Initial multi-tenant blog host

Go + Postgres application serving a management dashboard on the base
domain and one public blog per subdomain. Markdown posts organised in
pages, form-based theme customisation, image uploads stored in Postgres,
JWT cookie sessions with CSRF, superadmin user management, RSS feeds.
Docker/compose deployment and a Makefile-driven dev environment with
seed data.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Sd8UPWrvyYCLj97JexNw3A

1 files changed, 46 insertions, 0 deletions

diff --git a/internal/auth/auth_test.go b/internal/auth/auth_test.go
new file mode 100644
index 0000000..d09ec3c
--- /dev/null
+++ b/internal/auth/auth_test.go
@@ -0,0 +1,46 @@
+package auth
+
+import (
+	"testing"
+	"time"
+)
+
+func TestTokenRoundTrip(t *testing.T) {
+	secret := []byte("test-secret-test-secret")
+	tok, err := IssueToken(secret, 42, 3, time.Now())
+	if err != nil {
+		t.Fatal(err)
+	}
+	c, err := ParseToken(secret, tok)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if c.UserID != 42 || c.TokenVersion != 3 {
+		t.Errorf("claims = %+v", c)
+	}
+	if _, err := ParseToken([]byte("other-secret-other-secret"), tok); err == nil {
+		t.Error("token accepted with wrong secret")
+	}
+	old, _ := IssueToken(secret, 42, 3, time.Now().Add(-8*24*time.Hour))
+	if _, err := ParseToken(secret, old); err == nil {
+		t.Error("expired token accepted")
+	}
+}
+
+func TestPasswordAndCSRF(t *testing.T) {
+	h, err := HashPassword("hunter22")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !CheckPassword(h, "hunter22") || CheckPassword(h, "hunter23") {
+		t.Error("password check wrong")
+	}
+	secret := []byte("s")
+	tok := CSRFToken(secret, 1, 0)
+	if !CheckCSRF(secret, 1, 0, tok) {
+		t.Error("valid csrf rejected")
+	}
+	if CheckCSRF(secret, 1, 1, tok) || CheckCSRF(secret, 2, 0, tok) || CheckCSRF(secret, 1, 0, "") {
+		t.Error("invalid csrf accepted")
+	}
+}