xk-hy-transit-go/internal/fileauth/auth_ver233_test.go

package fileauth

import (
	"os"
	"testing"
)

func TestMain(m *testing.M) {
	SetB64Mode(B64ModePadded)
	os.Exit(m.Run())
}

func TestMarshalPutPolicyDoc_docExample(t *testing.T) {
	got, err := MarshalPutPolicyDoc("my-bucket:sunflower.jpg", 1451491200)
	if err != nil {
		t.Fatal(err)
	}
	if string(got) != DocExamplePolicyJSON {
		t.Fatalf("putPolicy mismatch\ngot:  %s\nwant: %s", got, DocExamplePolicyJSON)
	}
}

func TestMarshalPutPolicyUpload_scopeBucketOnly(t *testing.T) {
	got, err := MarshalPutPolicyUpload("other-doc", 1735689600)
	if err != nil {
		t.Fatal(err)
	}
	want := `{"scope":"other-doc","deadline":1735689600}`
	if string(got) != want {
		t.Fatalf("upload policy mismatch\ngot:  %s\nwant: %s", got, want)
	}
}

func TestVer233_encodedPutPolicy_docExample(t *testing.T) {
	got := urlSafeBase64Ver233([]byte(DocExamplePolicyJSON))
	if got != DocExampleEncodedPutPolicy {
		t.Fatalf("encodedPutPolicy mismatch\ngot:  %s\nwant: %s", got, DocExampleEncodedPutPolicy)
	}
}

func TestVer233_signHex_docExample(t *testing.T) {
	hex := HMACSignHex("MY_SECRET_KEY", DocExampleEncodedPutPolicy)
	if hex != DocExampleSignHex {
		t.Fatalf("sign hex mismatch\ngot:  %s\nwant: %s", hex, DocExampleSignHex)
	}
}

func TestVer233_encodedSign_docExample(t *testing.T) {
	sign, err := signPolicyVer233("MY_SECRET_KEY", DocExampleEncodedPutPolicy)
	if err != nil {
		t.Fatal(err)
	}
	if sign != DocExampleEncodedSign {
		t.Fatalf("encodedSign mismatch\ngot:  %s\nwant: %s", sign, DocExampleEncodedSign)
	}
}

func TestVer233_fullToken_docExample(t *testing.T) {
	parts, err := BuildUploadTokenFromPolicy("MY_ACCESS_KEY", "MY_SECRET_KEY", []byte(DocExamplePolicyJSON), "ver233-doc")
	if err != nil {
		t.Fatal(err)
	}
	if parts.UploadToken != DocExampleUploadToken {
		t.Fatalf("token mismatch\ngot:  %s\nwant: %s", parts.UploadToken, DocExampleUploadToken)
	}
	if parts.SignInput != DocExampleEncodedPutPolicy {
		t.Fatal("signInput should be encodedPutPolicy")
	}
}

func TestBuildUploadTokenPartsForUpload_productionShape(t *testing.T) {
	parts, err := BuildUploadTokenPartsForUpload("ak", "sec", "other-doc", 1735689600)
	if err != nil {
		t.Fatal(err)
	}
	if parts.Algorithm != "ver233-upload" {
		t.Fatalf("algorithm=%q", parts.Algorithm)
	}
	if parts.SignInput != parts.EncodedPutPolicy {
		t.Fatal("ver233 signInput must be encodedPutPolicy")
	}
	if parts.PolicyJSON != `{"scope":"other-doc","deadline":1735689600}` {
		t.Fatalf("policy=%q", parts.PolicyJSON)
	}
}

func TestCreateUploadTokenAtFile_ignoresFilenameInScope(t *testing.T) {
	parts, err := BuildUploadTokenPartsAtFile("ak", "sec", "other-doc", "different.pdf", 1735689600)
	if err != nil {
		t.Fatal(err)
	}
	if parts.PolicyJSON != `{"scope":"other-doc","deadline":1735689600}` {
		t.Fatalf("filename must not affect scope: %q", parts.PolicyJSON)
	}
}

func TestVer233_uploadRawB64_differsFromPadded(t *testing.T) {
	SetB64Mode(B64ModePadded)
	padded, err := BuildUploadTokenPartsForUpload("ak", "sec", "b", 1735689600)
	if err != nil {
		t.Fatal(err)
	}
	SetB64Mode(B64ModeRaw)
	raw, err := BuildUploadTokenPartsForUpload("ak", "sec", "b", 1735689600)
	if err != nil {
		t.Fatal(err)
	}
	SetB64Mode(B64ModePadded)
	if padded.UploadToken == raw.UploadToken {
		t.Fatal("padded vs raw token should differ")
	}
}