WeKnora deployment source with the reviewed wiki identity, summary and recovery fixes

internal/im/wecom/webhook_adapter_test.go

@@ -0,0 +1,85 @@
+package wecom
+
+import (
+	"bytes"
+	"crypto/aes"
+	"crypto/cipher"
+	"encoding/base64"
+	"encoding/binary"
+	"testing"
+)
+
+func TestWebhookAdapterDecryptPadding(t *testing.T) {
+	key := []byte("0123456789abcdef0123456789abcdef")
+	corpID := "ww_corp_id"
+	adapter := &WebhookAdapter{aesKey: key, corpID: corpID}
+
+	tests := []struct {
+		name       string
+		message    string
+		wantPadLen int
+	}{
+		{
+			name:       "padding below AES block size",
+			message:    "message with seven-byte pad",
+			wantPadLen: 7,
+		},
+		{
+			name:       "padding above AES block size",
+			message:    "message with 19",
+			wantPadLen: 19,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			encrypted, padLen := encryptWeComTestPayload(t, key, corpID, []byte(tt.message))
+			if padLen != tt.wantPadLen {
+				t.Fatalf("test fixture padding = %d, want %d", padLen, tt.wantPadLen)
+			}
+
+			got, err := adapter.decrypt(encrypted)
+			if err != nil {
+				t.Fatalf("decrypt() error = %v", err)
+			}
+			if !bytes.Equal(got, []byte(tt.message)) {
+				t.Fatalf("decrypt() = %q, want %q", got, tt.message)
+			}
+		})
+	}
+}
+
+func TestWebhookAdapterDecryptRejectsNonBlockAlignedCiphertext(t *testing.T) {
+	adapter := &WebhookAdapter{
+		aesKey: []byte("0123456789abcdef0123456789abcdef"),
+		corpID: "ww_corp_id",
+	}
+	encrypted := base64.StdEncoding.EncodeToString(make([]byte, aes.BlockSize+1))
+
+	if _, err := adapter.decrypt(encrypted); err == nil {
+		t.Fatal("decrypt() succeeded for ciphertext with a non-block-aligned length")
+	}
+}
+
+func encryptWeComTestPayload(t *testing.T, key []byte, corpID string, message []byte) (string, int) {
+	t.Helper()
+
+	plaintext := make([]byte, 16)
+	messageLength := make([]byte, 4)
+	binary.BigEndian.PutUint32(messageLength, uint32(len(message)))
+	plaintext = append(plaintext, messageLength...)
+	plaintext = append(plaintext, message...)
+	plaintext = append(plaintext, []byte(corpID)...)
+
+	padLen := wecomPKCS7BlockSize - len(plaintext)%wecomPKCS7BlockSize
+	plaintext = append(plaintext, bytes.Repeat([]byte{byte(padLen)}, padLen)...)
+
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		t.Fatalf("new cipher: %v", err)
+	}
+
+	ciphertext := make([]byte, len(plaintext))
+	cipher.NewCBCEncrypter(block, key[:aes.BlockSize]).CryptBlocks(ciphertext, plaintext)
+	return base64.StdEncoding.EncodeToString(ciphertext), padLen
+}