abrown38andClaude Opus 5.5
3c0808591f
Subnets served per interface, pools, reservations, options at three levels, leases in SQLite saved before the ACK, ping and decline conflict checks, validated changes with history and undo, users and tokens, an audit log, a Kea importer, a sandboxed systemd unit and Debian packages. Tested with real udhcpc and dhcpcd clients in Docker (scripts/e2e.sh). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
54 lines
1.6 KiB
Go
54 lines
1.6 KiB
Go
package auth
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"steward/internal/model"
|
|
)
|
|
|
|
func TestPasswords(t *testing.T) {
|
|
h, err := HashPassword("correct horse")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if !CheckPassword(h, "correct horse") || CheckPassword(h, "wrong horse") || CheckPassword("", "") {
|
|
t.Error("password check")
|
|
}
|
|
if _, err := HashPassword("short"); err == nil {
|
|
t.Error("short password accepted")
|
|
}
|
|
}
|
|
|
|
func TestTokens(t *testing.T) {
|
|
tok, pid, hash := NewToken()
|
|
gotPID, secret, err := ParseToken(tok)
|
|
if err != nil || gotPID != pid || !CheckSecret(secret, hash) {
|
|
t.Fatalf("token %q: %v", tok, err)
|
|
}
|
|
if _, _, err := ParseToken("jarl_abc_def"); err == nil {
|
|
t.Error("a Jarl token was accepted")
|
|
}
|
|
}
|
|
|
|
func TestPermissions(t *testing.T) {
|
|
op := &model.User{Username: "op", Grants: Roles["operator"]}
|
|
p := &Principal{User: op}
|
|
if !p.Can(ResConfig, true) || !p.Can(ResAudit, false) || p.Can(ResAudit, true) || p.IsAdmin() {
|
|
t.Error("operator")
|
|
}
|
|
admin := &model.User{Username: "admin", Admin: true}
|
|
p = &Principal{User: admin, Token: &model.Token{Grants: []model.Grant{{Resource: ResLeases, Access: Read}}}}
|
|
if !p.Can(ResLeases, false) || p.Can(ResLeases, true) || p.Can(ResConfig, false) || p.IsAdmin() {
|
|
t.Error("restricted admin token")
|
|
}
|
|
if !Narrower(Roles["leases"], Roles["operator"]) || Narrower(Roles["operator"], Roles["viewer"]) {
|
|
t.Error("narrower")
|
|
}
|
|
if _, err := ParseGrant("leases"); err == nil {
|
|
t.Error("grant without access accepted")
|
|
}
|
|
if g, err := ParseGrant("Config:Write"); err != nil || g.Resource != "config" {
|
|
t.Errorf("grant %v %v", g, err)
|
|
}
|
|
}
|