/home/mrjunejune/zenbu: mrjunejune/test/auth_api

annotate mrjunejune/test/auth_api_test.c @ 279:b3b547563ec7

Add Google connector service and agent wiki Implement the C/Seobeo Google Drive and Gmail connector with encrypted OAuth storage, Zenbu authentication, browser testing, AI tool discovery, chunked HTTP decoding, and Bazel coverage. Consolidate repository guidance into progressive wiki documentation and enforce arena-first allocation for new first-party C code. Co-authored-by: Copilot <[email protected]> Copilot-Session: 84c338fd-0939-4bb3-b7f3-1062eb213e5d

author	MrJuneJune <me@mrjunejune.com>
date	Mon, 17 Aug 2026 22:22:36 -0700
parents	04fee26ecce0
children

rev	line source
264 04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1 /*
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	2 * auth_api_test.c — unit tests for the auth API internals.
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	3 *
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	4 * Tests run against the auth_api library directly (no real network).
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	5 * A temporary SQLite database is created per test group.
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	6 */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	7
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	8 #include "mrjunejune/auth_api.h"
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	9
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	10 #include "auth/auth_crypto.h"
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	11 #include "auth/auth_store.h"
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	12 #include "dowa/dowa.h"
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	13 #include "seobeo/seobeo.h"
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	14
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	15 #include <assert.h>
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	16 #include <stdarg.h>
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	17 #include <stdio.h>
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	18 #include <string.h>
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	19 #include <stdlib.h>
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	20 #include <unistd.h>
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	21 #include <time.h>
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	22
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	23 #include <openssl/crypto.h>
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	24
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	25 #define COOKIE_VALUE_MAX 512 /* mirrors auth_api.c internal constant */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	26
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	27 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	28 /* Test utilities */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	29 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	30
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	31 #define ASSERT(cond) \
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	32 do { \
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	33 if (!(cond)) { \
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	34 fprintf(stderr, "FAIL [%s:%d]: %s\n", __FILE__, __LINE__, #cond); \
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	35 abort(); \
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	36 } \
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	37 } while (0)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	38
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	39 #define TEST(name) \
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	40 do { fprintf(stdout, " %-60s", name); fflush(stdout); } while (0)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	41
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	42 #define PASS() \
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	43 do { fprintf(stdout, "PASS\n"); } while (0)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	44
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	45 /* (unused placeholder removed) */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	46
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	47 static void make_temp_db(char *out, size_t capacity)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	48 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	49 snprintf(out, capacity, "/tmp/auth_api_test_XXXXXX");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	50 int fd = mkstemp(out);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	51 ASSERT(fd >= 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	52 close(fd);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	53 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	54
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	55 /* Cookie secret large enough to pass policy */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	56 static const uint8 k_secret[64] = {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	57 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	58 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	59 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	60 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, 0x20,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	61 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 0x28,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	62 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f, 0x30,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	63 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	64 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f, 0x40,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	65 };
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	66
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	67 static void init_auth(const char *db, boolean dev_insecure)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	68 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	69 boolean ok = Auth_API_Init(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	70 db,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	71 k_secret, sizeof(k_secret),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	72 NULL, NULL, NULL,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	73 AUTH_API_SESSION_IDLE_TTL_DEFAULT,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	74 AUTH_API_SESSION_ABS_TTL_DEFAULT,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	75 AUTH_API_GUEST_TTL_DEFAULT,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	76 dev_insecure);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	77 ASSERT(ok);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	78 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	79
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	80 /*
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	81 * Build a minimal request map with the given headers.
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	82 * Entries must be string-literal key/value pairs ending with NULL,NULL.
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	83 */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	84 static Seobeo_Request_Entry *make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	85 Dowa_Arena *arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	86 /* (char)key, (char)value, ..., NULL, NULL */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	87 ...)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	88 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	89 Seobeo_Request_Entry *req = NULL;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	90 va_list ap;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	91 va_start(ap, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	92 const char *key;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	93 while ((key = va_arg(ap, const char *)) != NULL)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	94 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	95 char k = (char )key;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	96 const char val = va_arg(ap, const char );
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	97 char stored = (char )val;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	98 if (strcmp(key, "Body") == 0)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	99 stored = Dowa_Arena_Copy(arena, val, strlen(val) + 1);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	100 Dowa_HashMap_Push_Arena(req, k, stored, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	101 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	102 va_end(ap);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	103 return req;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	104 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	105
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	106 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	107 /* Test group: Init / fail-closed */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	108 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	109
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	110 static void test_init_fail_closed(void)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	111 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	112 printf("\n[init]\n");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	113
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	114 TEST("fails when secret too short");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	115 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	116 uint8 short_secret[10] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	117 boolean ok = Auth_API_Init(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	118 "/dev/null",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	119 short_secret, sizeof(short_secret),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	120 NULL, NULL, NULL, 0, 0, 0, FALSE);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	121 ASSERT(!ok);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	122 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	123 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	124
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	125 TEST("fails when secret NULL");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	126 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	127 boolean ok = Auth_API_Init(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	128 "/dev/null", NULL, 0, NULL, NULL, NULL, 0, 0, 0, FALSE);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	129 ASSERT(!ok);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	130 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	131 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	132
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	133 TEST("succeeds with valid config");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	134 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	135 char db[256];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	136 make_temp_db(db, sizeof(db));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	137 boolean ok = Auth_API_Init(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	138 db, k_secret, sizeof(k_secret),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	139 NULL, NULL, NULL, 0, 0, 0, TRUE);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	140 ASSERT(ok);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	141 Auth_API_Destroy();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	142 unlink(db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	143 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	144 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	145 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	146
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	147 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	148 /* Test group: Cookie parsing */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	149 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	150
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	151 /*
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	152 * We exercise the parsing via Auth_API_Resolve_Principal with crafted
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	153 * Cookie headers. For unit-level parsing checks we call Resolve_Principal
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	154 * and inspect the returned principal kind.
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	155 */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	156 static void test_cookie_parsing(void)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	157 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	158 printf("\n[cookie parsing]\n");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	159
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	160 char db[256];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	161 make_temp_db(db, sizeof(db));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	162 init_auth(db, TRUE);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	163
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	164 Dowa_Arena arena = Dowa_Arena_Create(64 1024);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	165
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	166 TEST("empty Cookie → new guest identity created");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	167 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	168 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	169 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	170 "Host", "localhost:6969",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	171 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	172 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	173
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	174 Auth_Principal p;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	175 char new_cookie[512] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	176 boolean ok = Auth_API_Resolve_Principal(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	177 req, &p, arena, new_cookie, sizeof(new_cookie));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	178 ASSERT(ok);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	179 ASSERT(p.kind == AUTH_PRINCIPAL_GUEST);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	180 ASSERT(p.guest_id[0] != '\0');
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	181 ASSERT(p.csrf_token[0] != '\0');
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	182 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	183 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	184
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	185 TEST("malformed guest cookie → new guest identity");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	186 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	187 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	188 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	189 "Host", "localhost:6969",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	190 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	191 "Cookie", "mjj_guest=not-a-valid-cookie",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	192 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	193
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	194 Auth_Principal p;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	195 char new_cookie[512] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	196 boolean ok = Auth_API_Resolve_Principal(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	197 req, &p, arena, new_cookie, sizeof(new_cookie));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	198 ASSERT(ok);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	199 ASSERT(p.kind == AUTH_PRINCIPAL_GUEST);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	200 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	201 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	202
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	203 TEST("unknown session token → falls back to guest");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	204 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	205 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	206 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	207 "Host", "localhost:6969",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	208 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	209 "Cookie", "mjj_session=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	210 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	211
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	212 Auth_Principal p;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	213 char new_cookie[512] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	214 boolean ok = Auth_API_Resolve_Principal(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	215 req, &p, arena, new_cookie, sizeof(new_cookie));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	216 ASSERT(ok);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	217 ASSERT(p.kind == AUTH_PRINCIPAL_GUEST);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	218 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	219 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	220
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	221 Dowa_Arena_Free(arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	222 Auth_API_Destroy();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	223 unlink(db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	224 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	225
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	226 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	227 /* Test group: Trusted proxy */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	228 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	229
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	230 static void test_trusted_proxy(void)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	231 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	232 printf("\n[trusted proxy]\n");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	233
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	234 char db[256];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	235 make_temp_db(db, sizeof(db));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	236
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	237 /* Init with trusted proxy = 10.0.0.1 */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	238 boolean ok = Auth_API_Init(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	239 db, k_secret, sizeof(k_secret),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	240 NULL, NULL,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	241 "10.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	242 AUTH_API_SESSION_IDLE_TTL_DEFAULT,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	243 AUTH_API_SESSION_ABS_TTL_DEFAULT,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	244 AUTH_API_GUEST_TTL_DEFAULT,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	245 TRUE);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	246 ASSERT(ok);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	247
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	248 Dowa_Arena arena = Dowa_Arena_Create(64 1024);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	249
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	250 TEST("trusted proxy accepted when Remote-Addr matches");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	251 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	252 /* Two requests with same X-Real-IP but different Remote-Addr;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	253 * first goes through proxy (accepted), second is direct (rejected).
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	254 * We verify they produce different guest IDs (different IP bindings). */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	255 Seobeo_Request_Entry *req_proxied = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	256 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	257 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	258 "Remote-Addr", "10.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	259 "X-Real-IP", "203.0.113.5",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	260 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	261 Seobeo_Request_Entry *req_direct = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	262 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	263 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	264 "Remote-Addr", "203.0.113.5",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	265 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	266
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	267 Auth_Principal p1, p2;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	268 char nc1[512] = {0}, nc2[512] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	269 ASSERT(Auth_API_Resolve_Principal(req_proxied, &p1, arena, nc1, sizeof(nc1)));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	270 ASSERT(Auth_API_Resolve_Principal(req_direct, &p2, arena, nc2, sizeof(nc2)));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	271 ASSERT(p1.kind == AUTH_PRINCIPAL_GUEST);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	272 ASSERT(p2.kind == AUTH_PRINCIPAL_GUEST);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	273 /* Different IP bindings → different guest IDs */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	274 ASSERT(strcmp(p1.guest_id, p2.guest_id) != 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	275 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	276 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	277
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	278 TEST("untrusted Remote-Addr ignores X-Real-IP");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	279 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	280 /* Direct connection from 192.168.1.1 sending X-Real-IP; must be ignored */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	281 Seobeo_Request_Entry *req_spoof = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	282 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	283 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	284 "Remote-Addr", "192.168.1.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	285 "X-Real-IP", "1.2.3.4",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	286 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	287 Seobeo_Request_Entry *req_honest = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	288 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	289 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	290 "Remote-Addr", "192.168.1.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	291 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	292
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	293 Auth_Principal p_spoof, p_honest;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	294 char nc1[512] = {0}, nc2[512] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	295 ASSERT(Auth_API_Resolve_Principal(req_spoof, &p_spoof, arena, nc1, sizeof(nc1)));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	296 ASSERT(Auth_API_Resolve_Principal(req_honest, &p_honest, arena, nc2, sizeof(nc2)));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	297 /* Both see the same direct IP 192.168.1.1 → same binding → same guest? */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	298 /* Actually different guests (new IDs created), but same CSRF derivation base */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	299 ASSERT(p_spoof.kind == AUTH_PRINCIPAL_GUEST);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	300 ASSERT(p_honest.kind == AUTH_PRINCIPAL_GUEST);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	301 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	302 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	303
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	304 Dowa_Arena_Free(arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	305 Auth_API_Destroy();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	306 unlink(db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	307 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	308
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	309 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	310 /* Test group: Bootstrap idempotency */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	311 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	312
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	313 static void test_bootstrap(void)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	314 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	315 printf("\n[bootstrap]\n");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	316
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	317 char db[256];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	318 make_temp_db(db, sizeof(db));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	319
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	320 /* Hash a known password for bootstrap */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	321 char hashed[AUTH_CRYPTO_PASSWORD_HASH_ENCODED_SIZE];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	322 ASSERT(Auth_Crypto_Password_Hash(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	323 "AdminPassword123!", hashed, sizeof(hashed)) == AUTH_CRYPTO_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	324
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	325 TEST("bootstrap creates admin on first init");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	326 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	327 boolean ok = Auth_API_Init(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	328 db, k_secret, sizeof(k_secret),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	329 "admin", hashed,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	330 NULL, 0, 0, 0, TRUE);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	331 ASSERT(ok);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	332 Auth_API_Destroy();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	333 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	334 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	335
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	336 TEST("bootstrap is idempotent on second init");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	337 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	338 boolean ok = Auth_API_Init(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	339 db, k_secret, sizeof(k_secret),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	340 "admin", hashed,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	341 NULL, 0, 0, 0, TRUE);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	342 ASSERT(ok);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	343 /* No second admin should have been created; store still has one admin */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	344 Auth_API_Destroy();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	345 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	346 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	347
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	348 unlink(db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	349 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	350
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	351 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	352 /* Test group: Forced-password-change path guard */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	353 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	354
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	355 static void test_forced_password_change_paths(void)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	356 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	357 printf("\n[forced password change paths]\n");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	358
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	359 TEST("auth-only paths are permitted");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	360 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	361 ASSERT(Auth_API_Is_Forced_Password_Change_Only("/api/auth/session"));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	362 ASSERT(Auth_API_Is_Forced_Password_Change_Only("/api/auth/login"));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	363 ASSERT(Auth_API_Is_Forced_Password_Change_Only("/api/auth/logout"));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	364 ASSERT(Auth_API_Is_Forced_Password_Change_Only("/api/auth/password"));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	365 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	366 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	367
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	368 TEST("non-auth paths are not permitted");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	369 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	370 ASSERT(!Auth_API_Is_Forced_Password_Change_Only("/api/conversations"));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	371 ASSERT(!Auth_API_Is_Forced_Password_Change_Only("/jrpg"));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	372 ASSERT(!Auth_API_Is_Forced_Password_Change_Only("/"));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	373 ASSERT(!Auth_API_Is_Forced_Password_Change_Only(NULL));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	374 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	375 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	376 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	377
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	378 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	379 /* Test group: CSRF same-origin checks via session handler */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	380 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	381
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	382 static void test_csrf_and_origin(void)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	383 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	384 printf("\n[csrf and origin]\n");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	385
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	386 char db[256];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	387 make_temp_db(db, sizeof(db));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	388 init_auth(db, TRUE);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	389
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	390 Dowa_Arena arena = Dowa_Arena_Create(64 1024);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	391
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	392 TEST("POST login without Origin header → 403");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	393 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	394 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	395 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	396 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	397 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	398 "Body", "{\"username\":\"u\",\"password\":\"p\",\"csrfToken\":\"t\"}",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	399 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	400 /* No Origin header → same-origin check fails */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	401 /* We cannot directly call the static handler, so we route via the session
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	402 * handler to verify CSRF token is returned, then a login attempt without
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	403 * Origin will fail with 403 via the seobeo route. Since route handlers
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	404 * are static, we test the principal resolver here instead. */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	405 Auth_Principal p;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	406 char nc[512] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	407 boolean ok = Auth_API_Resolve_Principal(req, &p, arena, nc, sizeof(nc));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	408 ASSERT(ok);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	409 ASSERT(p.kind == AUTH_PRINCIPAL_GUEST);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	410 ASSERT(p.csrf_token[0] != '\0');
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	411 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	412 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	413
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	414 TEST("GET session returns csrf_token for guest");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	415 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	416 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	417 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	418 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	419 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	420 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	421
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	422 Auth_Principal p1, p2;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	423 char nc1[512] = {0}, nc2[512] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	424 ASSERT(Auth_API_Resolve_Principal(req, &p1, arena, nc1, sizeof(nc1)));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	425 ASSERT(Auth_API_Resolve_Principal(req, &p2, arena, nc2, sizeof(nc2)));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	426
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	427 /* Two fresh guests have different IDs */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	428 ASSERT(p1.kind == AUTH_PRINCIPAL_GUEST);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	429 ASSERT(p2.kind == AUTH_PRINCIPAL_GUEST);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	430 ASSERT(p1.csrf_token[0] != '\0');
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	431 ASSERT(p2.csrf_token[0] != '\0');
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	432 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	433 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	434
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	435 TEST("CSRF is stable for same guest across calls");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	436 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	437 /* Get a guest cookie, then re-use it in a second request */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	438 Seobeo_Request_Entry *req1 = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	439 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	440 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	441 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	442 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	443
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	444 Auth_Principal p1;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	445 char nc1[512] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	446 ASSERT(Auth_API_Resolve_Principal(req1, &p1, arena, nc1, sizeof(nc1)));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	447 ASSERT(p1.kind == AUTH_PRINCIPAL_GUEST);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	448 /* nc1 now contains "mjj_guest=<signed>; ..." — extract cookie value */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	449 const char *cookie_start = strchr(nc1, '=');
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	450 ASSERT(cookie_start);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	451 cookie_start++;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	452 char cookie_value[AUTH_CRYPTO_GUEST_COOKIE_SIZE] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	453 const char *cookie_end = strchr(cookie_start, ';');
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	454 size_t vlen = cookie_end ? (size_t)(cookie_end - cookie_start)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	455 : strlen(cookie_start);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	456 ASSERT(vlen < sizeof(cookie_value));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	457 memcpy(cookie_value, cookie_start, vlen);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	458
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	459 char cookie_hdr[600];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	460 snprintf(cookie_hdr, sizeof(cookie_hdr), "mjj_guest=%s", cookie_value);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	461
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	462 Seobeo_Request_Entry *req2 = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	463 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	464 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	465 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	466 "Cookie", cookie_hdr,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	467 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	468
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	469 Auth_Principal p2;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	470 char nc2[512] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	471 ASSERT(Auth_API_Resolve_Principal(req2, &p2, arena, nc2, sizeof(nc2)));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	472 ASSERT(p2.kind == AUTH_PRINCIPAL_GUEST);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	473 ASSERT(strcmp(p1.guest_id, p2.guest_id) == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	474 /* CSRF must be the same for the same guest binding */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	475 ASSERT(strcmp(p1.csrf_token, p2.csrf_token) == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	476 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	477 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	478
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	479 TEST("guest cookie with wrong IP binding → new guest");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	480 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	481 /* First request from IP A */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	482 Seobeo_Request_Entry *req_a = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	483 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	484 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	485 "Remote-Addr", "10.1.2.3",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	486 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	487 Auth_Principal pa;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	488 char nc_a[512] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	489 ASSERT(Auth_API_Resolve_Principal(req_a, &pa, arena, nc_a, sizeof(nc_a)));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	490
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	491 /* Extract cookie value */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	492 const char *cs = strchr(nc_a, '=');
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	493 ASSERT(cs); cs++;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	494 char cv[AUTH_CRYPTO_GUEST_COOKIE_SIZE] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	495 const char *ce = strchr(cs, ';');
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	496 size_t vl = ce ? (size_t)(ce - cs) : strlen(cs);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	497 ASSERT(vl < sizeof(cv));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	498 memcpy(cv, cs, vl);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	499
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	500 char cookie_hdr[600];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	501 snprintf(cookie_hdr, sizeof(cookie_hdr), "mjj_guest=%s", cv);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	502
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	503 /* Second request from IP B reusing A's cookie → IP mismatch → new guest */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	504 Seobeo_Request_Entry *req_b = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	505 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	506 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	507 "Remote-Addr", "10.9.9.9",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	508 "Cookie", cookie_hdr,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	509 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	510 Auth_Principal pb;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	511 char nc_b[512] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	512 ASSERT(Auth_API_Resolve_Principal(req_b, &pb, arena, nc_b, sizeof(nc_b)));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	513 ASSERT(pb.kind == AUTH_PRINCIPAL_GUEST);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	514 ASSERT(strcmp(pa.guest_id, pb.guest_id) != 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	515 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	516 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	517
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	518 Dowa_Arena_Free(arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	519 Auth_API_Destroy();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	520 unlink(db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	521 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	522
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	523 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	524 /* Test group: Login and session lifecycle */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	525 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	526
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	527 static void test_login_lifecycle(void)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	528 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	529 printf("\n[login lifecycle]\n");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	530
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	531 char db[256];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	532 make_temp_db(db, sizeof(db));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	533
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	534 /* Create bootstrap admin */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	535 char pw_hash[AUTH_CRYPTO_PASSWORD_HASH_ENCODED_SIZE];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	536 ASSERT(Auth_Crypto_Password_Hash(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	537 "SuperSecret123!", pw_hash, sizeof(pw_hash)) == AUTH_CRYPTO_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	538
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	539 boolean ok = Auth_API_Init(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	540 db, k_secret, sizeof(k_secret),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	541 "testadmin", pw_hash,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	542 NULL, 0, 0, 0, TRUE);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	543 ASSERT(ok);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	544
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	545 Dowa_Arena arena = Dowa_Arena_Create(128 1024);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	546
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	547 /* --- Obtain a guest principal and its CSRF --- */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	548 Seobeo_Request_Entry *guest_req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	549 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	550 "Host", "localhost:6969",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	551 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	552 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	553
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	554 Auth_Principal guest_p;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	555 char nc[512] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	556 ASSERT(Auth_API_Resolve_Principal(guest_req, &guest_p, arena, nc, sizeof(nc)));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	557 ASSERT(guest_p.kind == AUTH_PRINCIPAL_GUEST);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	558
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	559 TEST("login with wrong password returns 401");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	560 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	561 char body[512];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	562 snprintf(body, sizeof(body),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	563 "{\"username\":\"testadmin\","
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	564 "\"password\":\"wrongwrongwrong\","
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	565 "\"csrfToken\":\"%s\"}",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	566 guest_p.csrf_token);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	567
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	568 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	569 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	570 "Host", "localhost:6969",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	571 "Origin", "http://localhost:6969",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	572 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	573 "Body", body,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	574 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	575
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	576 /* Set guest cookie so CSRF resolves */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	577 const char *cs = strchr(nc, '='); ASSERT(cs); cs++;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	578 char cv[AUTH_CRYPTO_GUEST_COOKIE_SIZE] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	579 const char *ce = strchr(cs, ';');
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	580 size_t vl = ce ? (size_t)(ce - cs) : strlen(cs);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	581 memcpy(cv, cs, vl);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	582 char cookie_hdr[600];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	583 snprintf(cookie_hdr, sizeof(cookie_hdr), "mjj_guest=%s", cv);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	584 Dowa_HashMap_Push_Arena(req, "Cookie", cookie_hdr, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	585
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	586 /* We cannot call the static handler directly, so we verify via
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	587 * Resolve_Principal that the CSRF is correct. A real integration
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	588 * test would exercise via HTTP; here we confirm the auth store
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	589 * rejects bad credentials. */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	590 Auth_User_Auth_Record rec;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	591 Auth_Store_Result r = Auth_Store_Find_User_By_Username(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	592 NULL, "testadmin", &rec);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	593 /* NULL store → error is expected */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	594 ASSERT(r != AUTH_STORE_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	595 (void)req;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	596 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	597 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	598
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	599 TEST("rate limit key derivation does not crash");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	600 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	601 /* Indirectly exercised by repeated login attempts.
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	602 * Verify Resolve_Principal still works after 10 calls. */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	603 for (int i = 0; i < 10; i++)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	604 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	605 Seobeo_Request_Entry *r = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	606 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	607 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	608 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	609 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	610 Auth_Principal p;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	611 char c[512] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	612 ASSERT(Auth_API_Resolve_Principal(r, &p, arena, c, sizeof(c)));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	613 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	614 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	615 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	616
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	617 TEST("Auth store lookup works for bootstrap user");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	618 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	619 Auth_Store *store = Auth_Store_Create(db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	620 ASSERT(store);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	621
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	622 Auth_User_Auth_Record rec;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	623 memset(&rec, 0, sizeof(rec));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	624 Auth_Store_Result r = Auth_Store_Find_User_By_Username(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	625 store, "testadmin", &rec);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	626 ASSERT(r == AUTH_STORE_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	627 ASSERT(strcmp(rec.user.role, "admin") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	628 ASSERT(strcmp(rec.user.status, "active") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	629 /* Verify password matches */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	630 ASSERT(Auth_Crypto_Password_Verify("SuperSecret123!", rec.password_hash)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	631 == AUTH_CRYPTO_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	632
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	633 OPENSSL_cleanse(rec.password_hash, sizeof(rec.password_hash));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	634 Auth_Store_Destroy(store);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	635 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	636 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	637
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	638 Dowa_Arena_Free(arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	639 Auth_API_Destroy();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	640 unlink(db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	641 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	642
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	643 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	644 /* Test group: Session expiry / stale */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	645 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	646
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	647 static void test_session_expiry(void)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	648 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	649 printf("\n[session expiry]\n");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	650
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	651 char db[256];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	652 make_temp_db(db, sizeof(db));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	653 init_auth(db, TRUE);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	654
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	655 Dowa_Arena arena = Dowa_Arena_Create(64 1024);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	656
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	657 /* Create a user in the store directly */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	658 Auth_Store *store = Auth_Store_Create(db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	659 ASSERT(store);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	660
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	661 char pw_hash[AUTH_CRYPTO_PASSWORD_HASH_ENCODED_SIZE];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	662 ASSERT(Auth_Crypto_Password_Hash("Password12345!", pw_hash, sizeof(pw_hash))
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	663 == AUTH_CRYPTO_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	664 char user_id[37];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	665 ASSERT(Auth_Store_Create_User(store, "expiry_user", pw_hash,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	666 "member", FALSE, user_id) == AUTH_STORE_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	667
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	668 /* Create an already-expired session */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	669 char token[AUTH_CRYPTO_TOKEN_SIZE];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	670 char token_digest[AUTH_CRYPTO_TOKEN_DIGEST_SIZE];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	671 ASSERT(Auth_Crypto_Token_Generate(token, sizeof(token)) == AUTH_CRYPTO_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	672 ASSERT(Auth_Crypto_Token_Digest(token, token_digest, sizeof(token_digest))
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	673 == AUTH_CRYPTO_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	674
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	675 char csrf[AUTH_CRYPTO_TOKEN_SIZE];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	676 char csrf_digest[AUTH_CRYPTO_TOKEN_DIGEST_SIZE];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	677 ASSERT(Auth_Crypto_Token_Generate(csrf, sizeof(csrf)) == AUTH_CRYPTO_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	678 ASSERT(Auth_Crypto_Token_Digest(csrf, csrf_digest, sizeof(csrf_digest))
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	679 == AUTH_CRYPTO_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	680
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	681 int64 past = (int64)time(NULL) - 10000; /* well in the past */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	682 Auth_Session_Record session;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	683
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	684 /* Create session with expired TTLs (idle/abs both 1 second, 10000s ago) */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	685 ASSERT(Auth_Store_Create_Session(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	686 store, user_id, token_digest, csrf_digest,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	687 1, /* idle_ttl = 1 sec */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	688 1, /* abs_ttl = 1 sec */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	689 past,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	690 &session) == AUTH_STORE_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	691
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	692 TEST("expired session → falls back to guest");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	693 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	694 char cookie_hdr[256];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	695 snprintf(cookie_hdr, sizeof(cookie_hdr), "mjj_session=%s", token);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	696
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	697 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	698 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	699 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	700 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	701 "Cookie", cookie_hdr,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	702 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	703
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	704 Auth_Principal p;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	705 char nc[512] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	706 ASSERT(Auth_API_Resolve_Principal(req, &p, arena, nc, sizeof(nc)));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	707 ASSERT(p.kind == AUTH_PRINCIPAL_GUEST);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	708 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	709 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	710
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	711 /* Create and immediately revoke a session */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	712 char token2[AUTH_CRYPTO_TOKEN_SIZE];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	713 char token2_digest[AUTH_CRYPTO_TOKEN_DIGEST_SIZE];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	714 ASSERT(Auth_Crypto_Token_Generate(token2, sizeof(token2)) == AUTH_CRYPTO_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	715 ASSERT(Auth_Crypto_Token_Digest(token2, token2_digest, sizeof(token2_digest))
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	716 == AUTH_CRYPTO_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	717
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	718 int64 now = (int64)time(NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	719 Auth_Session_Record session2;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	720 ASSERT(Auth_Store_Create_Session(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	721 store, user_id, token2_digest, csrf_digest,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	722 3600, 86400, now, &session2) == AUTH_STORE_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	723 ASSERT(Auth_Store_Revoke_Session(store, token2_digest) == AUTH_STORE_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	724
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	725 TEST("revoked session → falls back to guest");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	726 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	727 char cookie_hdr[256];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	728 snprintf(cookie_hdr, sizeof(cookie_hdr), "mjj_session=%s", token2);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	729
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	730 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	731 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	732 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	733 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	734 "Cookie", cookie_hdr,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	735 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	736
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	737 Auth_Principal p;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	738 char nc[512] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	739 ASSERT(Auth_API_Resolve_Principal(req, &p, arena, nc, sizeof(nc)));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	740 ASSERT(p.kind == AUTH_PRINCIPAL_GUEST);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	741 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	742 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	743
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	744 /* Disabled user */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	745 Auth_Store_Update_User_Status(store, user_id, "disabled", user_id);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	746
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	747 char token3[AUTH_CRYPTO_TOKEN_SIZE];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	748 char token3_digest[AUTH_CRYPTO_TOKEN_DIGEST_SIZE];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	749 ASSERT(Auth_Crypto_Token_Generate(token3, sizeof(token3)) == AUTH_CRYPTO_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	750 ASSERT(Auth_Crypto_Token_Digest(token3, token3_digest, sizeof(token3_digest))
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	751 == AUTH_CRYPTO_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	752 Auth_Session_Record session3;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	753 Auth_Store_Create_Session(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	754 store, user_id, token3_digest, csrf_digest,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	755 3600, 86400, now, &session3);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	756
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	757 TEST("session for disabled user → falls back to guest");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	758 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	759 char cookie_hdr[256];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	760 snprintf(cookie_hdr, sizeof(cookie_hdr), "mjj_session=%s", token3);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	761
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	762 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	763 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	764 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	765 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	766 "Cookie", cookie_hdr,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	767 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	768
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	769 Auth_Principal p;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	770 char nc[512] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	771 ASSERT(Auth_API_Resolve_Principal(req, &p, arena, nc, sizeof(nc)));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	772 ASSERT(p.kind == AUTH_PRINCIPAL_GUEST);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	773 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	774 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	775
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	776 Auth_Store_Destroy(store);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	777 Dowa_Arena_Free(arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	778 Auth_API_Destroy();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	779 unlink(db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	780 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	781
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	782 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	783 /* Test group: Guest transfer hook */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	784 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	785
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	786 static char g_hook_guest_id[37] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	787 static char g_hook_user_id[37] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	788 static int g_hook_call_count = 0;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	789
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	790 static boolean test_transfer_hook_fn(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	791 const char *guest_id,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	792 const char *user_id,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	793 void *context)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	794 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	795 (void)context;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	796 strncpy(g_hook_guest_id, guest_id, 36);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	797 strncpy(g_hook_user_id, user_id, 36);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	798 g_hook_call_count++;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	799 return TRUE;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	800 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	801
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	802 static void test_transfer_hook(void)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	803 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	804 printf("\n[transfer hook]\n");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	805
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	806 TEST("register and retrieve hook without crash");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	807 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	808 Auth_API_Register_Guest_Transfer_Hook(test_transfer_hook_fn, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	809 /* Reset */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	810 Auth_API_Register_Guest_Transfer_Hook(NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	811 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	812 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	813 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	814
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	815 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	816 /* Test group: Rate limiter */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	817 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	818
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	819 static void test_rate_limiter(void)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	820 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	821 printf("\n[rate limiter]\n");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	822
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	823 char db[256];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	824 make_temp_db(db, sizeof(db));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	825 init_auth(db, TRUE);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	826 Dowa_Arena arena = Dowa_Arena_Create(64 1024);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	827
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	828 TEST("session endpoint survives rapid calls (no crash)");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	829 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	830 for (int i = 0; i < 20; i++)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	831 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	832 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	833 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	834 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	835 "Remote-Addr", "127.0.0.2",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	836 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	837 Auth_Principal p;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	838 char nc[512] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	839 ASSERT(Auth_API_Resolve_Principal(req, &p, arena, nc, sizeof(nc)));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	840 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	841 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	842 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	843
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	844 Dowa_Arena_Free(arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	845 Auth_API_Destroy();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	846 unlink(db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	847 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	848
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	849 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	850 /* Test group: Secure-cookie policy */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	851 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	852
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	853 static void test_secure_cookie_policy(void)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	854 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	855 printf("\n[secure cookie policy]\n");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	856
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	857 char db[256];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	858 make_temp_db(db, sizeof(db));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	859
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	860 TEST("dev insecure mode allowed (no crash)");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	861 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	862 boolean ok = Auth_API_Init(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	863 db, k_secret, sizeof(k_secret),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	864 NULL, NULL, NULL, 0, 0, 0, TRUE);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	865 ASSERT(ok);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	866 Auth_API_Destroy();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	867 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	868 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	869
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	870 TEST("production secure mode allowed (no crash)");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	871 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	872 boolean ok = Auth_API_Init(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	873 db, k_secret, sizeof(k_secret),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	874 NULL, NULL, NULL, 0, 0, 0, FALSE);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	875 ASSERT(ok);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	876
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	877 /* New guest cookie should contain '; Secure' */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	878 Dowa_Arena arena = Dowa_Arena_Create(32 1024);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	879 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	880 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	881 "Host", "example.com",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	882 "Remote-Addr", "203.0.113.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	883 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	884 Auth_Principal p;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	885 char nc[512] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	886 ASSERT(Auth_API_Resolve_Principal(req, &p, arena, nc, sizeof(nc)));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	887 ASSERT(strstr(nc, "Secure") != NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	888 Dowa_Arena_Free(arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	889 Auth_API_Destroy();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	890 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	891 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	892
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	893 unlink(db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	894 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	895
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	896 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	897 /* Helpers */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	898 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	899
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	900 /*
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	901 * Get the "status" field from a handler response map.
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	902 * Returns "200" if no status field (Seobeo default).
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	903 */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	904 static const char resp_status(Seobeo_Request_Entry resp)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	905 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	906 void *p = Dowa_HashMap_Get_Ptr(resp, "status");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	907 return p ? ((Seobeo_Request_Entry *)p)->value : "200";
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	908 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	909
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	910 /*
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	911 * Get a named field from a handler response map, or NULL.
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	912 */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	913 static const char resp_field(Seobeo_Request_Entry resp, const char *field)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	914 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	915 void p = Dowa_HashMap_Get_Ptr(resp, (char )field);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	916 return p ? ((Seobeo_Request_Entry *)p)->value : NULL;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	917 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	918
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	919 /*
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	920 * Init auth with a bootstrap admin and return the admin password.
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	921 * Writes the password hash into pw_hash_out.
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	922 */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	923 static const char *k_admin_password = "SuperSecret123!";
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	924
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	925 typedef struct {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	926 Auth_Store *store;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	927 char user_id[37];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	928 char replacement_hash[AUTH_CRYPTO_PASSWORD_HASH_ENCODED_SIZE];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	929 Auth_Store_Result result;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	930 } Login_Race_Context;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	931
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	932 static void reset_password_before_session_create(void *p_context)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	933 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	934 Login_Race_Context context = (Login_Race_Context )p_context;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	935 context->result = Auth_Store_Admin_Reset_Password(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	936 context->store, context->user_id, context->replacement_hash, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	937 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	938
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	939 static void init_auth_with_admin(const char *db,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	940 char *pw_hash_out)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	941 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	942 ASSERT(Auth_Crypto_Password_Hash(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	943 k_admin_password, pw_hash_out,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	944 AUTH_CRYPTO_PASSWORD_HASH_ENCODED_SIZE) == AUTH_CRYPTO_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	945 boolean ok = Auth_API_Init(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	946 db, k_secret, sizeof(k_secret),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	947 "admin", pw_hash_out,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	948 NULL,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	949 AUTH_API_SESSION_IDLE_TTL_DEFAULT,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	950 AUTH_API_SESSION_ABS_TTL_DEFAULT,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	951 AUTH_API_GUEST_TTL_DEFAULT,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	952 TRUE);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	953 ASSERT(ok);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	954 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	955
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	956 /*
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	957 * Extract a cookie value from a Set-Cookie directive string.
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	958 * e.g. "mjj_session=ABCD...; Path=/; HttpOnly" → "ABCD..."
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	959 * Returns the start in the out buffer; returns FALSE on failure.
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	960 */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	961 static boolean extract_cookie_value(const char *set_cookie_header,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	962 const char *cookie_name,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	963 char *out, size_t capacity)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	964 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	965 size_t nlen = strlen(cookie_name);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	966 if (strncmp(set_cookie_header, cookie_name, nlen) != 0 \|\|
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	967 set_cookie_header[nlen] != '=')
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	968 return FALSE;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	969 const char *start = set_cookie_header + nlen + 1;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	970 const char *end = strchr(start, ';');
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	971 size_t vlen = end ? (size_t)(end - start) : strlen(start);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	972 if (vlen >= capacity) return FALSE;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	973 memcpy(out, start, vlen);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	974 out[vlen] = '\0';
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	975 return TRUE;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	976 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	977
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	978 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	979 /* Test group: CSRF token length (issue 1 regression) */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	980 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	981
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	982 static void test_csrf_token_length(void)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	983 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	984 printf("\n[csrf token length]\n");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	985
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	986 char db[256];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	987 make_temp_db(db, sizeof(db));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	988 init_auth(db, TRUE);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	989 Dowa_Arena arena = Dowa_Arena_Create(32 1024);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	990
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	991 TEST("derived CSRF token is exactly AUTH_CRYPTO_TOKEN_SIZE-1 chars (43)");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	992 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	993 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	994 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	995 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	996 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	997 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	998 Auth_Principal p;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	999 char nc[512] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1000 ASSERT(Auth_API_Resolve_Principal(req, &p, arena, nc, sizeof(nc)));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1001 size_t csrf_len = strlen(p.csrf_token);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1002 ASSERT(csrf_len == AUTH_CRYPTO_TOKEN_SIZE - 1);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1003 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1004 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1005
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1006 TEST("Auth_Crypto_Base64url_Encode produces 43 chars for 32 bytes");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1007 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1008 uint8 bytes[32] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1009 char out[AUTH_CRYPTO_TOKEN_SIZE] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1010 size_t n = Auth_Crypto_Base64url_Encode(bytes, 32, out, sizeof(out));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1011 ASSERT(n == AUTH_CRYPTO_TOKEN_SIZE - 1);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1012 ASSERT(strlen(out) == AUTH_CRYPTO_TOKEN_SIZE - 1);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1013 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1014 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1015
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1016 Dowa_Arena_Free(arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1017 Auth_API_Destroy();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1018 unlink(db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1019 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1020
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1021 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1022 /* Test group: Handler-level CSRF + origin via test hooks (issue 8) */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1023 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1024
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1025 static void test_handler_login_flow(void)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1026 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1027 printf("\n[handler login flow]\n");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1028
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1029 char db[256];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1030 make_temp_db(db, sizeof(db));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1031 char pw_hash[AUTH_CRYPTO_PASSWORD_HASH_ENCODED_SIZE];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1032 init_auth_with_admin(db, pw_hash);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1033 Dowa_Arena arena = Dowa_Arena_Create(256 1024);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1034
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1035 /* --- Get a guest session to obtain a valid CSRF token --- */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1036 Seobeo_Request_Entry *session_req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1037 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1038 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1039 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1040 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1041 Seobeo_Request_Entry *session_resp =
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1042 Auth_API_Test_Session_Handler(session_req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1043 ASSERT(session_resp);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1044 const char *session_body = resp_field(session_resp, "body");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1045 ASSERT(session_body);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1046
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1047 /* Extract csrf_token and guest cookie from response */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1048 const char *csrf_start = strstr(session_body, "\"csrfToken\":\"");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1049 ASSERT(csrf_start);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1050 csrf_start += strlen("\"csrfToken\":\"");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1051 char csrf_token[AUTH_CRYPTO_TOKEN_SIZE] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1052 const char *csrf_end = strchr(csrf_start, '"');
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1053 ASSERT(csrf_end);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1054 size_t csrf_len = (size_t)(csrf_end - csrf_start);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1055 ASSERT(csrf_len == AUTH_CRYPTO_TOKEN_SIZE - 1);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1056 memcpy(csrf_token, csrf_start, csrf_len);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1057
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1058 /* Extract guest cookie directive */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1059 const char *guest_set_cookie = resp_field(session_resp, "Set-Cookie");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1060 char guest_cookie_val[AUTH_CRYPTO_GUEST_COOKIE_SIZE] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1061 if (guest_set_cookie)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1062 extract_cookie_value(guest_set_cookie, AUTH_API_GUEST_COOKIE_NAME,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1063 guest_cookie_val, sizeof(guest_cookie_val));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1064
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1065 TEST("malformed JSON login payload returns 400 without hanging");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1066 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1067 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1068 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1069 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1070 "Origin", "http://localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1071 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1072 "Body", "{\"username\":[x]}",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1073 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1074 Seobeo_Request_Entry *resp = Auth_API_Test_Login_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1075 ASSERT(resp);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1076 ASSERT(strcmp(resp_status(resp), "400") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1077 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1078 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1079
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1080 TEST("POST login without Origin → 403");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1081 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1082 char body[512];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1083 snprintf(body, sizeof(body),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1084 "{\"username\":\"admin\",\"password\":\"%s\","
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1085 "\"csrfToken\":\"%s\"}",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1086 k_admin_password, csrf_token);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1087 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1088 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1089 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1090 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1091 "Body", body,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1092 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1093 Seobeo_Request_Entry *resp = Auth_API_Test_Login_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1094 ASSERT(resp);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1095 ASSERT(strcmp(resp_status(resp), "403") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1096 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1097 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1098
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1099 TEST("POST login with wrong Origin → 403");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1100 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1101 char body[512];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1102 snprintf(body, sizeof(body),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1103 "{\"username\":\"admin\",\"password\":\"%s\","
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1104 "\"csrfToken\":\"%s\"}",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1105 k_admin_password, csrf_token);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1106 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1107 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1108 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1109 "Origin", "http://evil.example.com",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1110 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1111 "Body", body,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1112 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1113 Seobeo_Request_Entry *resp = Auth_API_Test_Login_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1114 ASSERT(resp);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1115 ASSERT(strcmp(resp_status(resp), "403") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1116 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1117 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1118
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1119 TEST("POST login with invalid CSRF → 403");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1120 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1121 char body[512];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1122 /* Use an all-A CSRF token which will not match the derived one */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1123 snprintf(body, sizeof(body),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1124 "{\"username\":\"admin\",\"password\":\"%s\","
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1125 "\"csrfToken\":\"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"}",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1126 k_admin_password);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1127 char cookie_hdr[600] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1128 if (guest_cookie_val[0])
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1129 snprintf(cookie_hdr, sizeof(cookie_hdr),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1130 "%s=%s", AUTH_API_GUEST_COOKIE_NAME, guest_cookie_val);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1131 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1132 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1133 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1134 "Origin", "http://localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1135 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1136 "Body", body,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1137 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1138 if (cookie_hdr[0])
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1139 Dowa_HashMap_Push_Arena(req, "Cookie", cookie_hdr, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1140 Seobeo_Request_Entry *resp = Auth_API_Test_Login_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1141 ASSERT(resp);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1142 ASSERT(strcmp(resp_status(resp), "403") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1143 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1144 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1145
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1146 TEST("POST login with valid CSRF + correct credentials → 200 + session cookie");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1147 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1148 char body[512];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1149 snprintf(body, sizeof(body),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1150 "{\"username\":\"admin\",\"password\":\"%s\","
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1151 "\"csrfToken\":\"%s\"}",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1152 k_admin_password, csrf_token);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1153 char cookie_hdr[600] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1154 if (guest_cookie_val[0])
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1155 snprintf(cookie_hdr, sizeof(cookie_hdr),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1156 "%s=%s", AUTH_API_GUEST_COOKIE_NAME, guest_cookie_val);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1157 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1158 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1159 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1160 "Origin", "http://localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1161 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1162 "Body", body,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1163 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1164 if (cookie_hdr[0])
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1165 Dowa_HashMap_Push_Arena(req, "Cookie", cookie_hdr, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1166 Seobeo_Request_Entry *resp = Auth_API_Test_Login_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1167 ASSERT(resp);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1168 ASSERT(strcmp(resp_status(resp), "200") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1169 const char *sc = resp_field(resp, "Set-Cookie");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1170 ASSERT(sc && strstr(sc, AUTH_API_SESSION_COOKIE_NAME));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1171 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1172 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1173
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1174 TEST("password reset between verify and session create returns generic 401");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1175 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1176 Login_Race_Context context;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1177 memset(&context, 0, sizeof(context));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1178 context.store = Auth_API_Get_Store();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1179 context.result = AUTH_STORE_ERROR;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1180
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1181 Auth_User_Auth_Record record;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1182 memset(&record, 0, sizeof(record));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1183 ASSERT(Auth_Store_Find_User_By_Username(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1184 context.store, "admin", &record) == AUTH_STORE_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1185 memcpy(context.user_id, record.user.id, sizeof(context.user_id));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1186 OPENSSL_cleanse(record.password_hash, sizeof(record.password_hash));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1187 ASSERT(Auth_Crypto_Password_Hash(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1188 "ResetPassword123!", context.replacement_hash,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1189 sizeof(context.replacement_hash)) == AUTH_CRYPTO_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1190
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1191 char body[512];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1192 snprintf(body, sizeof(body),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1193 "{\"username\":\"admin\",\"password\":\"%s\","
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1194 "\"csrfToken\":\"%s\"}",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1195 k_admin_password, csrf_token);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1196 char cookie_hdr[600] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1197 if (guest_cookie_val[0])
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1198 snprintf(cookie_hdr, sizeof(cookie_hdr),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1199 "%s=%s", AUTH_API_GUEST_COOKIE_NAME, guest_cookie_val);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1200 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1201 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1202 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1203 "Origin", "http://localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1204 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1205 "Body", body,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1206 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1207 if (cookie_hdr[0])
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1208 Dowa_HashMap_Push_Arena(req, "Cookie", cookie_hdr, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1209
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1210 Auth_API_Test_Set_Login_Pre_Create_Hook(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1211 reset_password_before_session_create, &context);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1212 Seobeo_Request_Entry *resp = Auth_API_Test_Login_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1213 Auth_API_Test_Set_Login_Pre_Create_Hook(NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1214
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1215 ASSERT(context.result == AUTH_STORE_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1216 ASSERT(resp);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1217 ASSERT(strcmp(resp_status(resp), "401") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1218 ASSERT(strstr(resp_field(resp, "body"), "invalid_credentials") != NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1219 ASSERT(resp_field(resp, "Set-Cookie") == NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1220 OPENSSL_cleanse(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1221 context.replacement_hash, sizeof(context.replacement_hash));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1222 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1223 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1224
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1225 Dowa_Arena_Free(arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1226 Auth_API_Destroy();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1227 unlink(db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1228 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1229
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1230 static void test_handler_logout_flow(void)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1231 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1232 printf("\n[handler logout flow]\n");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1233
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1234 char db[256];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1235 make_temp_db(db, sizeof(db));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1236 char pw_hash[AUTH_CRYPTO_PASSWORD_HASH_ENCODED_SIZE];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1237 init_auth_with_admin(db, pw_hash);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1238 Dowa_Arena arena = Dowa_Arena_Create(256 1024);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1239
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1240 /* Log in to get a session */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1241 Seobeo_Request_Entry *session_req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1242 arena, "Host", "localhost", "Remote-Addr", "127.0.0.1", NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1243 Seobeo_Request_Entry *session_resp =
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1244 Auth_API_Test_Session_Handler(session_req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1245 const char *session_body = resp_field(session_resp, "body");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1246 ASSERT(session_body);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1247 const char *csrf_start = strstr(session_body, "\"csrfToken\":\"");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1248 ASSERT(csrf_start); csrf_start += strlen("\"csrfToken\":\"");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1249 char csrf_token[AUTH_CRYPTO_TOKEN_SIZE] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1250 const char *csrf_end = strchr(csrf_start, '"');
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1251 size_t csrf_len = (size_t)(csrf_end - csrf_start);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1252 memcpy(csrf_token, csrf_start, csrf_len);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1253
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1254 const char *guest_sc = resp_field(session_resp, "Set-Cookie");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1255 char guest_cookie_val[AUTH_CRYPTO_GUEST_COOKIE_SIZE] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1256 if (guest_sc)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1257 extract_cookie_value(guest_sc, AUTH_API_GUEST_COOKIE_NAME,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1258 guest_cookie_val, sizeof(guest_cookie_val));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1259
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1260 char login_body[512];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1261 snprintf(login_body, sizeof(login_body),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1262 "{\"username\":\"admin\",\"password\":\"%s\",\"csrfToken\":\"%s\"}",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1263 k_admin_password, csrf_token);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1264 char cookie_hdr[600] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1265 if (guest_cookie_val[0])
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1266 snprintf(cookie_hdr, sizeof(cookie_hdr),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1267 "%s=%s", AUTH_API_GUEST_COOKIE_NAME, guest_cookie_val);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1268 Seobeo_Request_Entry *login_req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1269 arena, "Host", "localhost", "Origin", "http://localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1270 "Remote-Addr", "127.0.0.1", "Body", login_body, NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1271 if (cookie_hdr[0])
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1272 Dowa_HashMap_Push_Arena(login_req, "Cookie", cookie_hdr, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1273 Seobeo_Request_Entry *login_resp =
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1274 Auth_API_Test_Login_Handler(login_req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1275 ASSERT(login_resp && strcmp(resp_status(login_resp), "200") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1276
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1277 /* Extract session token from login response */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1278 const char *session_sc = resp_field(login_resp, "Set-Cookie");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1279 ASSERT(session_sc);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1280 char session_token[COOKIE_VALUE_MAX] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1281 ASSERT(extract_cookie_value(session_sc, AUTH_API_SESSION_COOKIE_NAME,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1282 session_token, sizeof(session_token)));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1283 ASSERT(session_token[0] != '\0');
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1284
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1285 /* Extract new CSRF from login body */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1286 const char *login_body_resp = resp_field(login_resp, "body");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1287 ASSERT(login_body_resp);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1288 const char *lcs = strstr(login_body_resp, "\"csrfToken\":\"");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1289 ASSERT(lcs); lcs += strlen("\"csrfToken\":\"");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1290 char login_csrf[AUTH_CRYPTO_TOKEN_SIZE] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1291 const char *lce = strchr(lcs, '"');
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1292 memcpy(login_csrf, lcs, (size_t)(lce - lcs));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1293
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1294 TEST("POST logout with wrong CSRF → 403");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1295 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1296 char session_cookie[600];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1297 snprintf(session_cookie, sizeof(session_cookie),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1298 "%s=%s", AUTH_API_SESSION_COOKIE_NAME, session_token);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1299 char logout_body[256];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1300 snprintf(logout_body, sizeof(logout_body),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1301 "{\"csrfToken\":\"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"}");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1302 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1303 arena, "Host", "localhost", "Origin", "http://localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1304 "Remote-Addr", "127.0.0.1", "Cookie", session_cookie,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1305 "Body", logout_body, NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1306 Seobeo_Request_Entry *resp = Auth_API_Test_Logout_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1307 ASSERT(resp && strcmp(resp_status(resp), "403") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1308 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1309 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1310
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1311 TEST("POST logout with valid CSRF → 200, session cookie cleared");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1312 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1313 char session_cookie[600];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1314 snprintf(session_cookie, sizeof(session_cookie),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1315 "%s=%s", AUTH_API_SESSION_COOKIE_NAME, session_token);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1316 char logout_body[256];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1317 snprintf(logout_body, sizeof(logout_body),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1318 "{\"csrfToken\":\"%s\"}", login_csrf);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1319 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1320 arena, "Host", "localhost", "Origin", "http://localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1321 "Remote-Addr", "127.0.0.1", "Cookie", session_cookie,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1322 "Body", logout_body, NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1323 Seobeo_Request_Entry *resp = Auth_API_Test_Logout_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1324 ASSERT(resp && strcmp(resp_status(resp), "200") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1325 /* Session cookie should be cleared (Max-Age=0) */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1326 const char *sc_hdr = resp_field(resp, "Set-Cookie");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1327 ASSERT(sc_hdr && strstr(sc_hdr, "Max-Age=0"));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1328 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1329 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1330
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1331 Dowa_Arena_Free(arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1332 Auth_API_Destroy();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1333 unlink(db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1334 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1335
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1336 static void test_handler_password_flow(void)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1337 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1338 printf("\n[handler password flow]\n");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1339
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1340 char db[256];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1341 make_temp_db(db, sizeof(db));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1342 char pw_hash[AUTH_CRYPTO_PASSWORD_HASH_ENCODED_SIZE];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1343 init_auth_with_admin(db, pw_hash);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1344 Dowa_Arena arena = Dowa_Arena_Create(512 1024);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1345
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1346 /* Log in */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1347 Seobeo_Request_Entry *s0 = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1348 arena, "Host", "localhost", "Remote-Addr", "127.0.0.1", NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1349 Seobeo_Request_Entry *sr0 = Auth_API_Test_Session_Handler(s0, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1350 const char *sb0 = resp_field(sr0, "body");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1351 ASSERT(sb0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1352 const char *c0s = strstr(sb0, "\"csrfToken\":\"");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1353 ASSERT(c0s); c0s += strlen("\"csrfToken\":\"");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1354 char csrf0[AUTH_CRYPTO_TOKEN_SIZE] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1355 memcpy(csrf0, c0s, AUTH_CRYPTO_TOKEN_SIZE - 1);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1356
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1357 const char *gsc = resp_field(sr0, "Set-Cookie");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1358 char gcv[AUTH_CRYPTO_GUEST_COOKIE_SIZE] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1359 if (gsc) extract_cookie_value(gsc, AUTH_API_GUEST_COOKIE_NAME, gcv, sizeof(gcv));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1360
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1361 char lb[512];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1362 snprintf(lb, sizeof(lb),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1363 "{\"username\":\"admin\",\"password\":\"%s\",\"csrfToken\":\"%s\"}",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1364 k_admin_password, csrf0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1365 char ck[600] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1366 if (gcv[0]) snprintf(ck, sizeof(ck), "%s=%s", AUTH_API_GUEST_COOKIE_NAME, gcv);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1367 Seobeo_Request_Entry *lr = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1368 arena, "Host", "localhost", "Origin", "http://localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1369 "Remote-Addr", "127.0.0.1", "Body", lb, NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1370 if (ck[0]) Dowa_HashMap_Push_Arena(lr, "Cookie", ck, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1371 Seobeo_Request_Entry *lresp = Auth_API_Test_Login_Handler(lr, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1372 ASSERT(lresp && strcmp(resp_status(lresp), "200") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1373
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1374 char session_tok[COOKIE_VALUE_MAX] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1375 const char *lsc = resp_field(lresp, "Set-Cookie");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1376 ASSERT(extract_cookie_value(lsc, AUTH_API_SESSION_COOKIE_NAME,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1377 session_tok, sizeof(session_tok)));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1378 const char *lb2 = resp_field(lresp, "body");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1379 ASSERT(lb2);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1380 const char *lcs = strstr(lb2, "\"csrfToken\":\"");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1381 ASSERT(lcs); lcs += strlen("\"csrfToken\":\"");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1382 char user_csrf[AUTH_CRYPTO_TOKEN_SIZE] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1383 const char *lce = strchr(lcs, '"');
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1384 memcpy(user_csrf, lcs, (size_t)(lce - lcs));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1385
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1386 char sess_cookie[600];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1387 snprintf(sess_cookie, sizeof(sess_cookie),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1388 "%s=%s", AUTH_API_SESSION_COOKIE_NAME, session_tok);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1389
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1390 TEST("POST password with wrong CSRF → 403");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1391 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1392 char body[512];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1393 snprintf(body, sizeof(body),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1394 "{\"currentPassword\":\"%s\","
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1395 "\"newPassword\":\"NewPassword123!\","
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1396 "\"csrfToken\":\"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"}",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1397 k_admin_password);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1398 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1399 arena, "Host", "localhost", "Origin", "http://localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1400 "Remote-Addr", "127.0.0.1", "Cookie", sess_cookie,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1401 "Body", body, NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1402 Seobeo_Request_Entry *resp = Auth_API_Test_Password_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1403 ASSERT(resp && strcmp(resp_status(resp), "403") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1404 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1405 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1406
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1407 TEST("POST password with wrong current password → 401");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1408 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1409 char body[512];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1410 snprintf(body, sizeof(body),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1411 "{\"currentPassword\":\"WRONG_PASSWORD_123!\","
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1412 "\"newPassword\":\"NewPassword123!\","
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1413 "\"csrfToken\":\"%s\"}", user_csrf);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1414 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1415 arena, "Host", "localhost", "Origin", "http://localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1416 "Remote-Addr", "127.0.0.1", "Cookie", sess_cookie,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1417 "Body", body, NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1418 Seobeo_Request_Entry *resp = Auth_API_Test_Password_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1419 ASSERT(resp && strcmp(resp_status(resp), "401") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1420 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1421 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1422
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1423 TEST("POST password with valid CSRF + correct current → 200 + new session cookie");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1424 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1425 const char *new_password = "NewSecurePass456!";
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1426 char body[512];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1427 snprintf(body, sizeof(body),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1428 "{\"currentPassword\":\"%s\","
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1429 "\"newPassword\":\"%s\","
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1430 "\"csrfToken\":\"%s\"}",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1431 k_admin_password, new_password, user_csrf);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1432 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1433 arena, "Host", "localhost", "Origin", "http://localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1434 "Remote-Addr", "127.0.0.1", "Cookie", sess_cookie,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1435 "Body", body, NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1436 Seobeo_Request_Entry *resp = Auth_API_Test_Password_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1437 ASSERT(resp);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1438 ASSERT(strcmp(resp_status(resp), "200") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1439 const char *new_sc = resp_field(resp, "Set-Cookie");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1440 ASSERT(new_sc && strstr(new_sc, AUTH_API_SESSION_COOKIE_NAME));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1441 /* Old session should now be revoked */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1442 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1443 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1444
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1445 Dowa_Arena_Free(arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1446 Auth_API_Destroy();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1447 unlink(db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1448 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1449
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1450 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1451 /* Test group: Forced password change redirect (issue 7) */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1452 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1453
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1454 static void test_forced_password_change_redirect(void)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1455 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1456 printf("\n[forced password change redirect]\n");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1457
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1458 TEST("/account/password is in forced-change-only list");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1459 ASSERT(Auth_API_Is_Forced_Password_Change_Only(AUTH_API_PATH_PASSWORD_PAGE));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1460 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1461
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1462 TEST("standard auth paths still in forced-change-only list");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1463 ASSERT(Auth_API_Is_Forced_Password_Change_Only(AUTH_API_PATH_SESSION));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1464 ASSERT(Auth_API_Is_Forced_Password_Change_Only(AUTH_API_PATH_LOGIN));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1465 ASSERT(Auth_API_Is_Forced_Password_Change_Only(AUTH_API_PATH_LOGOUT));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1466 ASSERT(Auth_API_Is_Forced_Password_Change_Only(AUTH_API_PATH_PASSWORD));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1467 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1468
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1469 TEST("non-auth paths excluded");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1470 ASSERT(!Auth_API_Is_Forced_Password_Change_Only("/jrpg"));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1471 ASSERT(!Auth_API_Is_Forced_Password_Change_Only("/api/conversations"));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1472 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1473 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1474
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1475 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1476 /* Test group: Transfer hook failure (issue 6) */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1477 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1478
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1479 static boolean g_transfer_fail_hook_called = FALSE;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1480
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1481 static boolean transfer_always_fail(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1482 const char guest_id, const char user_id, void *context)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1483 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1484 (void)guest_id; (void)user_id; (void)context;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1485 g_transfer_fail_hook_called = TRUE;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1486 return FALSE;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1487 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1488
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1489 static void test_transfer_hook_failure(void)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1490 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1491 printf("\n[transfer hook failure]\n");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1492
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1493 char db[256];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1494 make_temp_db(db, sizeof(db));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1495 char pw_hash[AUTH_CRYPTO_PASSWORD_HASH_ENCODED_SIZE];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1496 init_auth_with_admin(db, pw_hash);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1497 Auth_API_Register_Guest_Transfer_Hook(transfer_always_fail, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1498
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1499 Dowa_Arena arena = Dowa_Arena_Create(256 1024);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1500
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1501 /* Get guest session + CSRF */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1502 Seobeo_Request_Entry *s0 = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1503 arena, "Host", "localhost", "Remote-Addr", "127.0.0.1", NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1504 Seobeo_Request_Entry *sr0 = Auth_API_Test_Session_Handler(s0, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1505 const char *sb0 = resp_field(sr0, "body");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1506 ASSERT(sb0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1507 const char *c0s = strstr(sb0, "\"csrfToken\":\"");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1508 ASSERT(c0s); c0s += strlen("\"csrfToken\":\"");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1509 char csrf0[AUTH_CRYPTO_TOKEN_SIZE] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1510 memcpy(csrf0, c0s, AUTH_CRYPTO_TOKEN_SIZE - 1);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1511
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1512 const char *gsc = resp_field(sr0, "Set-Cookie");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1513 char gcv[AUTH_CRYPTO_GUEST_COOKIE_SIZE] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1514 if (gsc) extract_cookie_value(gsc, AUTH_API_GUEST_COOKIE_NAME, gcv, sizeof(gcv));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1515
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1516 TEST("login with failing transfer hook → 500, no session cookie, guest preserved");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1517 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1518 g_transfer_fail_hook_called = FALSE;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1519
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1520 char lb[512];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1521 snprintf(lb, sizeof(lb),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1522 "{\"username\":\"admin\",\"password\":\"%s\","
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1523 "\"csrfToken\":\"%s\"}",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1524 k_admin_password, csrf0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1525 char ck[600] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1526 if (gcv[0])
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1527 snprintf(ck, sizeof(ck), "%s=%s", AUTH_API_GUEST_COOKIE_NAME, gcv);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1528 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1529 arena, "Host", "localhost", "Origin", "http://localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1530 "Remote-Addr", "127.0.0.1", "Body", lb, NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1531 if (ck[0]) Dowa_HashMap_Push_Arena(req, "Cookie", ck, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1532
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1533 Seobeo_Request_Entry *resp = Auth_API_Test_Login_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1534 ASSERT(resp);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1535 ASSERT(strcmp(resp_status(resp), "500") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1536 ASSERT(g_transfer_fail_hook_called);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1537 /* No session cookie should be set */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1538 const char *sc = resp_field(resp, "Set-Cookie");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1539 ASSERT(!sc \|\| !strstr(sc, AUTH_API_SESSION_COOKIE_NAME));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1540 /* No clear-guest cookie either (guest preserved) */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1541 ASSERT(!sc \|\| !strstr(sc, "Max-Age=0"));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1542 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1543 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1544
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1545 Auth_API_Register_Guest_Transfer_Hook(NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1546 Dowa_Arena_Free(arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1547 Auth_API_Destroy();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1548 unlink(db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1549 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1550
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1551 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1552 /* Test group: Rate limiter collision safety (issue 4) */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1553 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1554
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1555 static void test_rate_limiter_collision(void)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1556 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1557 printf("\n[rate limiter collision]\n");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1558
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1559 char db[256];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1560 make_temp_db(db, sizeof(db));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1561 init_auth(db, TRUE);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1562
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1563 /* Access internal rate functions indirectly via the login handler.
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1564 * Two different users from different IPs should not reset each other. */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1565
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1566 TEST("rate table handles many distinct keys without crash");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1567 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1568 Dowa_Arena arena = Dowa_Arena_Create(512 1024);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1569 /* Issue 256+ login attempts from different request contexts */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1570 for (int i = 0; i < 300; i++)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1571 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1572 char ip[32];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1573 snprintf(ip, sizeof(ip), "10.%d.%d.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1574 (i / 256) & 0xff, i & 0xff);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1575 char body[256];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1576 snprintf(body, sizeof(body),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1577 "{\"username\":\"u%d\",\"password\":\"password12345678\","
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1578 "\"csrfToken\":\"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"}",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1579 i);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1580 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1581 arena, "Host", "localhost", "Origin", "http://localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1582 "Remote-Addr", ip, "Body", body, NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1583 /* All will fail CSRF, which is fine — we just want no crash */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1584 Seobeo_Request_Entry *resp = Auth_API_Test_Login_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1585 (void)resp;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1586 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1587 Dowa_Arena_Free(arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1588 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1589 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1590
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1591 TEST("rate limit for key A does not affect unrelated key B");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1592 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1593 /* This exercises that rate_check returns FALSE for fresh keys.
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1594 * We verify by running many requests from IP A (distinct user) and
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1595 * then checking IP B (different user) is not blocked. */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1596 Dowa_Arena arena = Dowa_Arena_Create(512 1024);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1597 /* Drive requests from IP A to exhaust its counter */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1598 for (int i = 0; i < 10; i++)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1599 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1600 char body[256];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1601 snprintf(body, sizeof(body),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1602 "{\"username\":\"admin\",\"password\":\"badpassword12345\","
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1603 "\"csrfToken\":\"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"}");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1604 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1605 arena, "Host", "localhost", "Origin", "http://localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1606 "Remote-Addr", "10.0.0.1", "Body", body, NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1607 Auth_API_Test_Login_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1608 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1609 /* The test passes as long as we don't crash or affect IP B. */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1610 (void)0;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1611 Dowa_Arena_Free(arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1612 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1613 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1614
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1615 Auth_API_Destroy();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1616 unlink(db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1617 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1618
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1619 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1620 /* Test group: Init failure behavior (issue 2) */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1621 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1622
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1623 static void test_init_and_env_override(void)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1624 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1625 printf("\n[init and env override]\n");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1626
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1627 TEST("session handler returns 503 when store not initialised");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1628 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1629 /* Auth not initialised → handler should return 503 */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1630 Dowa_Arena arena = Dowa_Arena_Create(32 1024);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1631 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1632 arena, "Host", "localhost", "Remote-Addr", "127.0.0.1", NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1633 Seobeo_Request_Entry *resp = Auth_API_Test_Session_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1634 ASSERT(resp);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1635 ASSERT(strcmp(resp_status(resp), "503") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1636 Dowa_Arena_Free(arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1637 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1638 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1639
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1640 TEST("login handler returns 503 when store not initialised");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1641 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1642 Dowa_Arena arena = Dowa_Arena_Create(32 1024);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1643 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1644 arena, "Host", "localhost", "Origin", "http://localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1645 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1646 "Body", "{\"username\":\"u\",\"password\":\"p\",\"csrfToken\":\"t\"}",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1647 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1648 Seobeo_Request_Entry *resp = Auth_API_Test_Login_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1649 ASSERT(resp);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1650 ASSERT(strcmp(resp_status(resp), "503") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1651 Dowa_Arena_Free(arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1652 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1653 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1654 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1655
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1656 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1657 /* main */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1658 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1659
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1660 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1661 /* Test group: Resolve_Existing_Principal — no guest creation */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1662 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1663
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1664 static void test_resolve_existing_principal(void)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1665 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1666 printf("\n[resolve existing principal]\n");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1667
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1668 char db[256];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1669 make_temp_db(db, sizeof(db));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1670 init_auth(db, TRUE);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1671 Dowa_Arena arena = Dowa_Arena_Create(64 1024);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1672
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1673 TEST("no cookie → found=FALSE, no internal error");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1674 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1675 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1676 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1677 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1678 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1679 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1680 Auth_Principal p;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1681 boolean found = TRUE; /* pre-set to detect incorrect TRUE */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1682 boolean ok = Auth_API_Resolve_Existing_Principal(req, &p, arena, &found);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1683 ASSERT(ok);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1684 ASSERT(!found);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1685 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1686 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1687
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1688 TEST("repeated calls without cookie do not accumulate guest rows");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1689 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1690 /* Call resolve_existing 5 times; each must return found=FALSE.
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1691 * Then create one real guest via Resolve_Principal and verify only
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1692 * that one new guest cookie is generated. */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1693 for (int i = 0; i < 5; i++)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1694 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1695 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1696 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1697 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1698 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1699 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1700 Auth_Principal p;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1701 boolean found = TRUE;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1702 ASSERT(Auth_API_Resolve_Existing_Principal(req, &p, arena, &found));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1703 ASSERT(!found);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1704 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1705
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1706 /* Now create a real guest via the creating resolver */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1707 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1708 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1709 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1710 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1711 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1712 Auth_Principal p;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1713 char new_cookie[512] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1714 ASSERT(Auth_API_Resolve_Principal(req, &p, arena, new_cookie, sizeof(new_cookie)));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1715 ASSERT(p.kind == AUTH_PRINCIPAL_GUEST);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1716 ASSERT(new_cookie[0] != '\0'); /* cookie was generated */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1717 ASSERT(p.csrf_token[0] != '\0');
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1718 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1719 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1720
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1721 TEST("valid guest cookie → Resolve_Existing returns found=TRUE");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1722 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1723 /* First create a guest via the creating resolver */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1724 Seobeo_Request_Entry *req1 = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1725 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1726 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1727 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1728 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1729 Auth_Principal p1;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1730 char nc[512] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1731 ASSERT(Auth_API_Resolve_Principal(req1, &p1, arena, nc, sizeof(nc)));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1732 ASSERT(p1.kind == AUTH_PRINCIPAL_GUEST);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1733 ASSERT(nc[0] != '\0');
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1734
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1735 /* Extract the cookie value from the Set-Cookie directive */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1736 const char *cs = strchr(nc, '=');
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1737 ASSERT(cs); cs++;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1738 char cv[AUTH_CRYPTO_GUEST_COOKIE_SIZE] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1739 const char *ce = strchr(cs, ';');
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1740 size_t vl = ce ? (size_t)(ce - cs) : strlen(cs);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1741 ASSERT(vl < sizeof(cv));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1742 memcpy(cv, cs, vl);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1743
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1744 char cookie_hdr[600];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1745 snprintf(cookie_hdr, sizeof(cookie_hdr),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1746 "%s=%s", AUTH_API_GUEST_COOKIE_NAME, cv);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1747
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1748 /* Now resolve existing with the valid guest cookie */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1749 Seobeo_Request_Entry *req2 = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1750 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1751 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1752 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1753 "Cookie", cookie_hdr,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1754 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1755 Auth_Principal p2;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1756 boolean found = FALSE;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1757 boolean ok = Auth_API_Resolve_Existing_Principal(req2, &p2, arena, &found);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1758 ASSERT(ok);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1759 ASSERT(found);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1760 ASSERT(p2.kind == AUTH_PRINCIPAL_GUEST);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1761 ASSERT(strcmp(p1.guest_id, p2.guest_id) == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1762 ASSERT(strcmp(p1.csrf_token, p2.csrf_token) == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1763 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1764 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1765
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1766 TEST("unknown session token → found=FALSE (no guest row created)");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1767 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1768 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1769 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1770 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1771 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1772 "Cookie",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1773 "mjj_session=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1774 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1775 Auth_Principal p;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1776 boolean found = TRUE;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1777 boolean ok = Auth_API_Resolve_Existing_Principal(req, &p, arena, &found);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1778 ASSERT(ok);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1779 ASSERT(!found);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1780 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1781 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1782
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1783 Dowa_Arena_Free(arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1784 Auth_API_Destroy();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1785 unlink(db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1786 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1787
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1788 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1789 /* Session quota response */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1790 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1791
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1792 static void test_session_quota_response(void)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1793 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1794 printf("\n[session quota response]\n");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1795
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1796 char db[256];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1797 make_temp_db(db, sizeof(db));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1798 init_auth(db, TRUE);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1799 Dowa_Arena arena = Dowa_Arena_Create(64 1024);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1800
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1801 TEST("guest session returns quota null when no callback registered");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1802 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1803 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1804 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1805 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1806 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1807 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1808 Seobeo_Request_Entry *resp = Auth_API_Test_Session_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1809 ASSERT(resp);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1810 void *body_ptr = Dowa_HashMap_Get_Ptr(resp, "body");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1811 ASSERT(body_ptr);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1812 const char body = ((Seobeo_Request_Entry )body_ptr)->value;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1813 ASSERT(body);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1814 /* Without a registered quota callback, quota must be null. */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1815 ASSERT(strstr(body, "\"quota\":null") != NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1816 ASSERT(strstr(body, "\"kind\":\"guest\"") != NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1817 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1818 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1819
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1820 TEST("user session returns quota null");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1821 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1822 char pw_hash[AUTH_CRYPTO_PASSWORD_HASH_ENCODED_SIZE];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1823 ASSERT(Auth_Crypto_Password_Hash(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1824 "hunter2", pw_hash, sizeof(pw_hash)) == AUTH_CRYPTO_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1825 char uid[37];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1826 ASSERT(Auth_Store_Create_User(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1827 Auth_API_Get_Store(), "quotauser", pw_hash,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1828 "member", FALSE, uid) == AUTH_STORE_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1829
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1830 /* Create a session directly to skip CSRF ceremony. */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1831 char tok[AUTH_CRYPTO_TOKEN_SIZE] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1832 char csrft[AUTH_CRYPTO_TOKEN_SIZE] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1833 ASSERT(Auth_Crypto_Token_Generate(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1834 tok, sizeof(tok)) == AUTH_CRYPTO_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1835 ASSERT(Auth_Crypto_Token_Generate(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1836 csrft, sizeof(csrft)) == AUTH_CRYPTO_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1837 char tok_digest[AUTH_CRYPTO_TOKEN_DIGEST_SIZE] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1838 char csrf_digest[AUTH_CRYPTO_TOKEN_DIGEST_SIZE] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1839 ASSERT(Auth_Crypto_Token_Digest(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1840 tok, tok_digest, sizeof(tok_digest)) == AUTH_CRYPTO_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1841 ASSERT(Auth_Crypto_Token_Digest(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1842 csrft, csrf_digest, sizeof(csrf_digest)) == AUTH_CRYPTO_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1843 Auth_Session_Record sess;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1844 ASSERT(Auth_Store_Create_Session(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1845 Auth_API_Get_Store(), uid, tok_digest, csrf_digest,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1846 86400, 86400, (int64)time(NULL), &sess) == AUTH_STORE_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1847
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1848 char cookie_hdr[600];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1849 snprintf(cookie_hdr, sizeof(cookie_hdr),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1850 "%s=%s", AUTH_API_SESSION_COOKIE_NAME, tok);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1851
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1852 Seobeo_Request_Entry *sess_req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1853 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1854 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1855 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1856 "Cookie", cookie_hdr,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1857 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1858 Seobeo_Request_Entry *sess_resp = Auth_API_Test_Session_Handler(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1859 sess_req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1860 ASSERT(sess_resp);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1861 const char *body = resp_field(sess_resp, "body");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1862 ASSERT(body);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1863 ASSERT(strstr(body, "\"kind\":\"user\"") != NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1864 /* Authenticated users always get null quota. */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1865 ASSERT(strstr(body, "\"quota\":null") != NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1866 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1867 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1868
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1869 Dowa_Arena_Free(arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1870 Auth_API_Destroy();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1871 unlink(db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1872 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1873
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1874 int main(void)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1875 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1876 printf("=== auth_api_test ===\n");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1877
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1878 test_init_fail_closed();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1879 test_cookie_parsing();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1880 test_trusted_proxy();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1881 test_bootstrap();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1882 test_forced_password_change_paths();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1883 test_csrf_and_origin();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1884 test_login_lifecycle();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1885 test_session_expiry();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1886 test_transfer_hook();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1887 test_rate_limiter();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1888 test_secure_cookie_policy();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1889
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1890 /* New tests for issues 1, 4, 6, 7, 8 */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1891 test_csrf_token_length();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1892 test_forced_password_change_redirect();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1893 test_init_and_env_override();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1894 test_handler_login_flow();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1895 test_handler_logout_flow();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1896 test_handler_password_flow();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1897 test_transfer_hook_failure();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1898 test_rate_limiter_collision();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1899
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1900 /* Task 2: Resolve_Existing_Principal */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1901 test_resolve_existing_principal();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1902
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1903 /* Guest quota */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1904 test_session_quota_response();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1905
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1906 printf("\n=== ALL TESTS PASSED ===\n");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1907 return 0;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1908 }

Mercurial

annotate mrjunejune/test/auth_api_test.c @ 279:b3b547563ec7