sulthan
bcc6b45515
Implements #23 per ADR-0002. - Discord authorization code grant (identify + guilds.members.read), form-encoded token exchange - Guild membership gate via the single-guild endpoint; optional DISCORD_REQUIRED_ROLE (empty default) - Owner Discord ID is the only identity allowed to sign in - Sessions are DB rows with opaque random ids; cookie carries only the id; expiry enforced; delete = revoke - HMAC session signing, derived key, and WEB_PASSWORD removed; no replacement signing secret - Login rate limiting preserved on the callback - Full flow tested through the real router against a local Discord stub (DISCORD_API_BASE) - Env: DISCORD_CLIENT_ID/_CLIENT_SECRET/_GUILD_ID/_REQUIRED_ROLE/_API_BASE/_REDIRECT_URI; docs updated go test ./... passes. Reviewed-on: #31 Co-authored-by: Sulthan Zaki <sultankiki05@gmail.com> Co-committed-by: Sulthan Zaki <sultankiki05@gmail.com>
85 lines
2.4 KiB
Go
85 lines
2.4 KiB
Go
package store
|
|
|
|
import (
|
|
"testing"
|
|
"time"
|
|
)
|
|
|
|
func TestCreateAndGetSession(t *testing.T) {
|
|
s := newTestStore(t)
|
|
owner := s.OwnerID()
|
|
|
|
sess, err := s.CreateSession("sess-1", owner, time.Hour)
|
|
if err != nil {
|
|
t.Fatalf("CreateSession: %v", err)
|
|
}
|
|
if sess.ID != "sess-1" || sess.ReaderID != owner {
|
|
t.Fatalf("CreateSession returned %+v, want id sess-1 reader %d", sess, owner)
|
|
}
|
|
|
|
got, ok, err := s.GetSession("sess-1", time.Now())
|
|
if err != nil || !ok {
|
|
t.Fatalf("GetSession: ok=%v err=%v, want ok", ok, err)
|
|
}
|
|
if got.ReaderID != owner {
|
|
t.Fatalf("session reader = %d, want %d", got.ReaderID, owner)
|
|
}
|
|
}
|
|
|
|
func TestGetSessionUnknownID(t *testing.T) {
|
|
s := newTestStore(t)
|
|
if _, ok, err := s.GetSession("nope", time.Now()); err != nil || ok {
|
|
t.Fatalf("GetSession(unknown) = ok=%v err=%v, want ok=false", ok, err)
|
|
}
|
|
}
|
|
|
|
func TestExpiredSessionIsGone(t *testing.T) {
|
|
s := newTestStore(t)
|
|
owner := s.OwnerID()
|
|
if _, err := s.CreateSession("sess-exp", owner, -time.Minute); err != nil {
|
|
t.Fatalf("CreateSession: %v", err)
|
|
}
|
|
|
|
now := time.Now()
|
|
if _, ok, err := s.GetSession("sess-exp", now); err != nil || ok {
|
|
t.Fatalf("GetSession(expired) = ok=%v err=%v, want ok=false", ok, err)
|
|
}
|
|
// The expired row is deleted on lookup, so the next call cannot revive it.
|
|
if _, ok, err := s.GetSession("sess-exp", now.Add(-time.Hour)); err != nil || ok {
|
|
t.Fatalf("GetSession(expired again) = ok=%v err=%v, want ok=false", ok, err)
|
|
}
|
|
}
|
|
|
|
func TestDeleteSessionRevokes(t *testing.T) {
|
|
s := newTestStore(t)
|
|
owner := s.OwnerID()
|
|
if _, err := s.CreateSession("sess-del", owner, time.Hour); err != nil {
|
|
t.Fatalf("CreateSession: %v", err)
|
|
}
|
|
if err := s.DeleteSession("sess-del"); err != nil {
|
|
t.Fatalf("DeleteSession: %v", err)
|
|
}
|
|
if _, ok, err := s.GetSession("sess-del", time.Now()); err != nil || ok {
|
|
t.Fatalf("GetSession after delete = ok=%v err=%v, want ok=false", ok, err)
|
|
}
|
|
// Deleting twice is not an error.
|
|
if err := s.DeleteSession("sess-del"); err != nil {
|
|
t.Fatalf("DeleteSession twice: %v", err)
|
|
}
|
|
}
|
|
|
|
func TestDeleteSessionIsPerReader(t *testing.T) {
|
|
s := newTestStore(t)
|
|
other := secondReader(t, s)
|
|
if _, err := s.CreateSession("sess-other", other, time.Hour); err != nil {
|
|
t.Fatalf("CreateSession: %v", err)
|
|
}
|
|
got, ok, err := s.GetSession("sess-other", time.Now())
|
|
if err != nil || !ok {
|
|
t.Fatalf("GetSession: ok=%v err=%v, want ok", ok, err)
|
|
}
|
|
if got.ReaderID != other {
|
|
t.Fatalf("session reader = %d, want %d", got.ReaderID, other)
|
|
}
|
|
}
|