v0.25.1
This commit is contained in:
Mateusz Gruszczyński committed
1 parent
87e571c170
commit
fa7abc9e53
308 files changed
+49746
-50237
No files matched your search
+1
-14
@@ -127,17 +127,4 @@ pub fn prepare_database(path: &Path) -> Result<()> {
|
||||
Ok(())
|
||||
}
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
#[test]
|
||||
fn setup_token_can_be_generated_before_database_or_server() {
|
||||
let dir = tempfile::tempdir().unwrap();
|
||||
let first = load_or_create_setup_token(dir.path()).unwrap();
|
||||
assert_eq!(first.len(), 64);
|
||||
assert!(first.bytes().all(|b| b.is_ascii_hexdigit()));
|
||||
assert!(!dir.path().join("config.sqlite3").exists());
|
||||
assert_eq!(load_or_create_setup_token(dir.path()).unwrap(), first);
|
||||
assert_eq!(load_setup_token(dir.path()).unwrap(), first);
|
||||
}
|
||||
}
|
||||
include!("files/tests.rs");
|
||||
@@ -0,0 +1,14 @@
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
#[test]
|
||||
fn setup_token_can_be_generated_before_database_or_server() {
|
||||
let dir = tempfile::tempdir().unwrap();
|
||||
let first = load_or_create_setup_token(dir.path()).unwrap();
|
||||
assert_eq!(first.len(), 64);
|
||||
assert!(first.bytes().all(|b| b.is_ascii_hexdigit()));
|
||||
assert!(!dir.path().join("config.sqlite3").exists());
|
||||
assert_eq!(load_or_create_setup_token(dir.path()).unwrap(), first);
|
||||
assert_eq!(load_setup_token(dir.path()).unwrap(), first);
|
||||
}
|
||||
}
|
||||
+1
-232
@@ -321,235 +321,4 @@ impl Auth {
|
||||
}
|
||||
}
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
#[test]
|
||||
fn accepts_independent_argon2id_fixture() {
|
||||
let fixture: serde_json::Value =
|
||||
serde_json::from_str(include_str!("../../tests/fixtures/argon2id.json")).unwrap();
|
||||
assert!(verify_sync(
|
||||
fixture["password"].as_str().unwrap(),
|
||||
fixture["hash"].as_str().unwrap()
|
||||
));
|
||||
assert!(!verify_sync(
|
||||
"incorrect fixture password",
|
||||
fixture["hash"].as_str().unwrap()
|
||||
));
|
||||
}
|
||||
#[test]
|
||||
fn password_and_username_policy() {
|
||||
assert_eq!(username(" Owner.Name ").unwrap(), "owner.name");
|
||||
assert!(username("a").is_err());
|
||||
assert!(username("a b").is_err());
|
||||
assert!(validate_password("a sufficiently long password").is_ok());
|
||||
assert!(validate_password("admin").is_err());
|
||||
assert!(validate_password(&"a".repeat(129)).is_err());
|
||||
}
|
||||
#[test]
|
||||
fn cookies_reject_ambiguity_and_tokens_are_hashed() {
|
||||
let s = random_secret();
|
||||
let mut headers = HeaderMap::new();
|
||||
headers.insert(COOKIE, format!("{COOKIE_NAME}={s}").parse().unwrap());
|
||||
assert_eq!(cookie_secret(&headers), Some(s.clone()));
|
||||
headers.append(COOKIE, format!("{COOKIE_NAME}={s}").parse().unwrap());
|
||||
assert!(cookie_secret(&headers).is_none());
|
||||
assert_ne!(secret_hash(&s), s);
|
||||
assert_eq!(secret_hash(&s).len(), 64);
|
||||
}
|
||||
#[tokio::test]
|
||||
async fn passwords_are_argon2id_salted_and_verifiable() {
|
||||
let password = "correct horse battery staple";
|
||||
let a = hash_password_offline(password.into()).await.unwrap();
|
||||
let b = hash_password_offline(password.into()).await.unwrap();
|
||||
assert!(a.starts_with("$argon2id$v=19$m=19456,t=2,p=1$"));
|
||||
assert_ne!(a, b);
|
||||
assert!(verify_sync(password, &a));
|
||||
assert!(!verify_sync("incorrect", &a));
|
||||
}
|
||||
#[tokio::test]
|
||||
async fn setup_race_creates_exactly_one_admin() {
|
||||
let dir = tempfile::tempdir().unwrap();
|
||||
let store = Store::open(&dir.path().join("db"), &crate::config::Config::default())
|
||||
.await
|
||||
.unwrap();
|
||||
let (a, b) = tokio::join!(
|
||||
store.initialize_admin("one", "test-hash", "test"),
|
||||
store.initialize_admin("two", "test-hash", "test")
|
||||
);
|
||||
assert_eq!(a.unwrap() as u8 + b.unwrap() as u8, 1);
|
||||
assert_eq!(store.recent_audit().await.unwrap().len(), 1);
|
||||
store.close().await;
|
||||
}
|
||||
#[tokio::test]
|
||||
async fn sessions_expire_rotate_and_reset_blocks_old_login_generation() {
|
||||
let dir = tempfile::tempdir().unwrap();
|
||||
let store = Store::open(&dir.path().join("db"), &crate::config::Config::default())
|
||||
.await
|
||||
.unwrap();
|
||||
store
|
||||
.initialize_admin("owner", "test-hash", "test")
|
||||
.await
|
||||
.unwrap();
|
||||
let first = store
|
||||
.create_session(1, "browser", None)
|
||||
.await
|
||||
.unwrap()
|
||||
.unwrap();
|
||||
assert!(store
|
||||
.session_at(&first.secret, now())
|
||||
.await
|
||||
.unwrap()
|
||||
.is_some());
|
||||
let next = store
|
||||
.create_session(1, "browser", Some(&first.secret))
|
||||
.await
|
||||
.unwrap()
|
||||
.unwrap();
|
||||
assert!(store
|
||||
.session_at(&first.secret, now())
|
||||
.await
|
||||
.unwrap()
|
||||
.is_none());
|
||||
assert!(store
|
||||
.session_at(&next.secret, now() + IDLE_SECONDS + 1)
|
||||
.await
|
||||
.unwrap()
|
||||
.is_none());
|
||||
let alive = store
|
||||
.create_session(1, "browser", None)
|
||||
.await
|
||||
.unwrap()
|
||||
.unwrap();
|
||||
assert!(store
|
||||
.reset_admin_password("new-hash", 1, "test")
|
||||
.await
|
||||
.unwrap());
|
||||
assert!(store
|
||||
.session_at(&alive.secret, now())
|
||||
.await
|
||||
.unwrap()
|
||||
.is_none());
|
||||
assert!(store
|
||||
.create_session(1, "browser", None)
|
||||
.await
|
||||
.unwrap()
|
||||
.is_none());
|
||||
assert!(store
|
||||
.create_session(2, "browser", None)
|
||||
.await
|
||||
.unwrap()
|
||||
.is_some());
|
||||
store.close().await;
|
||||
}
|
||||
#[test]
|
||||
fn session_cookie_uses_configured_remaining_lifetime() {
|
||||
let cookie = session_cookie("abc", true, 7 * 24 * 60 * 60);
|
||||
assert!(cookie.contains("Max-Age=604800"));
|
||||
assert!(cookie.ends_with("; Secure"));
|
||||
let short = session_cookie("abc", false, 0);
|
||||
assert!(short.contains("Max-Age=1"));
|
||||
assert!(!short.contains("; Secure"));
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn browser_session_lifetime_is_configurable_without_sliding_expiry() {
|
||||
const DAY: i64 = 24 * 60 * 60;
|
||||
let dir = tempfile::tempdir().unwrap();
|
||||
let store = Store::open(&dir.path().join("db"), &crate::config::Config::default())
|
||||
.await
|
||||
.unwrap();
|
||||
store
|
||||
.initialize_admin("owner", "test-hash", "test")
|
||||
.await
|
||||
.unwrap();
|
||||
|
||||
assert!(store
|
||||
.create_browser_session(1, None, 6 * DAY)
|
||||
.await
|
||||
.is_err());
|
||||
assert!(store
|
||||
.create_browser_session(1, None, 31 * DAY)
|
||||
.await
|
||||
.is_err());
|
||||
|
||||
let issued = store
|
||||
.create_browser_session(1, None, 7 * DAY)
|
||||
.await
|
||||
.unwrap()
|
||||
.unwrap();
|
||||
let seven_day_expiry = issued.session.expires_at;
|
||||
let extended = store
|
||||
.session_at_with_browser_lifetime(&issued.secret, now(), 30 * DAY)
|
||||
.await
|
||||
.unwrap()
|
||||
.unwrap();
|
||||
assert_eq!(extended.expires_at, seven_day_expiry + 23 * DAY);
|
||||
|
||||
let checked_again = store
|
||||
.session_at_with_browser_lifetime(&issued.secret, seven_day_expiry + DAY, 30 * DAY)
|
||||
.await
|
||||
.unwrap()
|
||||
.unwrap();
|
||||
assert_eq!(checked_again.expires_at, extended.expires_at);
|
||||
assert!(store
|
||||
.session_at_with_browser_lifetime(&issued.secret, extended.expires_at, 30 * DAY,)
|
||||
.await
|
||||
.unwrap()
|
||||
.is_none());
|
||||
store.close().await;
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn throttle_is_persistent_bounded_and_recovers() {
|
||||
let dir = tempfile::tempdir().unwrap();
|
||||
let file = dir.path().join("db");
|
||||
let store = Store::open(&file, &crate::config::Config::default())
|
||||
.await
|
||||
.unwrap();
|
||||
for _ in 0..10 {
|
||||
assert!(store.consume_auth_attempt(1000).await.unwrap());
|
||||
}
|
||||
assert!(!store.consume_auth_attempt(1001).await.unwrap());
|
||||
store.close().await;
|
||||
let store = Store::open(&file, &crate::config::Config::default())
|
||||
.await
|
||||
.unwrap();
|
||||
assert!(!store.consume_auth_attempt(1020).await.unwrap());
|
||||
assert!(store.consume_auth_attempt(1060).await.unwrap());
|
||||
store.close().await;
|
||||
}
|
||||
#[tokio::test]
|
||||
async fn browser_session_count_is_bounded() {
|
||||
let dir = tempfile::tempdir().unwrap();
|
||||
let store = Store::open(&dir.path().join("db"), &crate::config::Config::default())
|
||||
.await
|
||||
.unwrap();
|
||||
store
|
||||
.initialize_admin("owner", "test-hash", "test")
|
||||
.await
|
||||
.unwrap();
|
||||
let first = store
|
||||
.create_session(1, "browser", None)
|
||||
.await
|
||||
.unwrap()
|
||||
.unwrap();
|
||||
for _ in 0..20 {
|
||||
store
|
||||
.create_session(1, "browser", None)
|
||||
.await
|
||||
.unwrap()
|
||||
.unwrap();
|
||||
}
|
||||
let count: i64 = sqlx::query_scalar("SELECT count(*) FROM admin_sessions")
|
||||
.fetch_one(&store.pool)
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(count, 16);
|
||||
assert!(store
|
||||
.session_at(&first.secret, now())
|
||||
.await
|
||||
.unwrap()
|
||||
.is_none());
|
||||
store.close().await;
|
||||
}
|
||||
}
|
||||
include!("tests.rs");
|
||||
@@ -0,0 +1,232 @@
|
||||
mod tests {
|
||||
use super::*;
|
||||
#[test]
|
||||
fn accepts_independent_argon2id_fixture() {
|
||||
let fixture: serde_json::Value =
|
||||
serde_json::from_str(include_str!("../../tests/fixtures/argon2id.json")).unwrap();
|
||||
assert!(verify_sync(
|
||||
fixture["password"].as_str().unwrap(),
|
||||
fixture["hash"].as_str().unwrap()
|
||||
));
|
||||
assert!(!verify_sync(
|
||||
"incorrect fixture password",
|
||||
fixture["hash"].as_str().unwrap()
|
||||
));
|
||||
}
|
||||
#[test]
|
||||
fn password_and_username_policy() {
|
||||
assert_eq!(username(" Owner.Name ").unwrap(), "owner.name");
|
||||
assert!(username("a").is_err());
|
||||
assert!(username("a b").is_err());
|
||||
assert!(validate_password("a sufficiently long password").is_ok());
|
||||
assert!(validate_password("admin").is_err());
|
||||
assert!(validate_password(&"a".repeat(129)).is_err());
|
||||
}
|
||||
#[test]
|
||||
fn cookies_reject_ambiguity_and_tokens_are_hashed() {
|
||||
let s = random_secret();
|
||||
let mut headers = HeaderMap::new();
|
||||
headers.insert(COOKIE, format!("{COOKIE_NAME}={s}").parse().unwrap());
|
||||
assert_eq!(cookie_secret(&headers), Some(s.clone()));
|
||||
headers.append(COOKIE, format!("{COOKIE_NAME}={s}").parse().unwrap());
|
||||
assert!(cookie_secret(&headers).is_none());
|
||||
assert_ne!(secret_hash(&s), s);
|
||||
assert_eq!(secret_hash(&s).len(), 64);
|
||||
}
|
||||
#[tokio::test]
|
||||
async fn passwords_are_argon2id_salted_and_verifiable() {
|
||||
let password = "correct horse battery staple";
|
||||
let a = hash_password_offline(password.into()).await.unwrap();
|
||||
let b = hash_password_offline(password.into()).await.unwrap();
|
||||
assert!(a.starts_with("$argon2id$v=19$m=19456,t=2,p=1$"));
|
||||
assert_ne!(a, b);
|
||||
assert!(verify_sync(password, &a));
|
||||
assert!(!verify_sync("incorrect", &a));
|
||||
}
|
||||
#[tokio::test]
|
||||
async fn setup_race_creates_exactly_one_admin() {
|
||||
let dir = tempfile::tempdir().unwrap();
|
||||
let store = Store::open(&dir.path().join("db"), &crate::config::Config::default())
|
||||
.await
|
||||
.unwrap();
|
||||
let (a, b) = tokio::join!(
|
||||
store.initialize_admin("one", "test-hash", "test"),
|
||||
store.initialize_admin("two", "test-hash", "test")
|
||||
);
|
||||
assert_eq!(a.unwrap() as u8 + b.unwrap() as u8, 1);
|
||||
assert_eq!(store.recent_audit().await.unwrap().len(), 1);
|
||||
store.close().await;
|
||||
}
|
||||
#[tokio::test]
|
||||
async fn sessions_expire_rotate_and_reset_blocks_old_login_generation() {
|
||||
let dir = tempfile::tempdir().unwrap();
|
||||
let store = Store::open(&dir.path().join("db"), &crate::config::Config::default())
|
||||
.await
|
||||
.unwrap();
|
||||
store
|
||||
.initialize_admin("owner", "test-hash", "test")
|
||||
.await
|
||||
.unwrap();
|
||||
let first = store
|
||||
.create_session(1, "browser", None)
|
||||
.await
|
||||
.unwrap()
|
||||
.unwrap();
|
||||
assert!(store
|
||||
.session_at(&first.secret, now())
|
||||
.await
|
||||
.unwrap()
|
||||
.is_some());
|
||||
let next = store
|
||||
.create_session(1, "browser", Some(&first.secret))
|
||||
.await
|
||||
.unwrap()
|
||||
.unwrap();
|
||||
assert!(store
|
||||
.session_at(&first.secret, now())
|
||||
.await
|
||||
.unwrap()
|
||||
.is_none());
|
||||
assert!(store
|
||||
.session_at(&next.secret, now() + IDLE_SECONDS + 1)
|
||||
.await
|
||||
.unwrap()
|
||||
.is_none());
|
||||
let alive = store
|
||||
.create_session(1, "browser", None)
|
||||
.await
|
||||
.unwrap()
|
||||
.unwrap();
|
||||
assert!(store
|
||||
.reset_admin_password("new-hash", 1, "test")
|
||||
.await
|
||||
.unwrap());
|
||||
assert!(store
|
||||
.session_at(&alive.secret, now())
|
||||
.await
|
||||
.unwrap()
|
||||
.is_none());
|
||||
assert!(store
|
||||
.create_session(1, "browser", None)
|
||||
.await
|
||||
.unwrap()
|
||||
.is_none());
|
||||
assert!(store
|
||||
.create_session(2, "browser", None)
|
||||
.await
|
||||
.unwrap()
|
||||
.is_some());
|
||||
store.close().await;
|
||||
}
|
||||
#[test]
|
||||
fn session_cookie_uses_configured_remaining_lifetime() {
|
||||
let cookie = session_cookie("abc", true, 7 * 24 * 60 * 60);
|
||||
assert!(cookie.contains("Max-Age=604800"));
|
||||
assert!(cookie.ends_with("; Secure"));
|
||||
let short = session_cookie("abc", false, 0);
|
||||
assert!(short.contains("Max-Age=1"));
|
||||
assert!(!short.contains("; Secure"));
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn browser_session_lifetime_is_configurable_without_sliding_expiry() {
|
||||
const DAY: i64 = 24 * 60 * 60;
|
||||
let dir = tempfile::tempdir().unwrap();
|
||||
let store = Store::open(&dir.path().join("db"), &crate::config::Config::default())
|
||||
.await
|
||||
.unwrap();
|
||||
store
|
||||
.initialize_admin("owner", "test-hash", "test")
|
||||
.await
|
||||
.unwrap();
|
||||
|
||||
assert!(store
|
||||
.create_browser_session(1, None, 6 * DAY)
|
||||
.await
|
||||
.is_err());
|
||||
assert!(store
|
||||
.create_browser_session(1, None, 31 * DAY)
|
||||
.await
|
||||
.is_err());
|
||||
|
||||
let issued = store
|
||||
.create_browser_session(1, None, 7 * DAY)
|
||||
.await
|
||||
.unwrap()
|
||||
.unwrap();
|
||||
let seven_day_expiry = issued.session.expires_at;
|
||||
let extended = store
|
||||
.session_at_with_browser_lifetime(&issued.secret, now(), 30 * DAY)
|
||||
.await
|
||||
.unwrap()
|
||||
.unwrap();
|
||||
assert_eq!(extended.expires_at, seven_day_expiry + 23 * DAY);
|
||||
|
||||
let checked_again = store
|
||||
.session_at_with_browser_lifetime(&issued.secret, seven_day_expiry + DAY, 30 * DAY)
|
||||
.await
|
||||
.unwrap()
|
||||
.unwrap();
|
||||
assert_eq!(checked_again.expires_at, extended.expires_at);
|
||||
assert!(store
|
||||
.session_at_with_browser_lifetime(&issued.secret, extended.expires_at, 30 * DAY,)
|
||||
.await
|
||||
.unwrap()
|
||||
.is_none());
|
||||
store.close().await;
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn throttle_is_persistent_bounded_and_recovers() {
|
||||
let dir = tempfile::tempdir().unwrap();
|
||||
let file = dir.path().join("db");
|
||||
let store = Store::open(&file, &crate::config::Config::default())
|
||||
.await
|
||||
.unwrap();
|
||||
for _ in 0..10 {
|
||||
assert!(store.consume_auth_attempt(1000).await.unwrap());
|
||||
}
|
||||
assert!(!store.consume_auth_attempt(1001).await.unwrap());
|
||||
store.close().await;
|
||||
let store = Store::open(&file, &crate::config::Config::default())
|
||||
.await
|
||||
.unwrap();
|
||||
assert!(!store.consume_auth_attempt(1020).await.unwrap());
|
||||
assert!(store.consume_auth_attempt(1060).await.unwrap());
|
||||
store.close().await;
|
||||
}
|
||||
#[tokio::test]
|
||||
async fn browser_session_count_is_bounded() {
|
||||
let dir = tempfile::tempdir().unwrap();
|
||||
let store = Store::open(&dir.path().join("db"), &crate::config::Config::default())
|
||||
.await
|
||||
.unwrap();
|
||||
store
|
||||
.initialize_admin("owner", "test-hash", "test")
|
||||
.await
|
||||
.unwrap();
|
||||
let first = store
|
||||
.create_session(1, "browser", None)
|
||||
.await
|
||||
.unwrap()
|
||||
.unwrap();
|
||||
for _ in 0..20 {
|
||||
store
|
||||
.create_session(1, "browser", None)
|
||||
.await
|
||||
.unwrap()
|
||||
.unwrap();
|
||||
}
|
||||
let count: i64 = sqlx::query_scalar("SELECT count(*) FROM admin_sessions")
|
||||
.fetch_one(&store.pool)
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(count, 16);
|
||||
assert!(store
|
||||
.session_at(&first.secret, now())
|
||||
.await
|
||||
.unwrap()
|
||||
.is_none());
|
||||
store.close().await;
|
||||
}
|
||||
}
|
||||
Reference in new issue
Block a user