feat(auth): implement user and device authentication

2026-07-26 15:18:48 +08:00
parent c5d3b215ff
commit 49db5b8305
66 changed files with 6216 additions and 271 deletions
@@ -0,0 +1,67 @@
+package password
+
+import (
+	"errors"
+	"strings"
+	"testing"
+
+	"golang.org/x/crypto/bcrypt"
+)
+
+func TestBcryptHashesAndVerifiesWithoutStoringPlaintext(t *testing.T) {
+	manager, err := NewBcrypt(bcrypt.MinCost)
+	if err != nil {
+		t.Fatalf("NewBcrypt() error = %v", err)
+	}
+	encoded, err := manager.Hash("correct horse battery staple")
+	if err != nil {
+		t.Fatalf("Hash() error = %v", err)
+	}
+	if encoded == "correct horse battery staple" {
+		t.Fatal("Hash() returned plaintext")
+	}
+	if err := manager.Verify(encoded, "correct horse battery staple"); err != nil {
+		t.Fatalf("Verify(correct) error = %v", err)
+	}
+	if err := manager.Verify(encoded, "wrong"); !errors.Is(
+		err,
+		ErrPasswordMismatch,
+	) {
+		t.Fatalf("Verify(wrong) error = %v", err)
+	}
+}
+
+func TestBcryptRejectsInvalidCostAndOversizedPasswords(t *testing.T) {
+	if _, err := NewBcrypt(bcrypt.MinCost - 1); err == nil {
+		t.Fatal("NewBcrypt(invalid) error = nil")
+	}
+	manager, err := NewBcrypt(bcrypt.MinCost)
+	if err != nil {
+		t.Fatalf("NewBcrypt() error = %v", err)
+	}
+	oversized := strings.Repeat("x", 73)
+	if _, err := manager.Hash("too-short"); !errors.Is(
+		err,
+		ErrInvalidPassword,
+	) {
+		t.Fatalf("Hash(short) error = %v", err)
+	}
+	if _, err := manager.Hash(oversized); !errors.Is(
+		err,
+		ErrInvalidPassword,
+	) {
+		t.Fatalf("Hash(oversized) error = %v", err)
+	}
+	if _, err := manager.Hash(
+		string([]byte{0xff, 0xfe, 0xfd}),
+	); !errors.Is(err, ErrInvalidPassword) {
+		t.Fatalf("Hash(invalid UTF-8) error = %v", err)
+	}
+	if err := manager.Verify("$2a$04$invalid", oversized); !errors.Is(
+		err,
+		ErrPasswordMismatch,
+	) {
+		t.Fatalf("Verify(oversized) error = %v", err)
+	}
+	manager.VerifyDummy("password-123")
+}