tegwick
127f83da4d
Detached Ed25519 over the canonical envelope with signature omitted. Unsigned is stated, not implied. Testdata fixtures prove verify and tamper failure without minting a production key. FLEX-WP-0025 is finished with the validate check from the previous commit. Assistant: grok Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267
45 lines
1.2 KiB
Go
45 lines
1.2 KiB
Go
package sign_test
|
|
|
|
import (
|
|
"encoding/json"
|
|
"os"
|
|
"path/filepath"
|
|
"testing"
|
|
|
|
"github.com/netkingdom/flex-auth/internal/sign"
|
|
"github.com/netkingdom/flex-auth/pkg/api"
|
|
)
|
|
|
|
func TestWriteReplaySignatureFixtures(t *testing.T) {
|
|
if os.Getenv("UPDATE_FIXTURES") != "1" {
|
|
t.Skip("set UPDATE_FIXTURES=1 to regenerate signed replay fixtures")
|
|
}
|
|
dir := filepath.Join("..", "..", "examples", "secrets-engine", "replay")
|
|
data, err := os.ReadFile(filepath.Join(dir, "decision_rotate.json"))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
var envelope api.DecisionEnvelope
|
|
if err := json.Unmarshal(data, &envelope); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
_, priv := fixtureKey()
|
|
if err := sign.Sign(&envelope, priv, "testdata-ed25519"); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
writeJSON(t, filepath.Join(dir, "decision_rotate_signed.json"), envelope)
|
|
envelope.Effect = api.DecisionEffectDeny
|
|
envelope.Reason = "tampered_after_signing"
|
|
writeJSON(t, filepath.Join(dir, "decision_rotate_signed_tampered.json"), envelope)
|
|
}
|
|
|
|
func writeJSON(t *testing.T, path string, value any) {
|
|
t.Helper()
|
|
data, err := json.MarshalIndent(value, "", " ")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := os.WriteFile(path, append(data, '\n'), 0o644); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|