backend barebone done, big chunk of work done

server/internal/auth/tokens_test.go

@@ -0,0 +1,78 @@
+// Package auth_test tests access token issuance and parsing.
+package auth_test
+
+import (
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/golang-jwt/jwt/v5"
+	"messenger/internal/auth"
+)
+
+func TestIssueParseRoundTrip(t *testing.T) {
+	secret := "0123456789abcdef0123456789abcdef"
+	tm := auth.NewTokenManager(secret)
+	token, err := tm.IssueAccessToken(42, time.Minute)
+	if err != nil {
+		t.Fatalf("IssueAccessToken error: %v", err)
+	}
+	uid, err := tm.ParseAccessToken(token)
+	if err != nil {
+		t.Fatalf("ParseAccessToken error: %v", err)
+	}
+	if uid != 42 {
+		t.Fatalf("expected userID 42, got %d", uid)
+	}
+}
+
+func TestInvalidSignature(t *testing.T) {
+	tm1 := auth.NewTokenManager("secret1secret1secret1secret1sec1")
+	tm2 := auth.NewTokenManager("secret2secret2secret2secret2sec2")
+	token, err := tm1.IssueAccessToken(1, time.Minute)
+	if err != nil {
+		t.Fatalf("IssueAccessToken error: %v", err)
+	}
+	_, err = tm2.ParseAccessToken(token)
+	if !errors.Is(err, auth.ErrInvalidToken) {
+		t.Fatalf("expected ErrInvalidToken, got %v", err)
+	}
+}
+
+func TestExpiredToken(t *testing.T) {
+	tm := auth.NewTokenManager("secretsecretsecretsecretsecretse")
+	token, err := tm.IssueAccessToken(1, -time.Minute)
+	if err != nil {
+		t.Fatalf("IssueAccessToken error: %v", err)
+	}
+	_, err = tm.ParseAccessToken(token)
+	if !errors.Is(err, auth.ErrInvalidToken) {
+		t.Fatalf("expected ErrInvalidToken for expired, got %v", err)
+	}
+}
+
+func TestNoneAlgorithmToken(t *testing.T) {
+	claims := jwt.RegisteredClaims{
+		Subject:   "1",
+		IssuedAt:  jwt.NewNumericDate(time.Now()),
+		ExpiresAt: jwt.NewNumericDate(time.Now().Add(time.Minute)),
+	}
+	token := jwt.NewWithClaims(jwt.SigningMethodNone, claims)
+	tokenStr, err := token.SignedString(jwt.UnsafeAllowNoneSignatureType)
+	if err != nil {
+		t.Fatalf("create none token: %v", err)
+	}
+	tm := auth.NewTokenManager("longsecretlongsecretlongsecretlongsec")
+	_, err = tm.ParseAccessToken(tokenStr)
+	if !errors.Is(err, auth.ErrInvalidToken) {
+		t.Fatalf("expected ErrInvalidToken for none alg, got %v", err)
+	}
+}
+
+func TestGarbageToken(t *testing.T) {
+	tm := auth.NewTokenManager("secretsecretsecretsecretsecretse")
+	_, err := tm.ParseAccessToken("not a token")
+	if !errors.Is(err, auth.ErrInvalidToken) {
+		t.Fatalf("expected ErrInvalidToken for garbage token, got %v", err)
+	}
+}