54 lines
1.6 KiB
Go
54 lines
1.6 KiB
Go
|
package emission
|
||
|
|
|
||
|
|
import (
|
||
|
|
"bytes"
|
||
|
|
"crypto/ed25519"
|
||
|
|
"encoding/json"
|
||
|
|
"github.com/netkingdom/access-engine/internal/sign"
|
||
|
|
"github.com/netkingdom/access-engine/pkg/api"
|
||
|
|
"testing"
|
||
|
|
)
|
||
|
|
|
||
|
|
func TestOutboxReplayPreservesProducerNumericSignature(t *testing.T) {
|
||
|
|
folder := t.TempDir()
|
||
|
|
outbox, err := Open(folder, "synthetic-source")
|
||
|
|
if err != nil {
|
||
|
|
t.Fatal(err)
|
||
|
|
}
|
||
|
|
key := ed25519.NewKeyFromSeed(bytes.Repeat([]byte{21}, 32))
|
||
|
|
envelope := api.DecisionEnvelope{ID: "decision:synthetic-numeric", Effect: api.DecisionEffectDeny, Resource: api.ResourceRef{ID: "synthetic", Type: "tenant", System: "tenant-engine"}}
|
||
|
|
envelope.Binding = &api.DecisionBinding{Context: map[string]any{"float": json.Number("1.0"), "negative_zero": json.Number("-0.0"), "integer": json.Number("9007199254740993"), "exponent": json.Number("1e-07")}}
|
||
|
|
if err := sign.Sign(&envelope, key, "synthetic-numeric"); err != nil {
|
||
|
|
t.Fatal(err)
|
||
|
|
}
|
||
|
|
if err := outbox.Append(envelope); err != nil {
|
||
|
|
t.Fatal(err)
|
||
|
|
}
|
||
|
|
outbox.Close()
|
||
|
|
outbox, err = Open(folder, "synthetic-source")
|
||
|
|
if err != nil {
|
||
|
|
t.Fatal(err)
|
||
|
|
}
|
||
|
|
defer outbox.Close()
|
||
|
|
entry, _, err := outbox.nextEntry()
|
||
|
|
if err != nil {
|
||
|
|
t.Fatal(err)
|
||
|
|
}
|
||
|
|
wire, err := json.Marshal(entry.Event.Data)
|
||
|
|
if err != nil {
|
||
|
|
t.Fatal(err)
|
||
|
|
}
|
||
|
|
replayed, err := sign.DecodeEnvelope(wire)
|
||
|
|
if err != nil {
|
||
|
|
t.Fatal(err)
|
||
|
|
}
|
||
|
|
if err := sign.Verify(replayed, map[string]ed25519.PublicKey{"synthetic-numeric": key.Public().(ed25519.PublicKey)}); err != nil {
|
||
|
|
t.Fatal(err)
|
||
|
|
}
|
||
|
|
before, _ := sign.CanonicalBytes(envelope)
|
||
|
|
after, _ := sign.CanonicalBytes(replayed)
|
||
|
|
if !bytes.Equal(before, after) {
|
||
|
|
t.Fatal("replayed signed bytes changed")
|
||
|
|
}
|
||
|
|
}
|