1package auth
2
3import (
4 "bytes"
5 "context"
6 "testing"
7 "time"
8
9 "github.com/bnema/neferafk/internal/ports"
10)
11
12func TestPINSourceValidation(t *testing.T) {
13 for _, input := range []string{"12345", "123456\n", "12345a", " 123456", "123456 ", "", "123456\r", "123456789012345678901234567890123"} {
14 if pin := ResolvePIN(context.Background(), ports.AuthBootstrap{PINSource: "env", EnvPIN: []byte(input)}); pin != nil {
15 t.Fatal("invalid env source accepted")
16 }
17 }
18 in := []byte("123456")
19 pin := ResolvePIN(context.Background(), ports.AuthBootstrap{PINSource: "env", EnvPIN: in})
20 if !bytes.Equal(pin, in) {
21 t.Fatal("valid env source rejected")
22 }
23 clear(in)
24 if string(pin) != "123456" {
25 t.Fatal("resolved PIN aliases bootstrap")
26 }
27 clear(pin)
28 for _, entry := range []string{"", "-clip", "/absolute", "a/../b", "a//b", "a/./b", "a\\b", "a\x00b"} {
29 if passEntry(entry) {
30 t.Fatal("unsafe pass entry accepted")
31 }
32 }
33 if !passEntry("locker/pin") {
34 t.Fatal("valid pass reference rejected")
35 }
36 var out fixedOutput
37 if _, err := out.Write(make([]byte, sourceLimit)); err != nil {
38 t.Fatal(err)
39 }
40 if _, err := out.Write([]byte{1}); err == nil || out.n != sourceLimit {
41 t.Fatal("source output cap not enforced")
42 }
43 clear(out.data[:])
44}
45
46func TestSourceGenericChildBoundsAndTimeout(t *testing.T) {
47 pin, err := commandPIN(context.Background(), "/bin/sh", []string{"-c", "printf '123456\\nmetadata\\n'"}, []string{"PATH=/usr/bin:/bin"})
48 if err != nil || string(pin) != "123456" {
49 t.Fatalf("first line source: %v", err)
50 }
51 clear(pin)
52 if _, err := commandPIN(context.Background(), "/bin/sh", []string{"-c", "head -c 5000 /dev/zero"}, []string{"PATH=/usr/bin:/bin"}); err == nil {
53 t.Fatal("oversize source accepted")
54 }
55 ctx, cancel := context.WithTimeout(context.Background(), 30*time.Millisecond)
56 defer cancel()
57 start := time.Now()
58 if _, err := commandPIN(ctx, "/bin/sh", []string{"-c", "sleep 10 & wait"}, []string{"PATH=/usr/bin:/bin"}); err == nil {
59 t.Fatal("timed-out source accepted")
60 }
61 if time.Since(start) > time.Second {
62 t.Fatal("source group cancellation did not bound Wait")
63 }
64}