289 lines
11 KiB
Go
289 lines
11 KiB
Go
package verification
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
verificationmodel "git.sendico.io/tech/sxchnge/product/verification/model"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
"go.mongodb.org/mongo-driver/v2/bson"
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
)
|
|
|
|
func TestCreate_ReturnsRawToken(t *testing.T) {
|
|
db := newTestVerificationDB(t)
|
|
ctx := context.Background()
|
|
accountRef := bson.NewObjectID()
|
|
|
|
raw, err := db.Create(ctx, req(accountRef, verificationmodel.PurposePasswordReset, "", time.Hour))
|
|
require.NoError(t, err)
|
|
assert.NotEmpty(t, raw)
|
|
}
|
|
|
|
func TestCreate_TokenCanBeConsumed(t *testing.T) {
|
|
db := newTestVerificationDB(t)
|
|
ctx := context.Background()
|
|
accountRef := bson.NewObjectID()
|
|
|
|
raw, err := db.Create(ctx, req(accountRef, verificationmodel.PurposePasswordReset, "", time.Hour))
|
|
require.NoError(t, err)
|
|
|
|
tok, err := db.Consume(ctx, accountRef, verificationmodel.PurposePasswordReset, "", raw)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, accountRef, tok.AccountRef)
|
|
assert.Equal(t, verificationmodel.PurposePasswordReset, tok.Purpose)
|
|
assert.NotNil(t, tok.UsedAt)
|
|
}
|
|
|
|
func TestConsume_ReturnsCorrectFields(t *testing.T) {
|
|
db := newTestVerificationDB(t)
|
|
ctx := context.Background()
|
|
accountRef := bson.NewObjectID()
|
|
|
|
raw, err := db.Create(ctx, req(accountRef, verificationmodel.PurposeEmailChange, "new@example.com", time.Hour))
|
|
require.NoError(t, err)
|
|
|
|
tok, err := db.Consume(ctx, accountRef, verificationmodel.PurposeEmailChange, "", raw)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, accountRef, tok.AccountRef)
|
|
assert.Equal(t, verificationmodel.PurposeEmailChange, tok.Purpose)
|
|
assert.Equal(t, "new@example.com", tok.Target)
|
|
}
|
|
|
|
func TestConsume_SecondConsumeFailsAlreadyUsed(t *testing.T) {
|
|
db := newTestVerificationDB(t)
|
|
ctx := context.Background()
|
|
accountRef := bson.NewObjectID()
|
|
|
|
raw, err := db.Create(ctx, req(accountRef, verificationmodel.PurposePasswordReset, "", time.Hour))
|
|
require.NoError(t, err)
|
|
|
|
_, err = db.Consume(ctx, accountRef, verificationmodel.PurposePasswordReset, "", raw)
|
|
require.NoError(t, err)
|
|
|
|
_, err = db.Consume(ctx, accountRef, verificationmodel.PurposePasswordReset, "", raw)
|
|
require.Error(t, err)
|
|
assert.True(t, errors.Is(err, ErrTokenAlreadyUsed),
|
|
"second consume should fail with already-used after usedAt is set")
|
|
}
|
|
|
|
func TestConsume_ExpiredTokenFails(t *testing.T) {
|
|
db := newTestVerificationDB(t)
|
|
ctx := context.Background()
|
|
accountRef := bson.NewObjectID()
|
|
|
|
// Create with a TTL that is already in the past.
|
|
raw, err := db.Create(ctx, req(accountRef, verificationmodel.PurposePasswordReset, "", -time.Hour))
|
|
require.NoError(t, err)
|
|
|
|
_, err = db.Consume(ctx, accountRef, verificationmodel.PurposePasswordReset, "", raw)
|
|
require.Error(t, err)
|
|
assert.True(t, errors.Is(err, ErrTokenExpired),
|
|
"expired token should return explicit expiry error")
|
|
}
|
|
|
|
func TestConsume_UnknownTokenFails(t *testing.T) {
|
|
db := newTestVerificationDB(t)
|
|
ctx := context.Background()
|
|
|
|
_, err := db.Consume(ctx, bson.NilObjectID, "", "", "nonexistent-token-value")
|
|
require.Error(t, err)
|
|
assert.True(t, errors.Is(err, ErrTokenNotFound))
|
|
}
|
|
|
|
func TestConsume_AccountActivationWithoutAccountRef(t *testing.T) {
|
|
db := newTestVerificationDB(t)
|
|
ctx := context.Background()
|
|
accountRef := bson.NewObjectID()
|
|
|
|
raw, err := db.Create(ctx, req(accountRef, verificationmodel.PurposeAccountActivation, "", time.Hour))
|
|
require.NoError(t, err)
|
|
|
|
tok, err := db.Consume(ctx, bson.NilObjectID, verificationmodel.PurposeAccountActivation, "", raw)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, accountRef, tok.AccountRef)
|
|
assert.Equal(t, verificationmodel.PurposeAccountActivation, tok.Purpose)
|
|
}
|
|
|
|
func TestCreate_InvalidatesPreviousToken(t *testing.T) {
|
|
db := newTestVerificationDB(t)
|
|
ctx := context.Background()
|
|
accountRef := bson.NewObjectID()
|
|
|
|
oldRaw, err := db.Create(ctx, req(accountRef, verificationmodel.PurposePasswordReset, "", time.Hour))
|
|
require.NoError(t, err)
|
|
|
|
newRaw, err := db.Create(ctx, req(accountRef, verificationmodel.PurposePasswordReset, "", time.Hour))
|
|
require.NoError(t, err)
|
|
assert.NotEqual(t, oldRaw, newRaw, "new token should differ from old one")
|
|
|
|
// Old token is no longer consumable — invalidated (usedAt set) by the second Create.
|
|
_, err = db.Consume(ctx, accountRef, verificationmodel.PurposePasswordReset, "", oldRaw)
|
|
require.Error(t, err)
|
|
assert.True(t, errors.Is(err, ErrTokenAlreadyUsed),
|
|
"old token should return already-used after invalidation")
|
|
|
|
// New token works fine.
|
|
tok, err := db.Consume(ctx, accountRef, verificationmodel.PurposePasswordReset, "", newRaw)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, accountRef, tok.AccountRef)
|
|
}
|
|
|
|
func TestCreate_AccountActivationResendWithoutIdempotency_ReissuesToken(t *testing.T) {
|
|
db := newTestVerificationDB(t)
|
|
ctx := context.Background()
|
|
accountRef := bson.NewObjectID()
|
|
|
|
// First issue for the same verification scope.
|
|
firstRaw, err := db.Create(ctx, req(accountRef, verificationmodel.PurposeAccountActivation, "", time.Hour))
|
|
require.NoError(t, err)
|
|
|
|
// Second issue during resend should rotate token instead of failing with duplicate key.
|
|
secondRaw, err := db.Create(ctx, req(accountRef, verificationmodel.PurposeAccountActivation, "", time.Hour))
|
|
require.NoError(t, err)
|
|
assert.NotEqual(t, firstRaw, secondRaw)
|
|
|
|
// Old token becomes unusable after reissue.
|
|
_, err = db.Consume(ctx, bson.NilObjectID, verificationmodel.PurposeAccountActivation, "", firstRaw)
|
|
require.Error(t, err)
|
|
assert.True(t, errors.Is(err, ErrTokenAlreadyUsed))
|
|
|
|
// New token is valid.
|
|
tok, err := db.Consume(ctx, bson.NilObjectID, verificationmodel.PurposeAccountActivation, "", secondRaw)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, accountRef, tok.AccountRef)
|
|
assert.Equal(t, verificationmodel.PurposeAccountActivation, tok.Purpose)
|
|
|
|
// Non-idempotent requests should still persist unique internal keys,
|
|
// preventing uniqueness collisions on (accountRef, purpose, target, idempotencyKey).
|
|
repo := db.Repository.(*memoryTokenRepository)
|
|
repo.mu.Lock()
|
|
defer repo.mu.Unlock()
|
|
|
|
keys := map[string]struct{}{}
|
|
for _, stored := range repo.data {
|
|
if stored.AccountRef != accountRef || stored.Purpose != verificationmodel.PurposeAccountActivation {
|
|
continue
|
|
}
|
|
require.NotNil(t, stored.IdempotencyKey)
|
|
assert.True(t, strings.HasPrefix(*stored.IdempotencyKey, "auto:"))
|
|
keys[*stored.IdempotencyKey] = struct{}{}
|
|
}
|
|
assert.Len(t, keys, 2)
|
|
}
|
|
|
|
func TestCreate_InvalidatesMultiplePreviousTokens(t *testing.T) {
|
|
db := newTestVerificationDB(t)
|
|
ctx := context.Background()
|
|
accountRef := bson.NewObjectID()
|
|
|
|
first, err := db.Create(ctx, req(accountRef, verificationmodel.PurposePasswordReset, "", time.Hour))
|
|
require.NoError(t, err)
|
|
second, err := db.Create(ctx, req(accountRef, verificationmodel.PurposePasswordReset, "", time.Hour))
|
|
require.NoError(t, err)
|
|
third, err := db.Create(ctx, req(accountRef, verificationmodel.PurposePasswordReset, "", time.Hour))
|
|
require.NoError(t, err)
|
|
|
|
_, err = db.Consume(ctx, accountRef, verificationmodel.PurposePasswordReset, "", first)
|
|
assert.True(t, errors.Is(err, ErrTokenAlreadyUsed), "first should be invalidated/used")
|
|
_, err = db.Consume(ctx, accountRef, verificationmodel.PurposePasswordReset, "", second)
|
|
assert.True(t, errors.Is(err, ErrTokenAlreadyUsed), "second should be invalidated/used")
|
|
|
|
tok, err := db.Consume(ctx, accountRef, verificationmodel.PurposePasswordReset, "", third)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, accountRef, tok.AccountRef)
|
|
}
|
|
|
|
func TestCreate_DifferentPurposeNotInvalidated(t *testing.T) {
|
|
db := newTestVerificationDB(t)
|
|
ctx := context.Background()
|
|
accountRef := bson.NewObjectID()
|
|
|
|
resetRaw, err := db.Create(ctx, req(accountRef, verificationmodel.PurposePasswordReset, "", time.Hour))
|
|
require.NoError(t, err)
|
|
|
|
// Creating an activation token should NOT invalidate the password-reset token.
|
|
_, err = db.Create(ctx, req(accountRef, verificationmodel.PurposeAccountActivation, "", time.Hour))
|
|
require.NoError(t, err)
|
|
|
|
tok, err := db.Consume(ctx, accountRef, verificationmodel.PurposePasswordReset, "", resetRaw)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, verificationmodel.PurposePasswordReset, tok.Purpose)
|
|
}
|
|
|
|
func TestCreate_DifferentTargetNotInvalidated(t *testing.T) {
|
|
db := newTestVerificationDB(t)
|
|
ctx := context.Background()
|
|
accountRef := bson.NewObjectID()
|
|
|
|
firstRaw, err := db.Create(ctx, req(accountRef, verificationmodel.PurposeEmailChange, "a@example.com", time.Hour))
|
|
require.NoError(t, err)
|
|
|
|
// Creating a token for a different target email should NOT invalidate the first.
|
|
_, err = db.Create(ctx, req(accountRef, verificationmodel.PurposeEmailChange, "b@example.com", time.Hour))
|
|
require.NoError(t, err)
|
|
|
|
tok, err := db.Consume(ctx, accountRef, verificationmodel.PurposeEmailChange, "", firstRaw)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, "a@example.com", tok.Target)
|
|
}
|
|
|
|
func TestCreate_DifferentAccountNotInvalidated(t *testing.T) {
|
|
db := newTestVerificationDB(t)
|
|
ctx := context.Background()
|
|
account1 := bson.NewObjectID()
|
|
account2 := bson.NewObjectID()
|
|
|
|
raw1, err := db.Create(ctx, req(account1, verificationmodel.PurposePasswordReset, "", time.Hour))
|
|
require.NoError(t, err)
|
|
|
|
_, err = db.Create(ctx, req(account2, verificationmodel.PurposePasswordReset, "", time.Hour))
|
|
require.NoError(t, err)
|
|
|
|
tok, err := db.Consume(ctx, account1, verificationmodel.PurposePasswordReset, "", raw1)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, account1, tok.AccountRef)
|
|
}
|
|
|
|
func TestCreate_AlreadyUsedTokenNotInvalidatedAgain(t *testing.T) {
|
|
db := newTestVerificationDB(t)
|
|
ctx := context.Background()
|
|
accountRef := bson.NewObjectID()
|
|
|
|
// Create and consume first token.
|
|
raw1, err := db.Create(ctx, req(accountRef, verificationmodel.PurposePasswordReset, "", time.Hour))
|
|
require.NoError(t, err)
|
|
_, err = db.Consume(ctx, accountRef, verificationmodel.PurposePasswordReset, "", raw1)
|
|
require.NoError(t, err)
|
|
|
|
// Create second — the already-consumed token should have usedAt set,
|
|
// so the invalidation query (usedAt == nil) should skip it.
|
|
// This tests that the PatchMany filter correctly excludes already-used tokens.
|
|
raw2, err := db.Create(ctx, req(accountRef, verificationmodel.PurposePasswordReset, "", time.Hour))
|
|
require.NoError(t, err)
|
|
|
|
tok, err := db.Consume(ctx, accountRef, verificationmodel.PurposePasswordReset, "", raw2)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, accountRef, tok.AccountRef)
|
|
}
|
|
|
|
func TestCreate_ExpiredTokenNotInvalidated(t *testing.T) {
|
|
db := newTestVerificationDB(t)
|
|
ctx := context.Background()
|
|
accountRef := bson.NewObjectID()
|
|
|
|
// Create a token that is already expired.
|
|
_, err := db.Create(ctx, req(accountRef, verificationmodel.PurposePasswordReset, "", -time.Hour))
|
|
require.NoError(t, err)
|
|
|
|
// Create a fresh one — invalidation should skip the expired token (expiresAt > now filter).
|
|
raw2, err := db.Create(ctx, req(accountRef, verificationmodel.PurposePasswordReset, "", time.Hour))
|
|
require.NoError(t, err)
|
|
|
|
tok, err := db.Consume(ctx, accountRef, verificationmodel.PurposePasswordReset, "", raw2)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, accountRef, tok.AccountRef)
|
|
}
|