1 files changed, 46 insertions, 0 deletions
diff --git a/internal/auth/auth_test.go b/internal/auth/auth_test.go
new file mode 100644
index 0000000..d09ec3c
--- /dev/null
+++ b/internal/auth/auth_test.go
@@ -0,0 +1,46 @@
+package auth
+
+import (
+	"testing"
+	"time"
+)
+
+func TestTokenRoundTrip(t *testing.T) {
+	secret := []byte("test-secret-test-secret")
+	tok, err := IssueToken(secret, 42, 3, time.Now())
+	if err != nil {
+		t.Fatal(err)
+	}
+	c, err := ParseToken(secret, tok)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if c.UserID != 42 || c.TokenVersion != 3 {
+		t.Errorf("claims = %+v", c)
+	}
+	if _, err := ParseToken([]byte("other-secret-other-secret"), tok); err == nil {
+		t.Error("token accepted with wrong secret")
+	}
+	old, _ := IssueToken(secret, 42, 3, time.Now().Add(-8*24*time.Hour))
+	if _, err := ParseToken(secret, old); err == nil {
+		t.Error("expired token accepted")
+	}
+}
+
+func TestPasswordAndCSRF(t *testing.T) {
+	h, err := HashPassword("hunter22")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !CheckPassword(h, "hunter22") || CheckPassword(h, "hunter23") {
+		t.Error("password check wrong")
+	}
+	secret := []byte("s")
+	tok := CSRFToken(secret, 1, 0)
+	if !CheckCSRF(secret, 1, 0, tok) {
+		t.Error("valid csrf rejected")
+	}
+	if CheckCSRF(secret, 1, 1, tok) || CheckCSRF(secret, 2, 0, tok) || CheckCSRF(secret, 1, 0, "") {
+		t.Error("invalid csrf accepted")
+	}
+}