149 lines
4.1 KiB
Go
149 lines
4.1 KiB
Go
//go:build integration
|
|
// +build integration
|
|
|
|
package refreshtokens_test
|
|
|
|
import (
|
|
"context"
|
|
"testing"
|
|
"time"
|
|
|
|
"git.sendico.io/tech/sxchnge/bff/pkg/model"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
"go.mongodb.org/mongo-driver/v2/bson"
|
|
)
|
|
|
|
func TestRefreshTokenDB_TokenRotation(t *testing.T) {
|
|
db, cleanup := setupTestDB(t)
|
|
defer cleanup()
|
|
|
|
ctx := context.Background()
|
|
|
|
t.Run("Token_Rotation_On_Use", func(t *testing.T) {
|
|
userID := bson.NewObjectID()
|
|
clientID := "web-app"
|
|
deviceID := "user-browser"
|
|
initialToken := "initial_token_123"
|
|
|
|
// Create initial token
|
|
refreshToken := createTestRefreshToken(userID, clientID, deviceID, initialToken)
|
|
err := db.Create(ctx, refreshToken)
|
|
require.NoError(t, err)
|
|
|
|
// Simulate small delay
|
|
time.Sleep(10 * time.Millisecond)
|
|
|
|
// Use token - should update LastUsedAt
|
|
crt := &model.ClientRefreshToken{
|
|
SessionIdentifier: model.SessionIdentifier{
|
|
ClientID: clientID,
|
|
DeviceID: deviceID,
|
|
},
|
|
RefreshToken: initialToken,
|
|
}
|
|
|
|
retrievedToken, err := db.GetByCRT(ctx, crt)
|
|
require.NoError(t, err)
|
|
// Token lookup should preserve data and advance LastUsedAt.
|
|
assert.Equal(t, initialToken, retrievedToken.RefreshToken)
|
|
|
|
// Create new token with rotated value (simulating token rotation)
|
|
newToken := "rotated_token_456"
|
|
retrievedToken.RefreshToken = newToken
|
|
err = db.Update(ctx, retrievedToken)
|
|
require.NoError(t, err)
|
|
|
|
// Old token should no longer work
|
|
_, err = db.GetByCRT(ctx, crt)
|
|
assert.Error(t, err)
|
|
|
|
// New token should work
|
|
newCRT := &model.ClientRefreshToken{
|
|
SessionIdentifier: model.SessionIdentifier{
|
|
ClientID: clientID,
|
|
DeviceID: deviceID,
|
|
},
|
|
RefreshToken: newToken,
|
|
}
|
|
_, err = db.GetByCRT(ctx, newCRT)
|
|
require.NoError(t, err)
|
|
})
|
|
|
|
t.Run("Create_Defaults_LastUsedAt_When_Replacing_Active_Session", func(t *testing.T) {
|
|
userID := bson.NewObjectID()
|
|
clientID := "web-app"
|
|
deviceID := "replacement-browser"
|
|
|
|
initialLastUsedAt := time.Now().Add(-2 * time.Hour)
|
|
firstToken := createTestRefreshToken(userID, clientID, deviceID, "first_session_token")
|
|
firstToken.LastUsedAt = initialLastUsedAt
|
|
err := db.Create(ctx, firstToken)
|
|
require.NoError(t, err)
|
|
require.NotNil(t, firstToken.GetID())
|
|
firstTokenID := *firstToken.GetID()
|
|
|
|
time.Sleep(10 * time.Millisecond)
|
|
|
|
replacement := &model.RefreshToken{
|
|
ClientRefreshToken: model.ClientRefreshToken{
|
|
SessionIdentifier: model.SessionIdentifier{
|
|
ClientID: clientID,
|
|
DeviceID: deviceID,
|
|
},
|
|
RefreshToken: "replacement_session_token",
|
|
},
|
|
AccountRef: &userID,
|
|
ExpiresAt: time.Now().Add(24 * time.Hour),
|
|
IsRevoked: false,
|
|
UserAgent: "TestUserAgent/2.0",
|
|
IPAddress: "10.0.0.5",
|
|
}
|
|
|
|
err = db.Create(ctx, replacement)
|
|
require.NoError(t, err)
|
|
require.NotNil(t, replacement.GetID())
|
|
assert.Equal(t, firstTokenID, *replacement.GetID())
|
|
|
|
var stored model.RefreshToken
|
|
err = db.Get(ctx, firstTokenID, &stored)
|
|
require.NoError(t, err)
|
|
assert.False(t, stored.LastUsedAt.IsZero())
|
|
assert.True(t, stored.LastUsedAt.After(initialLastUsedAt))
|
|
assert.Equal(t, "replacement_session_token", stored.RefreshToken)
|
|
})
|
|
|
|
t.Run("GetByCRT_Updates_LastUsedAt", func(t *testing.T) {
|
|
userID := bson.NewObjectID()
|
|
clientID := "web-app"
|
|
deviceID := "refresh-browser"
|
|
token := "refresh_token_last_used"
|
|
|
|
initialLastUsedAt := time.Now().Add(-1 * time.Hour)
|
|
refreshToken := createTestRefreshToken(userID, clientID, deviceID, token)
|
|
refreshToken.LastUsedAt = initialLastUsedAt
|
|
err := db.Create(ctx, refreshToken)
|
|
require.NoError(t, err)
|
|
require.NotNil(t, refreshToken.GetID())
|
|
|
|
time.Sleep(10 * time.Millisecond)
|
|
|
|
crt := &model.ClientRefreshToken{
|
|
SessionIdentifier: model.SessionIdentifier{
|
|
ClientID: clientID,
|
|
DeviceID: deviceID,
|
|
},
|
|
RefreshToken: token,
|
|
}
|
|
|
|
retrievedToken, err := db.GetByCRT(ctx, crt)
|
|
require.NoError(t, err)
|
|
assert.True(t, retrievedToken.LastUsedAt.After(initialLastUsedAt))
|
|
|
|
var stored model.RefreshToken
|
|
err = db.Get(ctx, *refreshToken.GetID(), &stored)
|
|
require.NoError(t, err)
|
|
assert.True(t, stored.LastUsedAt.After(initialLastUsedAt))
|
|
})
|
|
}
|