24 lines
1.2 KiB
JavaScript
24 lines
1.2 KiB
JavaScript
import assert from 'node:assert/strict';
|
|
import test from 'node:test';
|
|
import { adminSignature, hmacHex, verifyAdminSignature, verifyHexHmac } from '../src/auth.mjs';
|
|
|
|
test('Gitea HMAC verifies the exact raw body', () => {
|
|
const body = Buffer.from('{"ref":"refs/heads/master"}');
|
|
const signature = hmacHex('a'.repeat(32), body);
|
|
assert.equal(verifyHexHmac('a'.repeat(32), body, signature), true);
|
|
assert.equal(verifyHexHmac('a'.repeat(32), Buffer.from(`${body} `), signature), false);
|
|
assert.equal(verifyHexHmac('a'.repeat(32), body, 'not-a-signature'), false);
|
|
});
|
|
|
|
test('admin signatures bind timestamp, request ID, and body with a five-minute window', () => {
|
|
const secret = 'b'.repeat(32);
|
|
const now = 1_786_013_000_000;
|
|
const timestamp = String(now);
|
|
const requestId = 'request-1234';
|
|
const body = Buffer.from('{"branch":"master"}');
|
|
const supplied = adminSignature(secret, timestamp, requestId, body);
|
|
assert.equal(verifyAdminSignature({ secret, timestamp, requestId, body, supplied, now }), true);
|
|
assert.equal(verifyAdminSignature({ secret, timestamp: String(now - 300_001), requestId, body, supplied, now }), false);
|
|
assert.equal(verifyAdminSignature({ secret, timestamp, requestId: 'changed-id', body, supplied, now }), false);
|
|
});
|