104 lines
3.6 KiB
Go
104 lines
3.6 KiB
Go
|
package service
|
|||
|
|
|
|||
|
|
import (
|
|||
|
|
"context"
|
|||
|
|
"errors"
|
|||
|
|
"strings"
|
|||
|
|
"testing"
|
|||
|
|
|
|||
|
|
"github.com/Tencent/WeKnora/internal/config"
|
|||
|
|
"github.com/Tencent/WeKnora/internal/types/interfaces"
|
|||
|
|
)
|
|||
|
|
|
|||
|
|
type stubComplexPasswordSettings struct {
|
|||
|
|
interfaces.SystemSettingService
|
|||
|
|
enabled bool
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
func (s *stubComplexPasswordSettings) GetBool(context.Context, string, string, bool) bool {
|
|||
|
|
return s.enabled
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
func TestValidatePasswordPolicy(t *testing.T) {
|
|||
|
|
t.Parallel()
|
|||
|
|
|
|||
|
|
cases := []struct {
|
|||
|
|
name string
|
|||
|
|
password string
|
|||
|
|
complex bool
|
|||
|
|
want error
|
|||
|
|
}{
|
|||
|
|
{name: "simple letters only", password: "password"},
|
|||
|
|
{name: "simple minimum length", password: "abc"},
|
|||
|
|
{name: "simple digits only", password: "123"},
|
|||
|
|
{name: "simple too short", password: "ab", want: ErrPasswordPolicy},
|
|||
|
|
{name: "simple empty", password: "", want: ErrPasswordPolicy},
|
|||
|
|
{name: "simple too long", password: "Abcdefg1" + "xxxxxxxxxxxxxxxxxxxxxxxxx", want: ErrPasswordPolicy},
|
|||
|
|
{name: "simple ok", password: "password1"},
|
|||
|
|
{name: "simple Unicode minimum", password: "三个字"},
|
|||
|
|
{name: "simple Unicode too short", password: "两字", want: ErrPasswordPolicy},
|
|||
|
|
{name: "simple invalid UTF8", password: "ab\xff", want: ErrPasswordPolicy},
|
|||
|
|
{name: "simple maximum length", password: strings.Repeat("x", 32)},
|
|||
|
|
{name: "bcrypt byte boundary", password: strings.Repeat("字", 24)},
|
|||
|
|
{name: "bcrypt byte overflow", password: strings.Repeat("字", 24) + "x", want: ErrPasswordPolicy},
|
|||
|
|
{name: "complex too short", password: "Ab1!", complex: true, want: ErrComplexPasswordPolicy},
|
|||
|
|
{name: "complex missing special", password: "NewSecure9", complex: true, want: ErrComplexPasswordPolicy},
|
|||
|
|
{name: "complex missing upper", password: "newsecure9!", complex: true, want: ErrComplexPasswordPolicy},
|
|||
|
|
{name: "complex missing lower", password: "NEWSECURE9!", complex: true, want: ErrComplexPasswordPolicy},
|
|||
|
|
{name: "complex ok", password: "NewSecure9!", complex: true},
|
|||
|
|
{
|
|||
|
|
name: "complex unicode digit is not ASCII",
|
|||
|
|
password: "Password١!",
|
|||
|
|
complex: true,
|
|||
|
|
want: ErrComplexPasswordPolicy,
|
|||
|
|
},
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
for _, tc := range cases {
|
|||
|
|
t.Run(tc.name, func(t *testing.T) {
|
|||
|
|
err := ValidatePasswordPolicy(tc.password, tc.complex)
|
|||
|
|
if !errors.Is(err, tc.want) {
|
|||
|
|
t.Fatalf("ValidatePasswordPolicy(%q, %v) err = %v, want %v", tc.password, tc.complex, err, tc.want)
|
|||
|
|
}
|
|||
|
|
})
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
func TestResolveComplexPasswordEnabled(t *testing.T) {
|
|||
|
|
t.Parallel()
|
|||
|
|
|
|||
|
|
ctx := context.Background()
|
|||
|
|
|
|||
|
|
if got := ResolveComplexPasswordEnabled(ctx, nil, nil); got {
|
|||
|
|
t.Fatal("nil cfg and settings should default to false")
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// The previous copy-paste checked cfg.Tenant; Auth-only configs must still work.
|
|||
|
|
cfgAuthOnly := &config.Config{Auth: &config.AuthConfig{ComplexPasswordEnabled: true}}
|
|||
|
|
if !ResolveComplexPasswordEnabled(ctx, cfgAuthOnly, nil) {
|
|||
|
|
t.Fatal("Auth.ComplexPasswordEnabled should be honoured when Tenant is nil")
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
cfgTenantOnly := &config.Config{Tenant: &config.TenantConfig{}}
|
|||
|
|
if got := ResolveComplexPasswordEnabled(ctx, cfgTenantOnly, nil); got {
|
|||
|
|
t.Fatal("Tenant-only cfg must not panic or enable the switch")
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
if !ResolveComplexPasswordEnabled(ctx, cfgAuthOnly, &stubComplexPasswordSettings{enabled: true}) {
|
|||
|
|
t.Fatal("settings override true")
|
|||
|
|
}
|
|||
|
|
if ResolveComplexPasswordEnabled(ctx, cfgAuthOnly, &stubComplexPasswordSettings{enabled: false}) {
|
|||
|
|
t.Fatal("settings override false should win over cfg")
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
func TestIsPasswordPolicyError(t *testing.T) {
|
|||
|
|
t.Parallel()
|
|||
|
|
if !IsPasswordPolicyError(ErrPasswordPolicy) || !IsPasswordPolicyError(ErrComplexPasswordPolicy) {
|
|||
|
|
t.Fatal("policy sentinels should match")
|
|||
|
|
}
|
|||
|
|
if IsPasswordPolicyError(ErrSamePassword) {
|
|||
|
|
t.Fatal("unrelated sentinel must not match")
|
|||
|
|
}
|
|||
|
|
}
|