken != request.RefreshToken {
|
|
return false, nil
|
|
}
|
|
if db.revokeErr != nil {
|
|
return false, db.revokeErr
|
|
}
|
|
token.IsRevoked = true
|
|
return true, nil
|
|
}
|
|
|
|
func newLogoutToken(accountRef bson.ObjectID, deviceID, value string) *sessionmodel.RefreshToken {
|
|
return &sessionmodel.RefreshToken{
|
|
ClientRefreshToken: sessionmodel.ClientRefreshToken{
|
|
SessionIdentifier: sessionmodel.SessionIdentifier{ClientID: "web", DeviceID: deviceID, SessionVersion: "version-" + deviceID},
|
|
RefreshToken: value,
|
|
},
|
|
AccountRef: &accountRef,
|
|
ExpiresAt: time.Now().Add(time.Hour),
|
|
}
|
|
}
|
|
|
|
func executeLogout(router *PublicRouter, deviceID, refreshToken string) int {
|
|
body := `{"clientId":"web","deviceId":"` + deviceID + `","token":"` + refreshToken + `"}`
|
|
request := httptest.NewRequestWithContext(context.Background(), http.MethodPost, "/accounts/logout", strings.NewReader(body))
|
|
response := httptest.NewRecorder()
|
|
router.logout(request)(response, request)
|
|
return response.Code
|
|
}
|
|
|
|
func TestLogoutRevokesOnlyCurrentSessionAndIsIdempotent(t *testing.T) {
|
|
accountRef := bson.NewObjectID()
|
|
db := &logoutDB{tokens: map[string]*sessionmodel.RefreshToken{
|
|
"device-a": newLogoutToken(accountRef, "device-a", "refresh-a"),
|
|
"device-b": newLogoutToken(accountRef, "device-b", "refresh-b"),
|
|
}}
|
|
router := &PublicRouter{logger: zap.NewNop(), rtdb: db, service: mservice.Accounts}
|
|
|
|
if status := executeLogout(router, "device-a", "refresh-a"); status != http.StatusOK {
|
|
t.Fatalf("first logout status = %d", status)
|
|
}
|
|
if status := executeLogout(router, "device-a", "refresh-a"); status != http.StatusOK {
|
|
t.Fatalf("repeated logout status = %d", status)
|
|
}
|
|
if !db.tokens["device-a"].IsRevoked {
|
|
t.Fatal("current device session was not revoked")
|
|
}
|
|
if db.tokens["device-b"].IsRevoked {
|
|
t.Fatal("another device session was revoked")
|
|
}
|
|
}
|
|
|
|
func TestConcurrentLogoutIsIdempotent(t *testing.T) {
|
|
accountRef := bson.NewObjectID()
|
|
db := &logoutDB{tokens: map[string]*sessionmodel.RefreshToken{
|
|
"device-a": newLogoutToken(accountRef, "device-a", "refresh-a"),
|
|
}}
|
|
router := &PublicRouter{logger: zap.NewNop(), rtdb: db, service: mservice.Accounts}
|
|
|
|
statuses := make(chan int, 8)
|
|
var workers sync.WaitGroup
|
|
for range 8 {
|
|
workers.Add(1)
|
|
go func() {
|
|
defer workers.Done()
|
|
statuses <- executeLogout(router, "device-a", "refresh-a")
|
|
}()
|
|
}
|
|
workers.Wait()
|
|
close(statuses)
|
|
for status := range statuses {
|
|
if status != http.StatusOK {
|
|
t.Fatalf("concurrent logout status = %d", status)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestDelayedLogoutDoesNotRevokeReplacementSession(t *testing.T) {
|
|
accountRef := bson.NewObjectID()
|
|
db := &logoutDB{tokens: map[string]*sessionmodel.RefreshToken{
|
|
"device-a": newLogoutToken(accountRef, "device-a", "new-refresh"),
|
|
}}
|
|
router := &PublicRouter{logger: zap.NewNop(), rtdb: db, service: mservice.Accounts}
|
|
|
|
if status := executeLogout(router, "device-a", "old-refresh"); status != http.StatusOK {
|
|
t.Fatalf("delayed logout status = %d", status)
|
|
}
|
|
if db.tokens["device-a"].IsRevoked {
|
|
t.Fatal("replacement session was revoked by a stale logout request")
|
|
}
|
|
}
|
|
|
|
func TestLogoutAcceptsAnAlreadyExpiredSession(t *testing.T) {
|
|
accountRef := bson.NewObjectID()
|
|
expired := newLogoutToken(accountRef, "device-a", "expired-refresh")
|
|
expired.ExpiresAt = time.Now().Add(-time.Hour)
|
|
db := &logoutDB{tokens: map[string]*sessionmodel.RefreshToken{"device-a": expired}}
|
|
router := &PublicRouter{logger: zap.NewNop(), rtdb: db, service: mservice.Accounts}
|
|
|
|
if status := executeLogout(router, "device-a", "expired-refresh"); status != http.StatusOK {
|
|
t.Fatalf("expired logout status = %d", status)
|
|
}
|
|
if !expired.IsRevoked {
|
|
t.Fatal("expired session was not marked revoked before cleanup")
|
|
}
|
|
}
|
|
|
|
func TestLogoutFailsClosedWhenSessionStoreIsUnavailable(t *testing.T) {
|
|
db := &logoutDB{lookupErr: merrors.Internal("database unavailable")}
|
|
router := &PublicRouter{logger: zap.NewNop(), rtdb: db, service: mservice.Accounts}
|
|
if status := executeLogout(router, "device-a", "refresh-a"); status != http.StatusInternalServerError {
|
|
t.Fatalf("logout status = %d, want %d", status, http.StatusInternalServerError)
|
|
}
|
|
}
|
|
|
|
func TestBrowserLogoutUsesCookieCredentialAndClearsIt(t *testing.T) {
|
|
accountRef := bson.NewObjectID()
|
|
token := newLogoutToken(accountRef, "device-a", "cookie-refresh")
|
|
db := &logoutDB{tokens: map[string]*sessionmodel.RefreshToken{"device-a": token}}
|
|
router := &PublicRouter{logger: zap.NewNop(), rtdb: db, service: mservice.Accounts}
|
|
body := `{"clientId":"web","deviceId":"device-a","token":"body-must-be-ignored"}`
|
|
request := httptest.NewRequest(http.MethodPost, "https://app.sendico.io/api/v1/accounts/logout", strings.NewReader(body))
|
|
request.Header.Set(browser.TransportHeader, browser.TransportCookie)
|
|
request.AddCookie(&http.Cookie{Name: browser.RefreshCookie, Value: "cookie-refresh"})
|
|
response := httptest.NewRecorder()
|
|
|
|
router.logout(request)(response, request)
|
|
|
|
require.Equal(t, http.StatusOK, response.Code)
|
|
require.True(t, token.IsRevoked)
|
|
cookies := response.Result().Cookies()
|
|
require.Len(t, cookies, 1)
|
|
require.Equal(t, browser.RefreshCookie, cookies[0].Name)
|
|
require.Equal(t, -1, cookies[0].MaxAge)
|
|
require.Equal(t, "/api/v1/accounts", cookies[0].Path)
|
|
}
|
|
|
|
func TestBrowserLogoutWithoutCookieIsIdempotentAndClearsBrowserState(t *testing.T) {
|
|
db := &logoutDB{tokens: map[string]*sessionmodel.RefreshToken{}}
|
|
router := &PublicRouter{logger: zap.NewNop(), rtdb: db, service: mservice.Accounts}
|
|
body := `{"clientId":"web","deviceId":"device-a","token":"body-must-be-ignored"}`
|
|
request := httptest.NewRequest(http.MethodPost, "https://app.sendico.io/api/v1/accounts/logout", strings.NewReader(body))
|
|
request.Header.Set(browser.TransportHeader, browser.TransportCookie)
|
|
response := httptest.NewRecorder()
|
|
|
|
router.logout(request)(response, request)
|
|
|
|
require.Equal(t, http.StatusOK, response.Code)
|
|
require.Contains(t, response.Header().Get("Set-Cookie"), browser.RefreshCookie+"=")
|
|
require.Contains(t, response.Header().Get("Set-Cookie"), "Max-Age=0")
|
|
}
|
|
|
|
func TestBrowserLogoutKeepsCookieWhenRevocationFails(t *testing.T) {
|
|
db := &logoutDB{
|
|
tokens: map[string]*sessionmodel.RefreshToken{},
|
|
lookupErr: merrors.Internal("database unavailable"),
|
|
}
|
|
router := &PublicRouter{logger: zap.NewNop(), rtdb: db, service: mservice.Accounts}
|
|
body := `{"clientId":"web","deviceId":"device-a"}`
|
|
request := httptest.NewRequest(http.MethodPost, "https://app.sendico.io/api/v1/accounts/logout", strings.NewReader(body))
|
|
request.Header.Set(browser.TransportHeader, browser.TransportCookie)
|
|
request.AddCookie(&http.Cookie{Name: browser.RefreshCookie, Value: "cookie-refresh"})
|
|
response := httptest.NewRecorder()
|
|
|
|
router.logout(request)(response, request)
|
|
|
|
require.Equal(t, http.StatusInternalServerError, response.Code)
|
|
require.Empty(t, response.Header().Get("Set-Cookie"), "client must retain the cookie so logout can retry revocation")
|
|
}
|