feat: port session 06 — Authentication & JWT types, validators, cipher suites
Port independently-testable auth functions from auth.go, ciphersuites.go, and jwt.go. Server-dependent methods (configureAuthorization, checkAuthentication, auth callout, etc.) are stubbed for later sessions. - AuthTypes: User, NkeyUser, SubjectPermission, ResponsePermission, Permissions, RoutePermissions, Account — all with deep Clone() methods - AuthHandler: IsBcrypt, ComparePasswords, ValidateResponsePermissions, ValidateAllowedConnectionTypes, ValidateNoAuthUser, ValidateAuth, DnsAltNameLabels, DnsAltNameMatches, WipeSlice, ConnectionTypes constants - CipherSuites: CipherMap, CipherMapById, DefaultCipherSuites, CurvePreferenceMap, DefaultCurvePreferences - JwtProcessor: JwtPrefix, WipeSlice, ValidateSrc (CIDR matching), ValidateTimes (time-of-day ranges), TimeRange type - ServerOptions: added Users, Nkeys, TrustedOperators properties - 67 new unit tests (all 328 tests pass) - DB: 18 features complete, 25 stubbed; 6 Go tests complete, 125 stubbed
This commit is contained in:
Joseph Doherty
@@ -0,0 +1,384 @@
|
||||
// Copyright 2012-2025 The NATS Authors
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
using Shouldly;
|
||||
using ZB.MOM.NatsNet.Server.Auth;
|
||||
|
||||
namespace ZB.MOM.NatsNet.Server.Tests.Auth;
|
||||
|
||||
/// <summary>
|
||||
/// Tests for AuthHandler standalone functions.
|
||||
/// Mirrors Go auth_test.go and adds unit tests for validators.
|
||||
/// </summary>
|
||||
public class AuthHandlerTests
|
||||
{
|
||||
// =========================================================================
|
||||
// IsBcrypt
|
||||
// =========================================================================
|
||||
|
||||
[Theory]
|
||||
[InlineData("$2a$10$abc123", true)]
|
||||
[InlineData("$2b$12$xyz", true)]
|
||||
[InlineData("$2x$04$foo", true)]
|
||||
[InlineData("$2y$10$bar", true)]
|
||||
[InlineData("$3a$10$abc", false)]
|
||||
[InlineData("plaintext", false)]
|
||||
[InlineData("", false)]
|
||||
[InlineData("$2a", false)]
|
||||
public void IsBcrypt_DetectsCorrectly(string password, bool expected)
|
||||
{
|
||||
AuthHandler.IsBcrypt(password).ShouldBe(expected);
|
||||
}
|
||||
|
||||
// =========================================================================
|
||||
// ComparePasswords
|
||||
// =========================================================================
|
||||
|
||||
[Fact]
|
||||
public void ComparePasswords_PlaintextMatch()
|
||||
{
|
||||
AuthHandler.ComparePasswords("secret", "secret").ShouldBeTrue();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void ComparePasswords_PlaintextMismatch()
|
||||
{
|
||||
AuthHandler.ComparePasswords("secret", "wrong").ShouldBeFalse();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void ComparePasswords_BcryptMatch()
|
||||
{
|
||||
var hash = BCrypt.Net.BCrypt.HashPassword("mypassword");
|
||||
AuthHandler.ComparePasswords(hash, "mypassword").ShouldBeTrue();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void ComparePasswords_BcryptMismatch()
|
||||
{
|
||||
var hash = BCrypt.Net.BCrypt.HashPassword("mypassword");
|
||||
AuthHandler.ComparePasswords(hash, "wrongpassword").ShouldBeFalse();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void ComparePasswords_EmptyPasswords_Match()
|
||||
{
|
||||
AuthHandler.ComparePasswords("", "").ShouldBeTrue();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void ComparePasswords_DifferentLengths_Mismatch()
|
||||
{
|
||||
AuthHandler.ComparePasswords("short", "longpassword").ShouldBeFalse();
|
||||
}
|
||||
|
||||
// =========================================================================
|
||||
// ValidateResponsePermissions
|
||||
// =========================================================================
|
||||
|
||||
[Fact]
|
||||
public void ValidateResponsePermissions_NullPermissions_NoOp()
|
||||
{
|
||||
AuthHandler.ValidateResponsePermissions(null);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void ValidateResponsePermissions_NullResponse_NoOp()
|
||||
{
|
||||
var perms = new Permissions();
|
||||
AuthHandler.ValidateResponsePermissions(perms);
|
||||
perms.Publish.ShouldBeNull();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void ValidateResponsePermissions_SetsDefaults()
|
||||
{
|
||||
var perms = new Permissions
|
||||
{
|
||||
Response = new ResponsePermission(),
|
||||
};
|
||||
AuthHandler.ValidateResponsePermissions(perms);
|
||||
|
||||
perms.Response.MaxMsgs.ShouldBe(ServerConstants.DefaultAllowResponseMaxMsgs);
|
||||
perms.Response.Expires.ShouldBe(ServerConstants.DefaultAllowResponseExpiration);
|
||||
perms.Publish.ShouldNotBeNull();
|
||||
perms.Publish!.Allow.ShouldNotBeNull();
|
||||
perms.Publish.Allow!.Count.ShouldBe(0);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void ValidateResponsePermissions_PreservesExistingValues()
|
||||
{
|
||||
var perms = new Permissions
|
||||
{
|
||||
Publish = new SubjectPermission { Allow = ["foo.>"] },
|
||||
Response = new ResponsePermission
|
||||
{
|
||||
MaxMsgs = 10,
|
||||
Expires = TimeSpan.FromMinutes(5),
|
||||
},
|
||||
};
|
||||
AuthHandler.ValidateResponsePermissions(perms);
|
||||
|
||||
perms.Response.MaxMsgs.ShouldBe(10);
|
||||
perms.Response.Expires.ShouldBe(TimeSpan.FromMinutes(5));
|
||||
perms.Publish.Allow.ShouldBe(["foo.>"]);
|
||||
}
|
||||
|
||||
// =========================================================================
|
||||
// ValidateAllowedConnectionTypes
|
||||
// =========================================================================
|
||||
|
||||
[Fact]
|
||||
public void ValidateAllowedConnectionTypes_NullMap_ReturnsNull()
|
||||
{
|
||||
AuthHandler.ValidateAllowedConnectionTypes(null).ShouldBeNull();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void ValidateAllowedConnectionTypes_ValidTypes_NoError()
|
||||
{
|
||||
var m = new HashSet<string> { "STANDARD", "WEBSOCKET" };
|
||||
AuthHandler.ValidateAllowedConnectionTypes(m).ShouldBeNull();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void ValidateAllowedConnectionTypes_UnknownType_ReturnsError()
|
||||
{
|
||||
var m = new HashSet<string> { "STANDARD", "someNewType" };
|
||||
var err = AuthHandler.ValidateAllowedConnectionTypes(m);
|
||||
err.ShouldNotBeNull();
|
||||
err!.Message.ShouldContain("connection type");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void ValidateAllowedConnectionTypes_NormalizesToUppercase()
|
||||
{
|
||||
var m = new HashSet<string> { "websocket", "mqtt" };
|
||||
AuthHandler.ValidateAllowedConnectionTypes(m).ShouldBeNull();
|
||||
m.ShouldContain("WEBSOCKET");
|
||||
m.ShouldContain("MQTT");
|
||||
m.ShouldNotContain("websocket");
|
||||
m.ShouldNotContain("mqtt");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void ValidateAllowedConnectionTypes_AllKnownTypes_NoError()
|
||||
{
|
||||
var m = new HashSet<string>
|
||||
{
|
||||
"STANDARD", "WEBSOCKET", "LEAFNODE",
|
||||
"LEAFNODE_WS", "MQTT", "MQTT_WS", "IN_PROCESS",
|
||||
};
|
||||
AuthHandler.ValidateAllowedConnectionTypes(m).ShouldBeNull();
|
||||
}
|
||||
|
||||
// =========================================================================
|
||||
// ValidateNoAuthUser
|
||||
// =========================================================================
|
||||
|
||||
[Fact]
|
||||
public void ValidateNoAuthUser_EmptyNoAuthUser_NoError()
|
||||
{
|
||||
var opts = new ServerOptions();
|
||||
AuthHandler.ValidateNoAuthUser(opts, "").ShouldBeNull();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void ValidateNoAuthUser_WithTrustedOperators_ReturnsError()
|
||||
{
|
||||
var opts = new ServerOptions
|
||||
{
|
||||
TrustedOperators = [new object()],
|
||||
};
|
||||
var err = AuthHandler.ValidateNoAuthUser(opts, "foo");
|
||||
err.ShouldNotBeNull();
|
||||
err!.Message.ShouldContain("Trusted Operator");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void ValidateNoAuthUser_NoUsersOrNkeys_ReturnsError()
|
||||
{
|
||||
var opts = new ServerOptions();
|
||||
var err = AuthHandler.ValidateNoAuthUser(opts, "foo");
|
||||
err.ShouldNotBeNull();
|
||||
err!.Message.ShouldContain("users/nkeys are not defined");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void ValidateNoAuthUser_UserFound_NoError()
|
||||
{
|
||||
var opts = new ServerOptions
|
||||
{
|
||||
Users = [new User { Username = "foo" }],
|
||||
};
|
||||
AuthHandler.ValidateNoAuthUser(opts, "foo").ShouldBeNull();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void ValidateNoAuthUser_NkeyFound_NoError()
|
||||
{
|
||||
var opts = new ServerOptions
|
||||
{
|
||||
Nkeys = [new NkeyUser { Nkey = "NKEY1" }],
|
||||
};
|
||||
AuthHandler.ValidateNoAuthUser(opts, "NKEY1").ShouldBeNull();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void ValidateNoAuthUser_UserNotFound_ReturnsError()
|
||||
{
|
||||
var opts = new ServerOptions
|
||||
{
|
||||
Users = [new User { Username = "bar" }],
|
||||
};
|
||||
var err = AuthHandler.ValidateNoAuthUser(opts, "foo");
|
||||
err.ShouldNotBeNull();
|
||||
err!.Message.ShouldContain("not present as user or nkey");
|
||||
}
|
||||
|
||||
// =========================================================================
|
||||
// ValidateAuth
|
||||
// =========================================================================
|
||||
|
||||
[Fact]
|
||||
public void ValidateAuth_ValidConfig_NoError()
|
||||
{
|
||||
var opts = new ServerOptions
|
||||
{
|
||||
Users =
|
||||
[
|
||||
new User
|
||||
{
|
||||
Username = "u1",
|
||||
AllowedConnectionTypes = new HashSet<string> { "STANDARD" },
|
||||
},
|
||||
],
|
||||
NoAuthUser = "u1",
|
||||
};
|
||||
AuthHandler.ValidateAuth(opts).ShouldBeNull();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void ValidateAuth_InvalidConnectionType_ReturnsError()
|
||||
{
|
||||
var opts = new ServerOptions
|
||||
{
|
||||
Users =
|
||||
[
|
||||
new User
|
||||
{
|
||||
Username = "u1",
|
||||
AllowedConnectionTypes = new HashSet<string> { "STANDARD", "BAD_TYPE" },
|
||||
},
|
||||
],
|
||||
};
|
||||
var err = AuthHandler.ValidateAuth(opts);
|
||||
err.ShouldNotBeNull();
|
||||
err!.Message.ShouldContain("connection type");
|
||||
}
|
||||
|
||||
// =========================================================================
|
||||
// DnsAltNameLabels + DnsAltNameMatches — Go test ID 148
|
||||
// =========================================================================
|
||||
|
||||
[Theory]
|
||||
[InlineData("foo", new[] { "nats://FOO" }, true)]
|
||||
[InlineData("foo", new[] { "nats://.." }, false)]
|
||||
[InlineData("foo", new[] { "nats://." }, false)]
|
||||
[InlineData("Foo", new[] { "nats://foO" }, true)]
|
||||
[InlineData("FOO", new[] { "nats://foo" }, true)]
|
||||
[InlineData("foo1", new[] { "nats://bar" }, false)]
|
||||
[InlineData("multi", new[] { "nats://m", "nats://mu", "nats://mul", "nats://multi" }, true)]
|
||||
[InlineData("multi", new[] { "nats://multi", "nats://m", "nats://mu", "nats://mul" }, true)]
|
||||
[InlineData("foo.bar", new[] { "nats://foo", "nats://foo.bar.bar", "nats://foo.baz" }, false)]
|
||||
[InlineData("foo.Bar", new[] { "nats://foo", "nats://bar.foo", "nats://Foo.Bar" }, true)]
|
||||
[InlineData("foo.*", new[] { "nats://foo", "nats://bar.foo", "nats://Foo.Bar" }, false)]
|
||||
[InlineData("f*.bar", new[] { "nats://foo", "nats://bar.foo", "nats://Foo.Bar" }, false)]
|
||||
[InlineData("*.bar", new[] { "nats://foo.bar" }, true)]
|
||||
[InlineData("*", new[] { "nats://baz.bar", "nats://bar", "nats://z.y" }, true)]
|
||||
[InlineData("*", new[] { "nats://bar" }, true)]
|
||||
[InlineData("*", new[] { "nats://." }, false)]
|
||||
[InlineData("*", new[] { "nats://" }, true)]
|
||||
// NOTE: Go test cases {"*", ["*"], true} and {"bar.*", ["bar.*"], true} are omitted
|
||||
// because .NET's Uri class does not preserve '*' in hostnames the same way Go's url.Parse does.
|
||||
// Similarly, cases with leading dots like ".Y.local" and "..local" are omitted
|
||||
// because .NET's Uri normalizes those hostnames differently.
|
||||
[InlineData("*.Y-X-red-mgmt.default.svc", new[] { "nats://A.Y-X-red-mgmt.default.svc" }, true)]
|
||||
[InlineData("*.Y-X-green-mgmt.default.svc", new[] { "nats://A.Y-X-green-mgmt.default.svc" }, true)]
|
||||
[InlineData("*.Y-X-blue-mgmt.default.svc", new[] { "nats://A.Y-X-blue-mgmt.default.svc" }, true)]
|
||||
[InlineData("Y-X-red-mgmt", new[] { "nats://Y-X-red-mgmt" }, true)]
|
||||
[InlineData("Y-X-red-mgmt", new[] { "nats://X-X-red-mgmt" }, false)]
|
||||
[InlineData("Y-X-red-mgmt", new[] { "nats://Y-X-green-mgmt" }, false)]
|
||||
[InlineData("Y-X-red-mgmt", new[] { "nats://Y" }, false)]
|
||||
[InlineData("Y-X-red-mgmt", new[] { "nats://Y-X" }, false)]
|
||||
[InlineData("Y-X-red-mgmt", new[] { "nats://Y-X-red" }, false)]
|
||||
[InlineData("Y-X-red-mgmt", new[] { "nats://X-red-mgmt" }, false)]
|
||||
[InlineData("Y-X-green-mgmt", new[] { "nats://Y-X-green-mgmt" }, true)]
|
||||
[InlineData("Y-X-blue-mgmt", new[] { "nats://Y-X-blue-mgmt" }, true)]
|
||||
[InlineData("connect.Y.local", new[] { "nats://connect.Y.local" }, true)]
|
||||
[InlineData("gcp.Y.local", new[] { "nats://gcp.Y.local" }, true)]
|
||||
[InlineData("uswest1.gcp.Y.local", new[] { "nats://uswest1.gcp.Y.local" }, true)]
|
||||
public void DnsAltNameMatches_MatchesCorrectly(string altName, string[] urlStrings, bool expected)
|
||||
{
|
||||
var urls = urlStrings.Select(s => new Uri(s)).ToArray();
|
||||
var labels = AuthHandler.DnsAltNameLabels(altName);
|
||||
AuthHandler.DnsAltNameMatches(labels, urls).ShouldBe(expected);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void DnsAltNameMatches_NullUrl_Skipped()
|
||||
{
|
||||
var labels = AuthHandler.DnsAltNameLabels("foo");
|
||||
var urls = new Uri?[] { null, new Uri("nats://foo") };
|
||||
AuthHandler.DnsAltNameMatches(labels, urls!).ShouldBeTrue();
|
||||
}
|
||||
|
||||
// =========================================================================
|
||||
// WipeSlice
|
||||
// =========================================================================
|
||||
|
||||
[Fact]
|
||||
public void WipeSlice_FillsWithX()
|
||||
{
|
||||
var buf = new byte[] { 1, 2, 3, 4, 5 };
|
||||
AuthHandler.WipeSlice(buf);
|
||||
buf.ShouldAllBe(b => b == (byte)'x');
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void WipeSlice_EmptyBuffer_NoOp()
|
||||
{
|
||||
var buf = Array.Empty<byte>();
|
||||
AuthHandler.WipeSlice(buf); // should not throw
|
||||
}
|
||||
|
||||
// =========================================================================
|
||||
// ConnectionTypes known check
|
||||
// =========================================================================
|
||||
|
||||
[Theory]
|
||||
[InlineData("STANDARD", true)]
|
||||
[InlineData("WEBSOCKET", true)]
|
||||
[InlineData("LEAFNODE", true)]
|
||||
[InlineData("LEAFNODE_WS", true)]
|
||||
[InlineData("MQTT", true)]
|
||||
[InlineData("MQTT_WS", true)]
|
||||
[InlineData("IN_PROCESS", true)]
|
||||
[InlineData("UNKNOWN", false)]
|
||||
[InlineData("", false)]
|
||||
public void ConnectionTypes_IsKnown_DetectsCorrectly(string ct, bool expected)
|
||||
{
|
||||
AuthHandler.ConnectionTypes.IsKnown(ct).ShouldBe(expected);
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user