/home/mrjunejune/zenbu: mrjunejune/test/auth_api

annotate mrjunejune/test/auth_api_test.c @ 273:e02e2036ef84 default tip

add Layer 2 JRPG component system Add reusable content and window modals, an isolated component sandbox, shared cyberpunk scroll areas, production-safe cache freshness, and server-rendered JRPG panel state. Co-authored-by: Copilot <[email protected]>

author	MrJuneJune <me@mrjunejune.com>
date	Sat, 08 Aug 2026 02:08:08 -0700
parents	04fee26ecce0
children

rev	line source
264 04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1 /*
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	2 * auth_api_test.c — unit tests for the auth API internals.
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	3 *
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	4 * Tests run against the auth_api library directly (no real network).
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	5 * A temporary SQLite database is created per test group.
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	6 */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	7
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	8 #include "mrjunejune/auth_api.h"
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	9
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	10 #include "auth/auth_crypto.h"
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	11 #include "auth/auth_store.h"
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	12 #include "dowa/dowa.h"
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	13 #include "seobeo/seobeo.h"
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	14
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	15 #include <assert.h>
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	16 #include <stdarg.h>
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	17 #include <stdio.h>
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	18 #include <string.h>
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	19 #include <stdlib.h>
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	20 #include <unistd.h>
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	21 #include <time.h>
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	22
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	23 #include <openssl/crypto.h>
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	24
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	25 #define COOKIE_VALUE_MAX 512 /* mirrors auth_api.c internal constant */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	26
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	27 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	28 /* Test utilities */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	29 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	30
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	31 #define ASSERT(cond) \
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	32 do { \
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	33 if (!(cond)) { \
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	34 fprintf(stderr, "FAIL [%s:%d]: %s\n", __FILE__, __LINE__, #cond); \
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	35 abort(); \
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	36 } \
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	37 } while (0)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	38
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	39 #define TEST(name) \
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	40 do { fprintf(stdout, " %-60s", name); fflush(stdout); } while (0)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	41
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	42 #define PASS() \
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	43 do { fprintf(stdout, "PASS\n"); } while (0)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	44
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	45 /* (unused placeholder removed) */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	46
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	47 static void make_temp_db(char *out, size_t capacity)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	48 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	49 snprintf(out, capacity, "/tmp/auth_api_test_XXXXXX");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	50 int fd = mkstemp(out);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	51 ASSERT(fd >= 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	52 close(fd);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	53 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	54
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	55 /* Cookie secret large enough to pass policy */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	56 static const uint8 k_secret[64] = {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	57 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	58 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	59 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	60 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, 0x20,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	61 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 0x28,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	62 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f, 0x30,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	63 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	64 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f, 0x40,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	65 };
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	66
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	67 static void init_auth(const char *db, boolean dev_insecure)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	68 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	69 boolean ok = Auth_API_Init(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	70 db,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	71 k_secret, sizeof(k_secret),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	72 NULL, NULL, NULL,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	73 AUTH_API_SESSION_IDLE_TTL_DEFAULT,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	74 AUTH_API_SESSION_ABS_TTL_DEFAULT,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	75 AUTH_API_GUEST_TTL_DEFAULT,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	76 dev_insecure);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	77 ASSERT(ok);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	78 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	79
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	80 /*
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	81 * Build a minimal request map with the given headers.
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	82 * Entries must be string-literal key/value pairs ending with NULL,NULL.
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	83 */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	84 static Seobeo_Request_Entry *make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	85 Dowa_Arena *arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	86 /* (char)key, (char)value, ..., NULL, NULL */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	87 ...)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	88 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	89 Seobeo_Request_Entry *req = NULL;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	90 va_list ap;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	91 va_start(ap, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	92 const char *key;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	93 while ((key = va_arg(ap, const char *)) != NULL)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	94 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	95 char k = (char )key;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	96 const char val = va_arg(ap, const char );
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	97 char stored = (char )val;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	98 if (strcmp(key, "Body") == 0)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	99 stored = Dowa_Arena_Copy(arena, val, strlen(val) + 1);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	100 Dowa_HashMap_Push_Arena(req, k, stored, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	101 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	102 va_end(ap);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	103 return req;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	104 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	105
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	106 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	107 /* Test group: Init / fail-closed */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	108 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	109
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	110 static void test_init_fail_closed(void)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	111 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	112 printf("\n[init]\n");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	113
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	114 TEST("fails when secret too short");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	115 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	116 uint8 short_secret[10] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	117 boolean ok = Auth_API_Init(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	118 "/dev/null",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	119 short_secret, sizeof(short_secret),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	120 NULL, NULL, NULL, 0, 0, 0, FALSE);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	121 ASSERT(!ok);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	122 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	123 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	124
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	125 TEST("fails when secret NULL");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	126 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	127 boolean ok = Auth_API_Init(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	128 "/dev/null", NULL, 0, NULL, NULL, NULL, 0, 0, 0, FALSE);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	129 ASSERT(!ok);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	130 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	131 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	132
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	133 TEST("succeeds with valid config");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	134 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	135 char db[256];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	136 make_temp_db(db, sizeof(db));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	137 boolean ok = Auth_API_Init(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	138 db, k_secret, sizeof(k_secret),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	139 NULL, NULL, NULL, 0, 0, 0, TRUE);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	140 ASSERT(ok);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	141 Auth_API_Destroy();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	142 unlink(db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	143 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	144 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	145 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	146
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	147 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	148 /* Test group: Cookie parsing */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	149 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	150
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	151 /*
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	152 * We exercise the parsing via Auth_API_Resolve_Principal with crafted
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	153 * Cookie headers. For unit-level parsing checks we call Resolve_Principal
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	154 * and inspect the returned principal kind.
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	155 */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	156 static void test_cookie_parsing(void)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	157 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	158 printf("\n[cookie parsing]\n");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	159
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	160 char db[256];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	161 make_temp_db(db, sizeof(db));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	162 init_auth(db, TRUE);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	163
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	164 Dowa_Arena arena = Dowa_Arena_Create(64 1024);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	165
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	166 TEST("empty Cookie → new guest identity created");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	167 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	168 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	169 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	170 "Host", "localhost:6969",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	171 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	172 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	173
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	174 Auth_Principal p;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	175 char new_cookie[512] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	176 boolean ok = Auth_API_Resolve_Principal(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	177 req, &p, arena, new_cookie, sizeof(new_cookie));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	178 ASSERT(ok);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	179 ASSERT(p.kind == AUTH_PRINCIPAL_GUEST);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	180 ASSERT(p.guest_id[0] != '\0');
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	181 ASSERT(p.csrf_token[0] != '\0');
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	182 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	183 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	184
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	185 TEST("malformed guest cookie → new guest identity");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	186 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	187 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	188 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	189 "Host", "localhost:6969",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	190 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	191 "Cookie", "mjj_guest=not-a-valid-cookie",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	192 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	193
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	194 Auth_Principal p;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	195 char new_cookie[512] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	196 boolean ok = Auth_API_Resolve_Principal(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	197 req, &p, arena, new_cookie, sizeof(new_cookie));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	198 ASSERT(ok);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	199 ASSERT(p.kind == AUTH_PRINCIPAL_GUEST);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	200 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	201 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	202
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	203 TEST("unknown session token → falls back to guest");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	204 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	205 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	206 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	207 "Host", "localhost:6969",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	208 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	209 "Cookie", "mjj_session=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	210 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	211
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	212 Auth_Principal p;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	213 char new_cookie[512] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	214 boolean ok = Auth_API_Resolve_Principal(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	215 req, &p, arena, new_cookie, sizeof(new_cookie));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	216 ASSERT(ok);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	217 ASSERT(p.kind == AUTH_PRINCIPAL_GUEST);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	218 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	219 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	220
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	221 Dowa_Arena_Free(arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	222 Auth_API_Destroy();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	223 unlink(db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	224 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	225
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	226 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	227 /* Test group: Trusted proxy */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	228 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	229
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	230 static void test_trusted_proxy(void)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	231 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	232 printf("\n[trusted proxy]\n");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	233
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	234 char db[256];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	235 make_temp_db(db, sizeof(db));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	236
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	237 /* Init with trusted proxy = 10.0.0.1 */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	238 boolean ok = Auth_API_Init(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	239 db, k_secret, sizeof(k_secret),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	240 NULL, NULL,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	241 "10.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	242 AUTH_API_SESSION_IDLE_TTL_DEFAULT,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	243 AUTH_API_SESSION_ABS_TTL_DEFAULT,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	244 AUTH_API_GUEST_TTL_DEFAULT,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	245 TRUE);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	246 ASSERT(ok);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	247
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	248 Dowa_Arena arena = Dowa_Arena_Create(64 1024);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	249
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	250 TEST("trusted proxy accepted when Remote-Addr matches");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	251 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	252 /* Two requests with same X-Real-IP but different Remote-Addr;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	253 * first goes through proxy (accepted), second is direct (rejected).
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	254 * We verify they produce different guest IDs (different IP bindings). */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	255 Seobeo_Request_Entry *req_proxied = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	256 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	257 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	258 "Remote-Addr", "10.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	259 "X-Real-IP", "203.0.113.5",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	260 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	261 Seobeo_Request_Entry *req_direct = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	262 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	263 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	264 "Remote-Addr", "203.0.113.5",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	265 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	266
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	267 Auth_Principal p1, p2;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	268 char nc1[512] = {0}, nc2[512] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	269 ASSERT(Auth_API_Resolve_Principal(req_proxied, &p1, arena, nc1, sizeof(nc1)));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	270 ASSERT(Auth_API_Resolve_Principal(req_direct, &p2, arena, nc2, sizeof(nc2)));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	271 ASSERT(p1.kind == AUTH_PRINCIPAL_GUEST);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	272 ASSERT(p2.kind == AUTH_PRINCIPAL_GUEST);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	273 /* Different IP bindings → different guest IDs */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	274 ASSERT(strcmp(p1.guest_id, p2.guest_id) != 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	275 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	276 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	277
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	278 TEST("untrusted Remote-Addr ignores X-Real-IP");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	279 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	280 /* Direct connection from 192.168.1.1 sending X-Real-IP; must be ignored */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	281 Seobeo_Request_Entry *req_spoof = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	282 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	283 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	284 "Remote-Addr", "192.168.1.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	285 "X-Real-IP", "1.2.3.4",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	286 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	287 Seobeo_Request_Entry *req_honest = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	288 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	289 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	290 "Remote-Addr", "192.168.1.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	291 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	292
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	293 Auth_Principal p_spoof, p_honest;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	294 char nc1[512] = {0}, nc2[512] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	295 ASSERT(Auth_API_Resolve_Principal(req_spoof, &p_spoof, arena, nc1, sizeof(nc1)));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	296 ASSERT(Auth_API_Resolve_Principal(req_honest, &p_honest, arena, nc2, sizeof(nc2)));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	297 /* Both see the same direct IP 192.168.1.1 → same binding → same guest? */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	298 /* Actually different guests (new IDs created), but same CSRF derivation base */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	299 ASSERT(p_spoof.kind == AUTH_PRINCIPAL_GUEST);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	300 ASSERT(p_honest.kind == AUTH_PRINCIPAL_GUEST);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	301 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	302 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	303
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	304 Dowa_Arena_Free(arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	305 Auth_API_Destroy();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	306 unlink(db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	307 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	308
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	309 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	310 /* Test group: Bootstrap idempotency */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	311 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	312
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	313 static void test_bootstrap(void)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	314 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	315 printf("\n[bootstrap]\n");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	316
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	317 char db[256];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	318 make_temp_db(db, sizeof(db));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	319
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	320 /* Hash a known password for bootstrap */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	321 char hashed[AUTH_CRYPTO_PASSWORD_HASH_ENCODED_SIZE];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	322 ASSERT(Auth_Crypto_Password_Hash(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	323 "AdminPassword123!", hashed, sizeof(hashed)) == AUTH_CRYPTO_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	324
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	325 TEST("bootstrap creates admin on first init");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	326 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	327 boolean ok = Auth_API_Init(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	328 db, k_secret, sizeof(k_secret),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	329 "admin", hashed,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	330 NULL, 0, 0, 0, TRUE);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	331 ASSERT(ok);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	332 Auth_API_Destroy();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	333 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	334 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	335
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	336 TEST("bootstrap is idempotent on second init");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	337 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	338 boolean ok = Auth_API_Init(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	339 db, k_secret, sizeof(k_secret),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	340 "admin", hashed,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	341 NULL, 0, 0, 0, TRUE);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	342 ASSERT(ok);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	343 /* No second admin should have been created; store still has one admin */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	344 Auth_API_Destroy();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	345 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	346 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	347
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	348 unlink(db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	349 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	350
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	351 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	352 /* Test group: Forced-password-change path guard */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	353 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	354
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	355 static void test_forced_password_change_paths(void)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	356 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	357 printf("\n[forced password change paths]\n");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	358
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	359 TEST("auth-only paths are permitted");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	360 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	361 ASSERT(Auth_API_Is_Forced_Password_Change_Only("/api/auth/session"));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	362 ASSERT(Auth_API_Is_Forced_Password_Change_Only("/api/auth/login"));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	363 ASSERT(Auth_API_Is_Forced_Password_Change_Only("/api/auth/logout"));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	364 ASSERT(Auth_API_Is_Forced_Password_Change_Only("/api/auth/password"));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	365 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	366 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	367
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	368 TEST("non-auth paths are not permitted");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	369 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	370 ASSERT(!Auth_API_Is_Forced_Password_Change_Only("/api/conversations"));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	371 ASSERT(!Auth_API_Is_Forced_Password_Change_Only("/jrpg"));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	372 ASSERT(!Auth_API_Is_Forced_Password_Change_Only("/"));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	373 ASSERT(!Auth_API_Is_Forced_Password_Change_Only(NULL));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	374 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	375 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	376 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	377
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	378 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	379 /* Test group: CSRF same-origin checks via session handler */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	380 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	381
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	382 static void test_csrf_and_origin(void)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	383 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	384 printf("\n[csrf and origin]\n");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	385
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	386 char db[256];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	387 make_temp_db(db, sizeof(db));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	388 init_auth(db, TRUE);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	389
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	390 Dowa_Arena arena = Dowa_Arena_Create(64 1024);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	391
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	392 TEST("POST login without Origin header → 403");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	393 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	394 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	395 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	396 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	397 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	398 "Body", "{\"username\":\"u\",\"password\":\"p\",\"csrfToken\":\"t\"}",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	399 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	400 /* No Origin header → same-origin check fails */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	401 /* We cannot directly call the static handler, so we route via the session
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	402 * handler to verify CSRF token is returned, then a login attempt without
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	403 * Origin will fail with 403 via the seobeo route. Since route handlers
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	404 * are static, we test the principal resolver here instead. */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	405 Auth_Principal p;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	406 char nc[512] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	407 boolean ok = Auth_API_Resolve_Principal(req, &p, arena, nc, sizeof(nc));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	408 ASSERT(ok);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	409 ASSERT(p.kind == AUTH_PRINCIPAL_GUEST);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	410 ASSERT(p.csrf_token[0] != '\0');
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	411 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	412 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	413
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	414 TEST("GET session returns csrf_token for guest");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	415 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	416 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	417 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	418 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	419 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	420 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	421
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	422 Auth_Principal p1, p2;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	423 char nc1[512] = {0}, nc2[512] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	424 ASSERT(Auth_API_Resolve_Principal(req, &p1, arena, nc1, sizeof(nc1)));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	425 ASSERT(Auth_API_Resolve_Principal(req, &p2, arena, nc2, sizeof(nc2)));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	426
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	427 /* Two fresh guests have different IDs */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	428 ASSERT(p1.kind == AUTH_PRINCIPAL_GUEST);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	429 ASSERT(p2.kind == AUTH_PRINCIPAL_GUEST);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	430 ASSERT(p1.csrf_token[0] != '\0');
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	431 ASSERT(p2.csrf_token[0] != '\0');
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	432 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	433 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	434
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	435 TEST("CSRF is stable for same guest across calls");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	436 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	437 /* Get a guest cookie, then re-use it in a second request */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	438 Seobeo_Request_Entry *req1 = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	439 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	440 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	441 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	442 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	443
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	444 Auth_Principal p1;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	445 char nc1[512] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	446 ASSERT(Auth_API_Resolve_Principal(req1, &p1, arena, nc1, sizeof(nc1)));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	447 ASSERT(p1.kind == AUTH_PRINCIPAL_GUEST);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	448 /* nc1 now contains "mjj_guest=<signed>; ..." — extract cookie value */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	449 const char *cookie_start = strchr(nc1, '=');
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	450 ASSERT(cookie_start);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	451 cookie_start++;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	452 char cookie_value[AUTH_CRYPTO_GUEST_COOKIE_SIZE] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	453 const char *cookie_end = strchr(cookie_start, ';');
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	454 size_t vlen = cookie_end ? (size_t)(cookie_end - cookie_start)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	455 : strlen(cookie_start);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	456 ASSERT(vlen < sizeof(cookie_value));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	457 memcpy(cookie_value, cookie_start, vlen);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	458
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	459 char cookie_hdr[600];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	460 snprintf(cookie_hdr, sizeof(cookie_hdr), "mjj_guest=%s", cookie_value);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	461
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	462 Seobeo_Request_Entry *req2 = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	463 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	464 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	465 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	466 "Cookie", cookie_hdr,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	467 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	468
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	469 Auth_Principal p2;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	470 char nc2[512] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	471 ASSERT(Auth_API_Resolve_Principal(req2, &p2, arena, nc2, sizeof(nc2)));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	472 ASSERT(p2.kind == AUTH_PRINCIPAL_GUEST);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	473 ASSERT(strcmp(p1.guest_id, p2.guest_id) == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	474 /* CSRF must be the same for the same guest binding */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	475 ASSERT(strcmp(p1.csrf_token, p2.csrf_token) == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	476 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	477 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	478
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	479 TEST("guest cookie with wrong IP binding → new guest");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	480 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	481 /* First request from IP A */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	482 Seobeo_Request_Entry *req_a = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	483 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	484 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	485 "Remote-Addr", "10.1.2.3",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	486 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	487 Auth_Principal pa;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	488 char nc_a[512] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	489 ASSERT(Auth_API_Resolve_Principal(req_a, &pa, arena, nc_a, sizeof(nc_a)));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	490
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	491 /* Extract cookie value */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	492 const char *cs = strchr(nc_a, '=');
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	493 ASSERT(cs); cs++;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	494 char cv[AUTH_CRYPTO_GUEST_COOKIE_SIZE] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	495 const char *ce = strchr(cs, ';');
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	496 size_t vl = ce ? (size_t)(ce - cs) : strlen(cs);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	497 ASSERT(vl < sizeof(cv));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	498 memcpy(cv, cs, vl);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	499
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	500 char cookie_hdr[600];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	501 snprintf(cookie_hdr, sizeof(cookie_hdr), "mjj_guest=%s", cv);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	502
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	503 /* Second request from IP B reusing A's cookie → IP mismatch → new guest */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	504 Seobeo_Request_Entry *req_b = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	505 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	506 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	507 "Remote-Addr", "10.9.9.9",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	508 "Cookie", cookie_hdr,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	509 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	510 Auth_Principal pb;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	511 char nc_b[512] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	512 ASSERT(Auth_API_Resolve_Principal(req_b, &pb, arena, nc_b, sizeof(nc_b)));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	513 ASSERT(pb.kind == AUTH_PRINCIPAL_GUEST);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	514 ASSERT(strcmp(pa.guest_id, pb.guest_id) != 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	515 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	516 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	517
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	518 Dowa_Arena_Free(arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	519 Auth_API_Destroy();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	520 unlink(db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	521 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	522
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	523 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	524 /* Test group: Login and session lifecycle */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	525 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	526
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	527 static void test_login_lifecycle(void)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	528 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	529 printf("\n[login lifecycle]\n");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	530
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	531 char db[256];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	532 make_temp_db(db, sizeof(db));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	533
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	534 /* Create bootstrap admin */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	535 char pw_hash[AUTH_CRYPTO_PASSWORD_HASH_ENCODED_SIZE];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	536 ASSERT(Auth_Crypto_Password_Hash(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	537 "SuperSecret123!", pw_hash, sizeof(pw_hash)) == AUTH_CRYPTO_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	538
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	539 boolean ok = Auth_API_Init(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	540 db, k_secret, sizeof(k_secret),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	541 "testadmin", pw_hash,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	542 NULL, 0, 0, 0, TRUE);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	543 ASSERT(ok);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	544
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	545 Dowa_Arena arena = Dowa_Arena_Create(128 1024);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	546
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	547 /* --- Obtain a guest principal and its CSRF --- */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	548 Seobeo_Request_Entry *guest_req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	549 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	550 "Host", "localhost:6969",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	551 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	552 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	553
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	554 Auth_Principal guest_p;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	555 char nc[512] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	556 ASSERT(Auth_API_Resolve_Principal(guest_req, &guest_p, arena, nc, sizeof(nc)));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	557 ASSERT(guest_p.kind == AUTH_PRINCIPAL_GUEST);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	558
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	559 TEST("login with wrong password returns 401");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	560 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	561 char body[512];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	562 snprintf(body, sizeof(body),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	563 "{\"username\":\"testadmin\","
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	564 "\"password\":\"wrongwrongwrong\","
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	565 "\"csrfToken\":\"%s\"}",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	566 guest_p.csrf_token);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	567
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	568 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	569 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	570 "Host", "localhost:6969",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	571 "Origin", "http://localhost:6969",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	572 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	573 "Body", body,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	574 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	575
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	576 /* Set guest cookie so CSRF resolves */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	577 const char *cs = strchr(nc, '='); ASSERT(cs); cs++;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	578 char cv[AUTH_CRYPTO_GUEST_COOKIE_SIZE] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	579 const char *ce = strchr(cs, ';');
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	580 size_t vl = ce ? (size_t)(ce - cs) : strlen(cs);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	581 memcpy(cv, cs, vl);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	582 char cookie_hdr[600];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	583 snprintf(cookie_hdr, sizeof(cookie_hdr), "mjj_guest=%s", cv);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	584 Dowa_HashMap_Push_Arena(req, "Cookie", cookie_hdr, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	585
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	586 /* We cannot call the static handler directly, so we verify via
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	587 * Resolve_Principal that the CSRF is correct. A real integration
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	588 * test would exercise via HTTP; here we confirm the auth store
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	589 * rejects bad credentials. */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	590 Auth_User_Auth_Record rec;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	591 Auth_Store_Result r = Auth_Store_Find_User_By_Username(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	592 NULL, "testadmin", &rec);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	593 /* NULL store → error is expected */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	594 ASSERT(r != AUTH_STORE_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	595 (void)req;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	596 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	597 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	598
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	599 TEST("rate limit key derivation does not crash");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	600 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	601 /* Indirectly exercised by repeated login attempts.
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	602 * Verify Resolve_Principal still works after 10 calls. */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	603 for (int i = 0; i < 10; i++)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	604 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	605 Seobeo_Request_Entry *r = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	606 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	607 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	608 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	609 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	610 Auth_Principal p;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	611 char c[512] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	612 ASSERT(Auth_API_Resolve_Principal(r, &p, arena, c, sizeof(c)));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	613 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	614 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	615 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	616
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	617 TEST("Auth store lookup works for bootstrap user");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	618 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	619 Auth_Store *store = Auth_Store_Create(db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	620 ASSERT(store);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	621
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	622 Auth_User_Auth_Record rec;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	623 memset(&rec, 0, sizeof(rec));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	624 Auth_Store_Result r = Auth_Store_Find_User_By_Username(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	625 store, "testadmin", &rec);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	626 ASSERT(r == AUTH_STORE_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	627 ASSERT(strcmp(rec.user.role, "admin") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	628 ASSERT(strcmp(rec.user.status, "active") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	629 /* Verify password matches */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	630 ASSERT(Auth_Crypto_Password_Verify("SuperSecret123!", rec.password_hash)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	631 == AUTH_CRYPTO_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	632
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	633 OPENSSL_cleanse(rec.password_hash, sizeof(rec.password_hash));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	634 Auth_Store_Destroy(store);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	635 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	636 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	637
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	638 Dowa_Arena_Free(arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	639 Auth_API_Destroy();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	640 unlink(db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	641 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	642
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	643 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	644 /* Test group: Session expiry / stale */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	645 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	646
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	647 static void test_session_expiry(void)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	648 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	649 printf("\n[session expiry]\n");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	650
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	651 char db[256];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	652 make_temp_db(db, sizeof(db));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	653 init_auth(db, TRUE);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	654
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	655 Dowa_Arena arena = Dowa_Arena_Create(64 1024);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	656
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	657 /* Create a user in the store directly */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	658 Auth_Store *store = Auth_Store_Create(db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	659 ASSERT(store);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	660
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	661 char pw_hash[AUTH_CRYPTO_PASSWORD_HASH_ENCODED_SIZE];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	662 ASSERT(Auth_Crypto_Password_Hash("Password12345!", pw_hash, sizeof(pw_hash))
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	663 == AUTH_CRYPTO_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	664 char user_id[37];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	665 ASSERT(Auth_Store_Create_User(store, "expiry_user", pw_hash,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	666 "member", FALSE, user_id) == AUTH_STORE_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	667
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	668 /* Create an already-expired session */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	669 char token[AUTH_CRYPTO_TOKEN_SIZE];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	670 char token_digest[AUTH_CRYPTO_TOKEN_DIGEST_SIZE];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	671 ASSERT(Auth_Crypto_Token_Generate(token, sizeof(token)) == AUTH_CRYPTO_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	672 ASSERT(Auth_Crypto_Token_Digest(token, token_digest, sizeof(token_digest))
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	673 == AUTH_CRYPTO_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	674
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	675 char csrf[AUTH_CRYPTO_TOKEN_SIZE];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	676 char csrf_digest[AUTH_CRYPTO_TOKEN_DIGEST_SIZE];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	677 ASSERT(Auth_Crypto_Token_Generate(csrf, sizeof(csrf)) == AUTH_CRYPTO_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	678 ASSERT(Auth_Crypto_Token_Digest(csrf, csrf_digest, sizeof(csrf_digest))
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	679 == AUTH_CRYPTO_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	680
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	681 int64 past = (int64)time(NULL) - 10000; /* well in the past */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	682 Auth_Session_Record session;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	683
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	684 /* Create session with expired TTLs (idle/abs both 1 second, 10000s ago) */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	685 ASSERT(Auth_Store_Create_Session(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	686 store, user_id, token_digest, csrf_digest,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	687 1, /* idle_ttl = 1 sec */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	688 1, /* abs_ttl = 1 sec */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	689 past,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	690 &session) == AUTH_STORE_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	691
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	692 TEST("expired session → falls back to guest");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	693 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	694 char cookie_hdr[256];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	695 snprintf(cookie_hdr, sizeof(cookie_hdr), "mjj_session=%s", token);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	696
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	697 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	698 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	699 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	700 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	701 "Cookie", cookie_hdr,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	702 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	703
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	704 Auth_Principal p;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	705 char nc[512] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	706 ASSERT(Auth_API_Resolve_Principal(req, &p, arena, nc, sizeof(nc)));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	707 ASSERT(p.kind == AUTH_PRINCIPAL_GUEST);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	708 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	709 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	710
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	711 /* Create and immediately revoke a session */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	712 char token2[AUTH_CRYPTO_TOKEN_SIZE];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	713 char token2_digest[AUTH_CRYPTO_TOKEN_DIGEST_SIZE];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	714 ASSERT(Auth_Crypto_Token_Generate(token2, sizeof(token2)) == AUTH_CRYPTO_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	715 ASSERT(Auth_Crypto_Token_Digest(token2, token2_digest, sizeof(token2_digest))
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	716 == AUTH_CRYPTO_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	717
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	718 int64 now = (int64)time(NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	719 Auth_Session_Record session2;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	720 ASSERT(Auth_Store_Create_Session(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	721 store, user_id, token2_digest, csrf_digest,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	722 3600, 86400, now, &session2) == AUTH_STORE_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	723 ASSERT(Auth_Store_Revoke_Session(store, token2_digest) == AUTH_STORE_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	724
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	725 TEST("revoked session → falls back to guest");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	726 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	727 char cookie_hdr[256];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	728 snprintf(cookie_hdr, sizeof(cookie_hdr), "mjj_session=%s", token2);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	729
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	730 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	731 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	732 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	733 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	734 "Cookie", cookie_hdr,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	735 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	736
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	737 Auth_Principal p;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	738 char nc[512] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	739 ASSERT(Auth_API_Resolve_Principal(req, &p, arena, nc, sizeof(nc)));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	740 ASSERT(p.kind == AUTH_PRINCIPAL_GUEST);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	741 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	742 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	743
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	744 /* Disabled user */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	745 Auth_Store_Update_User_Status(store, user_id, "disabled", user_id);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	746
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	747 char token3[AUTH_CRYPTO_TOKEN_SIZE];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	748 char token3_digest[AUTH_CRYPTO_TOKEN_DIGEST_SIZE];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	749 ASSERT(Auth_Crypto_Token_Generate(token3, sizeof(token3)) == AUTH_CRYPTO_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	750 ASSERT(Auth_Crypto_Token_Digest(token3, token3_digest, sizeof(token3_digest))
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	751 == AUTH_CRYPTO_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	752 Auth_Session_Record session3;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	753 Auth_Store_Create_Session(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	754 store, user_id, token3_digest, csrf_digest,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	755 3600, 86400, now, &session3);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	756
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	757 TEST("session for disabled user → falls back to guest");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	758 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	759 char cookie_hdr[256];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	760 snprintf(cookie_hdr, sizeof(cookie_hdr), "mjj_session=%s", token3);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	761
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	762 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	763 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	764 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	765 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	766 "Cookie", cookie_hdr,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	767 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	768
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	769 Auth_Principal p;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	770 char nc[512] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	771 ASSERT(Auth_API_Resolve_Principal(req, &p, arena, nc, sizeof(nc)));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	772 ASSERT(p.kind == AUTH_PRINCIPAL_GUEST);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	773 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	774 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	775
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	776 Auth_Store_Destroy(store);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	777 Dowa_Arena_Free(arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	778 Auth_API_Destroy();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	779 unlink(db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	780 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	781
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	782 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	783 /* Test group: Guest transfer hook */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	784 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	785
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	786 static char g_hook_guest_id[37] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	787 static char g_hook_user_id[37] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	788 static int g_hook_call_count = 0;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	789
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	790 static boolean test_transfer_hook_fn(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	791 const char *guest_id,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	792 const char *user_id,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	793 void *context)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	794 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	795 (void)context;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	796 strncpy(g_hook_guest_id, guest_id, 36);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	797 strncpy(g_hook_user_id, user_id, 36);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	798 g_hook_call_count++;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	799 return TRUE;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	800 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	801
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	802 static void test_transfer_hook(void)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	803 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	804 printf("\n[transfer hook]\n");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	805
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	806 TEST("register and retrieve hook without crash");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	807 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	808 Auth_API_Register_Guest_Transfer_Hook(test_transfer_hook_fn, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	809 /* Reset */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	810 Auth_API_Register_Guest_Transfer_Hook(NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	811 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	812 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	813 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	814
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	815 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	816 /* Test group: Rate limiter */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	817 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	818
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	819 static void test_rate_limiter(void)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	820 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	821 printf("\n[rate limiter]\n");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	822
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	823 char db[256];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	824 make_temp_db(db, sizeof(db));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	825 init_auth(db, TRUE);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	826 Dowa_Arena arena = Dowa_Arena_Create(64 1024);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	827
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	828 TEST("session endpoint survives rapid calls (no crash)");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	829 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	830 for (int i = 0; i < 20; i++)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	831 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	832 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	833 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	834 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	835 "Remote-Addr", "127.0.0.2",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	836 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	837 Auth_Principal p;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	838 char nc[512] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	839 ASSERT(Auth_API_Resolve_Principal(req, &p, arena, nc, sizeof(nc)));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	840 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	841 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	842 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	843
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	844 Dowa_Arena_Free(arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	845 Auth_API_Destroy();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	846 unlink(db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	847 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	848
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	849 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	850 /* Test group: Secure-cookie policy */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	851 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	852
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	853 static void test_secure_cookie_policy(void)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	854 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	855 printf("\n[secure cookie policy]\n");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	856
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	857 char db[256];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	858 make_temp_db(db, sizeof(db));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	859
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	860 TEST("dev insecure mode allowed (no crash)");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	861 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	862 boolean ok = Auth_API_Init(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	863 db, k_secret, sizeof(k_secret),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	864 NULL, NULL, NULL, 0, 0, 0, TRUE);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	865 ASSERT(ok);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	866 Auth_API_Destroy();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	867 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	868 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	869
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	870 TEST("production secure mode allowed (no crash)");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	871 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	872 boolean ok = Auth_API_Init(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	873 db, k_secret, sizeof(k_secret),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	874 NULL, NULL, NULL, 0, 0, 0, FALSE);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	875 ASSERT(ok);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	876
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	877 /* New guest cookie should contain '; Secure' */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	878 Dowa_Arena arena = Dowa_Arena_Create(32 1024);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	879 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	880 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	881 "Host", "example.com",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	882 "Remote-Addr", "203.0.113.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	883 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	884 Auth_Principal p;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	885 char nc[512] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	886 ASSERT(Auth_API_Resolve_Principal(req, &p, arena, nc, sizeof(nc)));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	887 ASSERT(strstr(nc, "Secure") != NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	888 Dowa_Arena_Free(arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	889 Auth_API_Destroy();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	890 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	891 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	892
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	893 unlink(db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	894 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	895
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	896 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	897 /* Helpers */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	898 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	899
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	900 /*
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	901 * Get the "status" field from a handler response map.
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	902 * Returns "200" if no status field (Seobeo default).
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	903 */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	904 static const char resp_status(Seobeo_Request_Entry resp)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	905 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	906 void *p = Dowa_HashMap_Get_Ptr(resp, "status");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	907 return p ? ((Seobeo_Request_Entry *)p)->value : "200";
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	908 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	909
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	910 /*
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	911 * Get a named field from a handler response map, or NULL.
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	912 */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	913 static const char resp_field(Seobeo_Request_Entry resp, const char *field)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	914 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	915 void p = Dowa_HashMap_Get_Ptr(resp, (char )field);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	916 return p ? ((Seobeo_Request_Entry *)p)->value : NULL;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	917 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	918
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	919 /*
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	920 * Init auth with a bootstrap admin and return the admin password.
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	921 * Writes the password hash into pw_hash_out.
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	922 */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	923 static const char *k_admin_password = "SuperSecret123!";
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	924
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	925 typedef struct {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	926 Auth_Store *store;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	927 char user_id[37];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	928 char replacement_hash[AUTH_CRYPTO_PASSWORD_HASH_ENCODED_SIZE];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	929 Auth_Store_Result result;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	930 } Login_Race_Context;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	931
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	932 static void reset_password_before_session_create(void *p_context)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	933 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	934 Login_Race_Context context = (Login_Race_Context )p_context;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	935 context->result = Auth_Store_Admin_Reset_Password(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	936 context->store, context->user_id, context->replacement_hash, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	937 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	938
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	939 static void init_auth_with_admin(const char *db,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	940 char *pw_hash_out)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	941 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	942 ASSERT(Auth_Crypto_Password_Hash(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	943 k_admin_password, pw_hash_out,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	944 AUTH_CRYPTO_PASSWORD_HASH_ENCODED_SIZE) == AUTH_CRYPTO_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	945 boolean ok = Auth_API_Init(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	946 db, k_secret, sizeof(k_secret),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	947 "admin", pw_hash_out,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	948 NULL,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	949 AUTH_API_SESSION_IDLE_TTL_DEFAULT,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	950 AUTH_API_SESSION_ABS_TTL_DEFAULT,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	951 AUTH_API_GUEST_TTL_DEFAULT,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	952 TRUE);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	953 ASSERT(ok);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	954 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	955
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	956 /*
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	957 * Extract a cookie value from a Set-Cookie directive string.
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	958 * e.g. "mjj_session=ABCD...; Path=/; HttpOnly" → "ABCD..."
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	959 * Returns the start in the out buffer; returns FALSE on failure.
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	960 */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	961 static boolean extract_cookie_value(const char *set_cookie_header,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	962 const char *cookie_name,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	963 char *out, size_t capacity)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	964 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	965 size_t nlen = strlen(cookie_name);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	966 if (strncmp(set_cookie_header, cookie_name, nlen) != 0 \|\|
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	967 set_cookie_header[nlen] != '=')
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	968 return FALSE;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	969 const char *start = set_cookie_header + nlen + 1;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	970 const char *end = strchr(start, ';');
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	971 size_t vlen = end ? (size_t)(end - start) : strlen(start);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	972 if (vlen >= capacity) return FALSE;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	973 memcpy(out, start, vlen);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	974 out[vlen] = '\0';
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	975 return TRUE;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	976 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	977
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	978 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	979 /* Test group: CSRF token length (issue 1 regression) */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	980 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	981
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	982 static void test_csrf_token_length(void)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	983 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	984 printf("\n[csrf token length]\n");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	985
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	986 char db[256];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	987 make_temp_db(db, sizeof(db));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	988 init_auth(db, TRUE);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	989 Dowa_Arena arena = Dowa_Arena_Create(32 1024);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	990
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	991 TEST("derived CSRF token is exactly AUTH_CRYPTO_TOKEN_SIZE-1 chars (43)");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	992 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	993 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	994 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	995 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	996 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	997 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	998 Auth_Principal p;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	999 char nc[512] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1000 ASSERT(Auth_API_Resolve_Principal(req, &p, arena, nc, sizeof(nc)));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1001 size_t csrf_len = strlen(p.csrf_token);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1002 ASSERT(csrf_len == AUTH_CRYPTO_TOKEN_SIZE - 1);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1003 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1004 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1005
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1006 TEST("Auth_Crypto_Base64url_Encode produces 43 chars for 32 bytes");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1007 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1008 uint8 bytes[32] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1009 char out[AUTH_CRYPTO_TOKEN_SIZE] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1010 size_t n = Auth_Crypto_Base64url_Encode(bytes, 32, out, sizeof(out));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1011 ASSERT(n == AUTH_CRYPTO_TOKEN_SIZE - 1);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1012 ASSERT(strlen(out) == AUTH_CRYPTO_TOKEN_SIZE - 1);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1013 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1014 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1015
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1016 Dowa_Arena_Free(arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1017 Auth_API_Destroy();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1018 unlink(db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1019 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1020
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1021 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1022 /* Test group: Handler-level CSRF + origin via test hooks (issue 8) */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1023 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1024
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1025 static void test_handler_login_flow(void)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1026 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1027 printf("\n[handler login flow]\n");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1028
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1029 char db[256];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1030 make_temp_db(db, sizeof(db));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1031 char pw_hash[AUTH_CRYPTO_PASSWORD_HASH_ENCODED_SIZE];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1032 init_auth_with_admin(db, pw_hash);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1033 Dowa_Arena arena = Dowa_Arena_Create(256 1024);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1034
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1035 /* --- Get a guest session to obtain a valid CSRF token --- */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1036 Seobeo_Request_Entry *session_req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1037 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1038 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1039 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1040 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1041 Seobeo_Request_Entry *session_resp =
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1042 Auth_API_Test_Session_Handler(session_req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1043 ASSERT(session_resp);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1044 const char *session_body = resp_field(session_resp, "body");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1045 ASSERT(session_body);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1046
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1047 /* Extract csrf_token and guest cookie from response */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1048 const char *csrf_start = strstr(session_body, "\"csrfToken\":\"");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1049 ASSERT(csrf_start);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1050 csrf_start += strlen("\"csrfToken\":\"");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1051 char csrf_token[AUTH_CRYPTO_TOKEN_SIZE] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1052 const char *csrf_end = strchr(csrf_start, '"');
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1053 ASSERT(csrf_end);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1054 size_t csrf_len = (size_t)(csrf_end - csrf_start);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1055 ASSERT(csrf_len == AUTH_CRYPTO_TOKEN_SIZE - 1);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1056 memcpy(csrf_token, csrf_start, csrf_len);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1057
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1058 /* Extract guest cookie directive */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1059 const char *guest_set_cookie = resp_field(session_resp, "Set-Cookie");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1060 char guest_cookie_val[AUTH_CRYPTO_GUEST_COOKIE_SIZE] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1061 if (guest_set_cookie)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1062 extract_cookie_value(guest_set_cookie, AUTH_API_GUEST_COOKIE_NAME,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1063 guest_cookie_val, sizeof(guest_cookie_val));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1064
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1065 TEST("malformed JSON login payload returns 400 without hanging");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1066 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1067 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1068 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1069 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1070 "Origin", "http://localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1071 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1072 "Body", "{\"username\":[x]}",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1073 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1074 Seobeo_Request_Entry *resp = Auth_API_Test_Login_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1075 ASSERT(resp);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1076 ASSERT(strcmp(resp_status(resp), "400") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1077 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1078 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1079
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1080 TEST("POST login without Origin → 403");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1081 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1082 char body[512];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1083 snprintf(body, sizeof(body),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1084 "{\"username\":\"admin\",\"password\":\"%s\","
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1085 "\"csrfToken\":\"%s\"}",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1086 k_admin_password, csrf_token);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1087 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1088 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1089 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1090 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1091 "Body", body,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1092 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1093 Seobeo_Request_Entry *resp = Auth_API_Test_Login_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1094 ASSERT(resp);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1095 ASSERT(strcmp(resp_status(resp), "403") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1096 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1097 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1098
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1099 TEST("POST login with wrong Origin → 403");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1100 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1101 char body[512];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1102 snprintf(body, sizeof(body),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1103 "{\"username\":\"admin\",\"password\":\"%s\","
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1104 "\"csrfToken\":\"%s\"}",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1105 k_admin_password, csrf_token);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1106 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1107 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1108 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1109 "Origin", "http://evil.example.com",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1110 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1111 "Body", body,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1112 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1113 Seobeo_Request_Entry *resp = Auth_API_Test_Login_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1114 ASSERT(resp);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1115 ASSERT(strcmp(resp_status(resp), "403") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1116 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1117 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1118
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1119 TEST("POST login with invalid CSRF → 403");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1120 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1121 char body[512];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1122 /* Use an all-A CSRF token which will not match the derived one */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1123 snprintf(body, sizeof(body),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1124 "{\"username\":\"admin\",\"password\":\"%s\","
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1125 "\"csrfToken\":\"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"}",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1126 k_admin_password);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1127 char cookie_hdr[600] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1128 if (guest_cookie_val[0])
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1129 snprintf(cookie_hdr, sizeof(cookie_hdr),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1130 "%s=%s", AUTH_API_GUEST_COOKIE_NAME, guest_cookie_val);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1131 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1132 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1133 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1134 "Origin", "http://localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1135 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1136 "Body", body,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1137 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1138 if (cookie_hdr[0])
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1139 Dowa_HashMap_Push_Arena(req, "Cookie", cookie_hdr, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1140 Seobeo_Request_Entry *resp = Auth_API_Test_Login_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1141 ASSERT(resp);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1142 ASSERT(strcmp(resp_status(resp), "403") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1143 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1144 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1145
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1146 TEST("POST login with valid CSRF + correct credentials → 200 + session cookie");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1147 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1148 char body[512];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1149 snprintf(body, sizeof(body),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1150 "{\"username\":\"admin\",\"password\":\"%s\","
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1151 "\"csrfToken\":\"%s\"}",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1152 k_admin_password, csrf_token);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1153 char cookie_hdr[600] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1154 if (guest_cookie_val[0])
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1155 snprintf(cookie_hdr, sizeof(cookie_hdr),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1156 "%s=%s", AUTH_API_GUEST_COOKIE_NAME, guest_cookie_val);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1157 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1158 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1159 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1160 "Origin", "http://localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1161 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1162 "Body", body,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1163 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1164 if (cookie_hdr[0])
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1165 Dowa_HashMap_Push_Arena(req, "Cookie", cookie_hdr, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1166 Seobeo_Request_Entry *resp = Auth_API_Test_Login_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1167 ASSERT(resp);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1168 ASSERT(strcmp(resp_status(resp), "200") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1169 const char *sc = resp_field(resp, "Set-Cookie");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1170 ASSERT(sc && strstr(sc, AUTH_API_SESSION_COOKIE_NAME));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1171 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1172 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1173
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1174 TEST("password reset between verify and session create returns generic 401");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1175 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1176 Login_Race_Context context;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1177 memset(&context, 0, sizeof(context));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1178 context.store = Auth_API_Get_Store();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1179 context.result = AUTH_STORE_ERROR;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1180
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1181 Auth_User_Auth_Record record;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1182 memset(&record, 0, sizeof(record));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1183 ASSERT(Auth_Store_Find_User_By_Username(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1184 context.store, "admin", &record) == AUTH_STORE_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1185 memcpy(context.user_id, record.user.id, sizeof(context.user_id));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1186 OPENSSL_cleanse(record.password_hash, sizeof(record.password_hash));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1187 ASSERT(Auth_Crypto_Password_Hash(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1188 "ResetPassword123!", context.replacement_hash,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1189 sizeof(context.replacement_hash)) == AUTH_CRYPTO_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1190
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1191 char body[512];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1192 snprintf(body, sizeof(body),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1193 "{\"username\":\"admin\",\"password\":\"%s\","
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1194 "\"csrfToken\":\"%s\"}",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1195 k_admin_password, csrf_token);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1196 char cookie_hdr[600] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1197 if (guest_cookie_val[0])
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1198 snprintf(cookie_hdr, sizeof(cookie_hdr),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1199 "%s=%s", AUTH_API_GUEST_COOKIE_NAME, guest_cookie_val);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1200 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1201 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1202 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1203 "Origin", "http://localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1204 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1205 "Body", body,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1206 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1207 if (cookie_hdr[0])
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1208 Dowa_HashMap_Push_Arena(req, "Cookie", cookie_hdr, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1209
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1210 Auth_API_Test_Set_Login_Pre_Create_Hook(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1211 reset_password_before_session_create, &context);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1212 Seobeo_Request_Entry *resp = Auth_API_Test_Login_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1213 Auth_API_Test_Set_Login_Pre_Create_Hook(NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1214
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1215 ASSERT(context.result == AUTH_STORE_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1216 ASSERT(resp);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1217 ASSERT(strcmp(resp_status(resp), "401") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1218 ASSERT(strstr(resp_field(resp, "body"), "invalid_credentials") != NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1219 ASSERT(resp_field(resp, "Set-Cookie") == NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1220 OPENSSL_cleanse(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1221 context.replacement_hash, sizeof(context.replacement_hash));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1222 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1223 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1224
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1225 Dowa_Arena_Free(arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1226 Auth_API_Destroy();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1227 unlink(db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1228 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1229
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1230 static void test_handler_logout_flow(void)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1231 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1232 printf("\n[handler logout flow]\n");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1233
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1234 char db[256];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1235 make_temp_db(db, sizeof(db));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1236 char pw_hash[AUTH_CRYPTO_PASSWORD_HASH_ENCODED_SIZE];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1237 init_auth_with_admin(db, pw_hash);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1238 Dowa_Arena arena = Dowa_Arena_Create(256 1024);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1239
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1240 /* Log in to get a session */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1241 Seobeo_Request_Entry *session_req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1242 arena, "Host", "localhost", "Remote-Addr", "127.0.0.1", NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1243 Seobeo_Request_Entry *session_resp =
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1244 Auth_API_Test_Session_Handler(session_req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1245 const char *session_body = resp_field(session_resp, "body");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1246 ASSERT(session_body);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1247 const char *csrf_start = strstr(session_body, "\"csrfToken\":\"");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1248 ASSERT(csrf_start); csrf_start += strlen("\"csrfToken\":\"");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1249 char csrf_token[AUTH_CRYPTO_TOKEN_SIZE] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1250 const char *csrf_end = strchr(csrf_start, '"');
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1251 size_t csrf_len = (size_t)(csrf_end - csrf_start);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1252 memcpy(csrf_token, csrf_start, csrf_len);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1253
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1254 const char *guest_sc = resp_field(session_resp, "Set-Cookie");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1255 char guest_cookie_val[AUTH_CRYPTO_GUEST_COOKIE_SIZE] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1256 if (guest_sc)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1257 extract_cookie_value(guest_sc, AUTH_API_GUEST_COOKIE_NAME,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1258 guest_cookie_val, sizeof(guest_cookie_val));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1259
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1260 char login_body[512];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1261 snprintf(login_body, sizeof(login_body),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1262 "{\"username\":\"admin\",\"password\":\"%s\",\"csrfToken\":\"%s\"}",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1263 k_admin_password, csrf_token);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1264 char cookie_hdr[600] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1265 if (guest_cookie_val[0])
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1266 snprintf(cookie_hdr, sizeof(cookie_hdr),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1267 "%s=%s", AUTH_API_GUEST_COOKIE_NAME, guest_cookie_val);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1268 Seobeo_Request_Entry *login_req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1269 arena, "Host", "localhost", "Origin", "http://localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1270 "Remote-Addr", "127.0.0.1", "Body", login_body, NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1271 if (cookie_hdr[0])
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1272 Dowa_HashMap_Push_Arena(login_req, "Cookie", cookie_hdr, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1273 Seobeo_Request_Entry *login_resp =
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1274 Auth_API_Test_Login_Handler(login_req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1275 ASSERT(login_resp && strcmp(resp_status(login_resp), "200") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1276
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1277 /* Extract session token from login response */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1278 const char *session_sc = resp_field(login_resp, "Set-Cookie");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1279 ASSERT(session_sc);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1280 char session_token[COOKIE_VALUE_MAX] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1281 ASSERT(extract_cookie_value(session_sc, AUTH_API_SESSION_COOKIE_NAME,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1282 session_token, sizeof(session_token)));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1283 ASSERT(session_token[0] != '\0');
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1284
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1285 /* Extract new CSRF from login body */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1286 const char *login_body_resp = resp_field(login_resp, "body");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1287 ASSERT(login_body_resp);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1288 const char *lcs = strstr(login_body_resp, "\"csrfToken\":\"");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1289 ASSERT(lcs); lcs += strlen("\"csrfToken\":\"");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1290 char login_csrf[AUTH_CRYPTO_TOKEN_SIZE] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1291 const char *lce = strchr(lcs, '"');
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1292 memcpy(login_csrf, lcs, (size_t)(lce - lcs));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1293
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1294 TEST("POST logout with wrong CSRF → 403");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1295 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1296 char session_cookie[600];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1297 snprintf(session_cookie, sizeof(session_cookie),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1298 "%s=%s", AUTH_API_SESSION_COOKIE_NAME, session_token);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1299 char logout_body[256];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1300 snprintf(logout_body, sizeof(logout_body),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1301 "{\"csrfToken\":\"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"}");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1302 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1303 arena, "Host", "localhost", "Origin", "http://localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1304 "Remote-Addr", "127.0.0.1", "Cookie", session_cookie,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1305 "Body", logout_body, NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1306 Seobeo_Request_Entry *resp = Auth_API_Test_Logout_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1307 ASSERT(resp && strcmp(resp_status(resp), "403") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1308 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1309 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1310
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1311 TEST("POST logout with valid CSRF → 200, session cookie cleared");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1312 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1313 char session_cookie[600];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1314 snprintf(session_cookie, sizeof(session_cookie),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1315 "%s=%s", AUTH_API_SESSION_COOKIE_NAME, session_token);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1316 char logout_body[256];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1317 snprintf(logout_body, sizeof(logout_body),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1318 "{\"csrfToken\":\"%s\"}", login_csrf);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1319 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1320 arena, "Host", "localhost", "Origin", "http://localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1321 "Remote-Addr", "127.0.0.1", "Cookie", session_cookie,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1322 "Body", logout_body, NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1323 Seobeo_Request_Entry *resp = Auth_API_Test_Logout_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1324 ASSERT(resp && strcmp(resp_status(resp), "200") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1325 /* Session cookie should be cleared (Max-Age=0) */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1326 const char *sc_hdr = resp_field(resp, "Set-Cookie");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1327 ASSERT(sc_hdr && strstr(sc_hdr, "Max-Age=0"));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1328 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1329 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1330
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1331 Dowa_Arena_Free(arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1332 Auth_API_Destroy();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1333 unlink(db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1334 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1335
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1336 static void test_handler_password_flow(void)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1337 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1338 printf("\n[handler password flow]\n");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1339
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1340 char db[256];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1341 make_temp_db(db, sizeof(db));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1342 char pw_hash[AUTH_CRYPTO_PASSWORD_HASH_ENCODED_SIZE];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1343 init_auth_with_admin(db, pw_hash);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1344 Dowa_Arena arena = Dowa_Arena_Create(512 1024);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1345
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1346 /* Log in */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1347 Seobeo_Request_Entry *s0 = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1348 arena, "Host", "localhost", "Remote-Addr", "127.0.0.1", NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1349 Seobeo_Request_Entry *sr0 = Auth_API_Test_Session_Handler(s0, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1350 const char *sb0 = resp_field(sr0, "body");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1351 ASSERT(sb0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1352 const char *c0s = strstr(sb0, "\"csrfToken\":\"");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1353 ASSERT(c0s); c0s += strlen("\"csrfToken\":\"");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1354 char csrf0[AUTH_CRYPTO_TOKEN_SIZE] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1355 memcpy(csrf0, c0s, AUTH_CRYPTO_TOKEN_SIZE - 1);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1356
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1357 const char *gsc = resp_field(sr0, "Set-Cookie");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1358 char gcv[AUTH_CRYPTO_GUEST_COOKIE_SIZE] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1359 if (gsc) extract_cookie_value(gsc, AUTH_API_GUEST_COOKIE_NAME, gcv, sizeof(gcv));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1360
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1361 char lb[512];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1362 snprintf(lb, sizeof(lb),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1363 "{\"username\":\"admin\",\"password\":\"%s\",\"csrfToken\":\"%s\"}",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1364 k_admin_password, csrf0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1365 char ck[600] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1366 if (gcv[0]) snprintf(ck, sizeof(ck), "%s=%s", AUTH_API_GUEST_COOKIE_NAME, gcv);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1367 Seobeo_Request_Entry *lr = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1368 arena, "Host", "localhost", "Origin", "http://localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1369 "Remote-Addr", "127.0.0.1", "Body", lb, NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1370 if (ck[0]) Dowa_HashMap_Push_Arena(lr, "Cookie", ck, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1371 Seobeo_Request_Entry *lresp = Auth_API_Test_Login_Handler(lr, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1372 ASSERT(lresp && strcmp(resp_status(lresp), "200") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1373
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1374 char session_tok[COOKIE_VALUE_MAX] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1375 const char *lsc = resp_field(lresp, "Set-Cookie");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1376 ASSERT(extract_cookie_value(lsc, AUTH_API_SESSION_COOKIE_NAME,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1377 session_tok, sizeof(session_tok)));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1378 const char *lb2 = resp_field(lresp, "body");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1379 ASSERT(lb2);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1380 const char *lcs = strstr(lb2, "\"csrfToken\":\"");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1381 ASSERT(lcs); lcs += strlen("\"csrfToken\":\"");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1382 char user_csrf[AUTH_CRYPTO_TOKEN_SIZE] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1383 const char *lce = strchr(lcs, '"');
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1384 memcpy(user_csrf, lcs, (size_t)(lce - lcs));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1385
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1386 char sess_cookie[600];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1387 snprintf(sess_cookie, sizeof(sess_cookie),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1388 "%s=%s", AUTH_API_SESSION_COOKIE_NAME, session_tok);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1389
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1390 TEST("POST password with wrong CSRF → 403");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1391 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1392 char body[512];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1393 snprintf(body, sizeof(body),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1394 "{\"currentPassword\":\"%s\","
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1395 "\"newPassword\":\"NewPassword123!\","
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1396 "\"csrfToken\":\"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"}",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1397 k_admin_password);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1398 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1399 arena, "Host", "localhost", "Origin", "http://localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1400 "Remote-Addr", "127.0.0.1", "Cookie", sess_cookie,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1401 "Body", body, NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1402 Seobeo_Request_Entry *resp = Auth_API_Test_Password_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1403 ASSERT(resp && strcmp(resp_status(resp), "403") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1404 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1405 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1406
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1407 TEST("POST password with wrong current password → 401");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1408 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1409 char body[512];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1410 snprintf(body, sizeof(body),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1411 "{\"currentPassword\":\"WRONG_PASSWORD_123!\","
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1412 "\"newPassword\":\"NewPassword123!\","
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1413 "\"csrfToken\":\"%s\"}", user_csrf);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1414 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1415 arena, "Host", "localhost", "Origin", "http://localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1416 "Remote-Addr", "127.0.0.1", "Cookie", sess_cookie,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1417 "Body", body, NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1418 Seobeo_Request_Entry *resp = Auth_API_Test_Password_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1419 ASSERT(resp && strcmp(resp_status(resp), "401") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1420 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1421 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1422
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1423 TEST("POST password with valid CSRF + correct current → 200 + new session cookie");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1424 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1425 const char *new_password = "NewSecurePass456!";
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1426 char body[512];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1427 snprintf(body, sizeof(body),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1428 "{\"currentPassword\":\"%s\","
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1429 "\"newPassword\":\"%s\","
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1430 "\"csrfToken\":\"%s\"}",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1431 k_admin_password, new_password, user_csrf);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1432 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1433 arena, "Host", "localhost", "Origin", "http://localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1434 "Remote-Addr", "127.0.0.1", "Cookie", sess_cookie,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1435 "Body", body, NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1436 Seobeo_Request_Entry *resp = Auth_API_Test_Password_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1437 ASSERT(resp);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1438 ASSERT(strcmp(resp_status(resp), "200") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1439 const char *new_sc = resp_field(resp, "Set-Cookie");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1440 ASSERT(new_sc && strstr(new_sc, AUTH_API_SESSION_COOKIE_NAME));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1441 /* Old session should now be revoked */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1442 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1443 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1444
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1445 Dowa_Arena_Free(arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1446 Auth_API_Destroy();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1447 unlink(db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1448 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1449
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1450 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1451 /* Test group: Forced password change redirect (issue 7) */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1452 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1453
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1454 static void test_forced_password_change_redirect(void)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1455 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1456 printf("\n[forced password change redirect]\n");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1457
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1458 TEST("/account/password is in forced-change-only list");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1459 ASSERT(Auth_API_Is_Forced_Password_Change_Only(AUTH_API_PATH_PASSWORD_PAGE));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1460 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1461
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1462 TEST("standard auth paths still in forced-change-only list");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1463 ASSERT(Auth_API_Is_Forced_Password_Change_Only(AUTH_API_PATH_SESSION));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1464 ASSERT(Auth_API_Is_Forced_Password_Change_Only(AUTH_API_PATH_LOGIN));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1465 ASSERT(Auth_API_Is_Forced_Password_Change_Only(AUTH_API_PATH_LOGOUT));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1466 ASSERT(Auth_API_Is_Forced_Password_Change_Only(AUTH_API_PATH_PASSWORD));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1467 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1468
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1469 TEST("non-auth paths excluded");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1470 ASSERT(!Auth_API_Is_Forced_Password_Change_Only("/jrpg"));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1471 ASSERT(!Auth_API_Is_Forced_Password_Change_Only("/api/conversations"));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1472 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1473 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1474
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1475 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1476 /* Test group: Transfer hook failure (issue 6) */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1477 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1478
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1479 static boolean g_transfer_fail_hook_called = FALSE;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1480
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1481 static boolean transfer_always_fail(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1482 const char guest_id, const char user_id, void *context)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1483 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1484 (void)guest_id; (void)user_id; (void)context;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1485 g_transfer_fail_hook_called = TRUE;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1486 return FALSE;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1487 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1488
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1489 static void test_transfer_hook_failure(void)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1490 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1491 printf("\n[transfer hook failure]\n");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1492
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1493 char db[256];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1494 make_temp_db(db, sizeof(db));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1495 char pw_hash[AUTH_CRYPTO_PASSWORD_HASH_ENCODED_SIZE];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1496 init_auth_with_admin(db, pw_hash);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1497 Auth_API_Register_Guest_Transfer_Hook(transfer_always_fail, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1498
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1499 Dowa_Arena arena = Dowa_Arena_Create(256 1024);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1500
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1501 /* Get guest session + CSRF */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1502 Seobeo_Request_Entry *s0 = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1503 arena, "Host", "localhost", "Remote-Addr", "127.0.0.1", NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1504 Seobeo_Request_Entry *sr0 = Auth_API_Test_Session_Handler(s0, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1505 const char *sb0 = resp_field(sr0, "body");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1506 ASSERT(sb0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1507 const char *c0s = strstr(sb0, "\"csrfToken\":\"");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1508 ASSERT(c0s); c0s += strlen("\"csrfToken\":\"");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1509 char csrf0[AUTH_CRYPTO_TOKEN_SIZE] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1510 memcpy(csrf0, c0s, AUTH_CRYPTO_TOKEN_SIZE - 1);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1511
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1512 const char *gsc = resp_field(sr0, "Set-Cookie");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1513 char gcv[AUTH_CRYPTO_GUEST_COOKIE_SIZE] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1514 if (gsc) extract_cookie_value(gsc, AUTH_API_GUEST_COOKIE_NAME, gcv, sizeof(gcv));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1515
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1516 TEST("login with failing transfer hook → 500, no session cookie, guest preserved");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1517 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1518 g_transfer_fail_hook_called = FALSE;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1519
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1520 char lb[512];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1521 snprintf(lb, sizeof(lb),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1522 "{\"username\":\"admin\",\"password\":\"%s\","
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1523 "\"csrfToken\":\"%s\"}",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1524 k_admin_password, csrf0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1525 char ck[600] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1526 if (gcv[0])
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1527 snprintf(ck, sizeof(ck), "%s=%s", AUTH_API_GUEST_COOKIE_NAME, gcv);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1528 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1529 arena, "Host", "localhost", "Origin", "http://localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1530 "Remote-Addr", "127.0.0.1", "Body", lb, NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1531 if (ck[0]) Dowa_HashMap_Push_Arena(req, "Cookie", ck, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1532
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1533 Seobeo_Request_Entry *resp = Auth_API_Test_Login_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1534 ASSERT(resp);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1535 ASSERT(strcmp(resp_status(resp), "500") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1536 ASSERT(g_transfer_fail_hook_called);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1537 /* No session cookie should be set */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1538 const char *sc = resp_field(resp, "Set-Cookie");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1539 ASSERT(!sc \|\| !strstr(sc, AUTH_API_SESSION_COOKIE_NAME));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1540 /* No clear-guest cookie either (guest preserved) */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1541 ASSERT(!sc \|\| !strstr(sc, "Max-Age=0"));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1542 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1543 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1544
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1545 Auth_API_Register_Guest_Transfer_Hook(NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1546 Dowa_Arena_Free(arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1547 Auth_API_Destroy();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1548 unlink(db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1549 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1550
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1551 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1552 /* Test group: Rate limiter collision safety (issue 4) */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1553 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1554
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1555 static void test_rate_limiter_collision(void)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1556 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1557 printf("\n[rate limiter collision]\n");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1558
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1559 char db[256];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1560 make_temp_db(db, sizeof(db));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1561 init_auth(db, TRUE);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1562
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1563 /* Access internal rate functions indirectly via the login handler.
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1564 * Two different users from different IPs should not reset each other. */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1565
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1566 TEST("rate table handles many distinct keys without crash");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1567 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1568 Dowa_Arena arena = Dowa_Arena_Create(512 1024);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1569 /* Issue 256+ login attempts from different request contexts */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1570 for (int i = 0; i < 300; i++)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1571 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1572 char ip[32];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1573 snprintf(ip, sizeof(ip), "10.%d.%d.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1574 (i / 256) & 0xff, i & 0xff);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1575 char body[256];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1576 snprintf(body, sizeof(body),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1577 "{\"username\":\"u%d\",\"password\":\"password12345678\","
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1578 "\"csrfToken\":\"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"}",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1579 i);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1580 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1581 arena, "Host", "localhost", "Origin", "http://localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1582 "Remote-Addr", ip, "Body", body, NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1583 /* All will fail CSRF, which is fine — we just want no crash */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1584 Seobeo_Request_Entry *resp = Auth_API_Test_Login_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1585 (void)resp;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1586 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1587 Dowa_Arena_Free(arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1588 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1589 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1590
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1591 TEST("rate limit for key A does not affect unrelated key B");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1592 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1593 /* This exercises that rate_check returns FALSE for fresh keys.
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1594 * We verify by running many requests from IP A (distinct user) and
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1595 * then checking IP B (different user) is not blocked. */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1596 Dowa_Arena arena = Dowa_Arena_Create(512 1024);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1597 /* Drive requests from IP A to exhaust its counter */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1598 for (int i = 0; i < 10; i++)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1599 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1600 char body[256];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1601 snprintf(body, sizeof(body),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1602 "{\"username\":\"admin\",\"password\":\"badpassword12345\","
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1603 "\"csrfToken\":\"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"}");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1604 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1605 arena, "Host", "localhost", "Origin", "http://localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1606 "Remote-Addr", "10.0.0.1", "Body", body, NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1607 Auth_API_Test_Login_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1608 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1609 /* The test passes as long as we don't crash or affect IP B. */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1610 (void)0;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1611 Dowa_Arena_Free(arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1612 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1613 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1614
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1615 Auth_API_Destroy();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1616 unlink(db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1617 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1618
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1619 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1620 /* Test group: Init failure behavior (issue 2) */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1621 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1622
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1623 static void test_init_and_env_override(void)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1624 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1625 printf("\n[init and env override]\n");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1626
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1627 TEST("session handler returns 503 when store not initialised");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1628 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1629 /* Auth not initialised → handler should return 503 */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1630 Dowa_Arena arena = Dowa_Arena_Create(32 1024);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1631 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1632 arena, "Host", "localhost", "Remote-Addr", "127.0.0.1", NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1633 Seobeo_Request_Entry *resp = Auth_API_Test_Session_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1634 ASSERT(resp);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1635 ASSERT(strcmp(resp_status(resp), "503") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1636 Dowa_Arena_Free(arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1637 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1638 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1639
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1640 TEST("login handler returns 503 when store not initialised");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1641 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1642 Dowa_Arena arena = Dowa_Arena_Create(32 1024);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1643 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1644 arena, "Host", "localhost", "Origin", "http://localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1645 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1646 "Body", "{\"username\":\"u\",\"password\":\"p\",\"csrfToken\":\"t\"}",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1647 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1648 Seobeo_Request_Entry *resp = Auth_API_Test_Login_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1649 ASSERT(resp);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1650 ASSERT(strcmp(resp_status(resp), "503") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1651 Dowa_Arena_Free(arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1652 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1653 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1654 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1655
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1656 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1657 /* main */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1658 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1659
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1660 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1661 /* Test group: Resolve_Existing_Principal — no guest creation */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1662 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1663
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1664 static void test_resolve_existing_principal(void)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1665 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1666 printf("\n[resolve existing principal]\n");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1667
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1668 char db[256];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1669 make_temp_db(db, sizeof(db));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1670 init_auth(db, TRUE);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1671 Dowa_Arena arena = Dowa_Arena_Create(64 1024);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1672
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1673 TEST("no cookie → found=FALSE, no internal error");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1674 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1675 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1676 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1677 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1678 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1679 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1680 Auth_Principal p;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1681 boolean found = TRUE; /* pre-set to detect incorrect TRUE */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1682 boolean ok = Auth_API_Resolve_Existing_Principal(req, &p, arena, &found);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1683 ASSERT(ok);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1684 ASSERT(!found);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1685 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1686 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1687
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1688 TEST("repeated calls without cookie do not accumulate guest rows");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1689 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1690 /* Call resolve_existing 5 times; each must return found=FALSE.
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1691 * Then create one real guest via Resolve_Principal and verify only
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1692 * that one new guest cookie is generated. */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1693 for (int i = 0; i < 5; i++)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1694 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1695 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1696 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1697 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1698 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1699 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1700 Auth_Principal p;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1701 boolean found = TRUE;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1702 ASSERT(Auth_API_Resolve_Existing_Principal(req, &p, arena, &found));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1703 ASSERT(!found);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1704 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1705
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1706 /* Now create a real guest via the creating resolver */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1707 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1708 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1709 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1710 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1711 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1712 Auth_Principal p;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1713 char new_cookie[512] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1714 ASSERT(Auth_API_Resolve_Principal(req, &p, arena, new_cookie, sizeof(new_cookie)));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1715 ASSERT(p.kind == AUTH_PRINCIPAL_GUEST);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1716 ASSERT(new_cookie[0] != '\0'); /* cookie was generated */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1717 ASSERT(p.csrf_token[0] != '\0');
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1718 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1719 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1720
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1721 TEST("valid guest cookie → Resolve_Existing returns found=TRUE");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1722 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1723 /* First create a guest via the creating resolver */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1724 Seobeo_Request_Entry *req1 = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1725 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1726 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1727 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1728 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1729 Auth_Principal p1;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1730 char nc[512] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1731 ASSERT(Auth_API_Resolve_Principal(req1, &p1, arena, nc, sizeof(nc)));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1732 ASSERT(p1.kind == AUTH_PRINCIPAL_GUEST);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1733 ASSERT(nc[0] != '\0');
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1734
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1735 /* Extract the cookie value from the Set-Cookie directive */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1736 const char *cs = strchr(nc, '=');
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1737 ASSERT(cs); cs++;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1738 char cv[AUTH_CRYPTO_GUEST_COOKIE_SIZE] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1739 const char *ce = strchr(cs, ';');
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1740 size_t vl = ce ? (size_t)(ce - cs) : strlen(cs);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1741 ASSERT(vl < sizeof(cv));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1742 memcpy(cv, cs, vl);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1743
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1744 char cookie_hdr[600];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1745 snprintf(cookie_hdr, sizeof(cookie_hdr),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1746 "%s=%s", AUTH_API_GUEST_COOKIE_NAME, cv);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1747
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1748 /* Now resolve existing with the valid guest cookie */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1749 Seobeo_Request_Entry *req2 = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1750 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1751 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1752 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1753 "Cookie", cookie_hdr,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1754 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1755 Auth_Principal p2;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1756 boolean found = FALSE;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1757 boolean ok = Auth_API_Resolve_Existing_Principal(req2, &p2, arena, &found);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1758 ASSERT(ok);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1759 ASSERT(found);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1760 ASSERT(p2.kind == AUTH_PRINCIPAL_GUEST);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1761 ASSERT(strcmp(p1.guest_id, p2.guest_id) == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1762 ASSERT(strcmp(p1.csrf_token, p2.csrf_token) == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1763 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1764 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1765
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1766 TEST("unknown session token → found=FALSE (no guest row created)");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1767 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1768 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1769 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1770 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1771 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1772 "Cookie",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1773 "mjj_session=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1774 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1775 Auth_Principal p;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1776 boolean found = TRUE;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1777 boolean ok = Auth_API_Resolve_Existing_Principal(req, &p, arena, &found);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1778 ASSERT(ok);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1779 ASSERT(!found);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1780 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1781 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1782
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1783 Dowa_Arena_Free(arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1784 Auth_API_Destroy();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1785 unlink(db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1786 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1787
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1788 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1789 /* Session quota response */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1790 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1791
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1792 static void test_session_quota_response(void)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1793 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1794 printf("\n[session quota response]\n");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1795
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1796 char db[256];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1797 make_temp_db(db, sizeof(db));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1798 init_auth(db, TRUE);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1799 Dowa_Arena arena = Dowa_Arena_Create(64 1024);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1800
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1801 TEST("guest session returns quota null when no callback registered");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1802 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1803 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1804 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1805 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1806 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1807 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1808 Seobeo_Request_Entry *resp = Auth_API_Test_Session_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1809 ASSERT(resp);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1810 void *body_ptr = Dowa_HashMap_Get_Ptr(resp, "body");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1811 ASSERT(body_ptr);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1812 const char body = ((Seobeo_Request_Entry )body_ptr)->value;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1813 ASSERT(body);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1814 /* Without a registered quota callback, quota must be null. */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1815 ASSERT(strstr(body, "\"quota\":null") != NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1816 ASSERT(strstr(body, "\"kind\":\"guest\"") != NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1817 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1818 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1819
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1820 TEST("user session returns quota null");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1821 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1822 char pw_hash[AUTH_CRYPTO_PASSWORD_HASH_ENCODED_SIZE];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1823 ASSERT(Auth_Crypto_Password_Hash(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1824 "hunter2", pw_hash, sizeof(pw_hash)) == AUTH_CRYPTO_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1825 char uid[37];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1826 ASSERT(Auth_Store_Create_User(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1827 Auth_API_Get_Store(), "quotauser", pw_hash,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1828 "member", FALSE, uid) == AUTH_STORE_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1829
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1830 /* Create a session directly to skip CSRF ceremony. */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1831 char tok[AUTH_CRYPTO_TOKEN_SIZE] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1832 char csrft[AUTH_CRYPTO_TOKEN_SIZE] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1833 ASSERT(Auth_Crypto_Token_Generate(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1834 tok, sizeof(tok)) == AUTH_CRYPTO_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1835 ASSERT(Auth_Crypto_Token_Generate(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1836 csrft, sizeof(csrft)) == AUTH_CRYPTO_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1837 char tok_digest[AUTH_CRYPTO_TOKEN_DIGEST_SIZE] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1838 char csrf_digest[AUTH_CRYPTO_TOKEN_DIGEST_SIZE] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1839 ASSERT(Auth_Crypto_Token_Digest(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1840 tok, tok_digest, sizeof(tok_digest)) == AUTH_CRYPTO_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1841 ASSERT(Auth_Crypto_Token_Digest(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1842 csrft, csrf_digest, sizeof(csrf_digest)) == AUTH_CRYPTO_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1843 Auth_Session_Record sess;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1844 ASSERT(Auth_Store_Create_Session(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1845 Auth_API_Get_Store(), uid, tok_digest, csrf_digest,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1846 86400, 86400, (int64)time(NULL), &sess) == AUTH_STORE_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1847
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1848 char cookie_hdr[600];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1849 snprintf(cookie_hdr, sizeof(cookie_hdr),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1850 "%s=%s", AUTH_API_SESSION_COOKIE_NAME, tok);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1851
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1852 Seobeo_Request_Entry *sess_req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1853 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1854 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1855 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1856 "Cookie", cookie_hdr,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1857 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1858 Seobeo_Request_Entry *sess_resp = Auth_API_Test_Session_Handler(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1859 sess_req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1860 ASSERT(sess_resp);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1861 const char *body = resp_field(sess_resp, "body");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1862 ASSERT(body);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1863 ASSERT(strstr(body, "\"kind\":\"user\"") != NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1864 /* Authenticated users always get null quota. */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1865 ASSERT(strstr(body, "\"quota\":null") != NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1866 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1867 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1868
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1869 Dowa_Arena_Free(arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1870 Auth_API_Destroy();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1871 unlink(db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1872 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1873
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1874 int main(void)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1875 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1876 printf("=== auth_api_test ===\n");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1877
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1878 test_init_fail_closed();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1879 test_cookie_parsing();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1880 test_trusted_proxy();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1881 test_bootstrap();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1882 test_forced_password_change_paths();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1883 test_csrf_and_origin();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1884 test_login_lifecycle();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1885 test_session_expiry();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1886 test_transfer_hook();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1887 test_rate_limiter();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1888 test_secure_cookie_policy();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1889
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1890 /* New tests for issues 1, 4, 6, 7, 8 */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1891 test_csrf_token_length();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1892 test_forced_password_change_redirect();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1893 test_init_and_env_override();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1894 test_handler_login_flow();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1895 test_handler_logout_flow();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1896 test_handler_password_flow();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1897 test_transfer_hook_failure();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1898 test_rate_limiter_collision();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1899
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1900 /* Task 2: Resolve_Existing_Principal */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1901 test_resolve_existing_principal();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1902
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1903 /* Guest quota */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1904 test_session_quota_response();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1905
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1906 printf("\n=== ALL TESTS PASSED ===\n");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1907 return 0;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1908 }

Mercurial

annotate mrjunejune/test/auth_api_test.c @ 273:e02e2036ef84 default tip