HoneyandClaude Opus 5
31a027c93a
Go-Backend (chi, pgx, golang-migrate) + React/TS-Frontend als PWA. Enthalten: Auth inkl. OIDC, Dateien mit Versionen und Papierkorb, Freigaben (Links + intern), WebDAV, Gruppenordner, Admin/Theming, Volltextsuche mit OCR, eigener PDF-Betrachter und WOPI-Office (Collabora/OnlyOffice). Nicht im Repo: deploy/.env (Sitzungsschlüssel, DB- und Admin-Passwort) sowie alle Daten- und Build-Verzeichnisse – siehe .gitignore. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
67 lines
1.7 KiB
Go
67 lines
1.7 KiB
Go
package auth
|
||
|
||
import (
|
||
"strings"
|
||
"testing"
|
||
)
|
||
|
||
func TestGenerateAppPasswordFormat(t *testing.T) {
|
||
token, err := GenerateAppPassword()
|
||
if err != nil {
|
||
t.Fatalf("GenerateAppPassword: %v", err)
|
||
}
|
||
|
||
groups := strings.Split(token, "-")
|
||
if len(groups) != appPasswordGroups {
|
||
t.Fatalf("got %d groups, want %d (%q)", len(groups), appPasswordGroups, token)
|
||
}
|
||
for _, g := range groups {
|
||
if len(g) != appPasswordGroupLen {
|
||
t.Fatalf("group %q has length %d, want %d", g, len(g), appPasswordGroupLen)
|
||
}
|
||
for _, c := range g {
|
||
if !strings.ContainsRune(appPasswordAlphabet, c) {
|
||
t.Fatalf("character %q is outside the alphabet – hard to type on a phone", c)
|
||
}
|
||
}
|
||
}
|
||
}
|
||
|
||
func TestGenerateAppPasswordIsRandom(t *testing.T) {
|
||
seen := make(map[string]bool, 100)
|
||
for i := 0; i < 100; i++ {
|
||
token, err := GenerateAppPassword()
|
||
if err != nil {
|
||
t.Fatalf("GenerateAppPassword: %v", err)
|
||
}
|
||
if seen[token] {
|
||
t.Fatalf("duplicate token after %d draws: %q", i, token)
|
||
}
|
||
seen[token] = true
|
||
}
|
||
}
|
||
|
||
// Der Klartext darf nie gespeichert werden – gehasht wird deterministisch,
|
||
// damit der Login ein reiner Index-Lookup bleibt.
|
||
func TestHashAppPassword(t *testing.T) {
|
||
const token = "abcde-fghij-klmno-pqrst-uvwxy"
|
||
|
||
h := HashAppPassword(token)
|
||
if h == token || strings.Contains(h, token) {
|
||
t.Fatal("hash leaks the plaintext token")
|
||
}
|
||
if len(h) != 64 {
|
||
t.Fatalf("hash length = %d, want 64 hex chars", len(h))
|
||
}
|
||
if h != HashAppPassword(token) {
|
||
t.Fatal("hash is not deterministic")
|
||
}
|
||
if h == HashAppPassword("abcde-fghij-klmno-pqrst-uvwxz") {
|
||
t.Fatal("different tokens hash to the same value")
|
||
}
|
||
// Clients hängen beim Kopieren gern Whitespace an.
|
||
if h != HashAppPassword(" "+token+"\n") {
|
||
t.Fatal("surrounding whitespace changes the hash")
|
||
}
|
||
}
|