mirror of
https://github.com/whyour/qinglong.git
synced 2026-09-20 16:07:11 +08:00
35 lines
1.3 KiB
JavaScript
35 lines
1.3 KiB
JavaScript
const assert = require('node:assert/strict');
|
|
const { test } = require('node:test');
|
|
const {
|
|
InvalidApiCredentialTokenValueError,
|
|
apiCredentialSecretDigest,
|
|
assertApiCredentialPepper,
|
|
formatApiCredentialToken,
|
|
} = require('@qinglong/runtime-core/api-credential-token');
|
|
|
|
test('derives one domain-separated digest and formats the canonical token', () => {
|
|
const pepper = Buffer.alloc(32, 1).toString('base64url');
|
|
const secret = Buffer.alloc(32, 2).toString('base64url');
|
|
assert.doesNotThrow(() => assertApiCredentialPepper(pepper));
|
|
assert.equal(
|
|
apiCredentialSecretDigest(pepper, 'app_primary', secret),
|
|
'e15b6ff4b2ab5037c149974e6bd788eca4777e4d698f649373d39244555d4991',
|
|
);
|
|
assert.equal(
|
|
formatApiCredentialToken('app_primary', secret),
|
|
`ql3c_app_primary_${secret}`,
|
|
);
|
|
});
|
|
|
|
test('rejects weak, non-canonical and widened token material', () => {
|
|
const canonical = Buffer.alloc(32, 1).toString('base64url');
|
|
for (const action of [
|
|
() => assertApiCredentialPepper('weak'),
|
|
() => apiCredentialSecretDigest(canonical, '../escape', canonical),
|
|
() => apiCredentialSecretDigest(canonical, 'valid', `${canonical}=`),
|
|
() => formatApiCredentialToken('valid', 'weak'),
|
|
]) {
|
|
assert.throws(action, InvalidApiCredentialTokenValueError);
|
|
}
|
|
});
|