navidrome/core/auth/auth_test.go

package auth_test

import (
	"testing"
	"time"

	"github.com/navidrome/navidrome/conf"
	"github.com/navidrome/navidrome/consts"
	"github.com/navidrome/navidrome/core/auth"
	"github.com/navidrome/navidrome/log"
	"github.com/navidrome/navidrome/model"
	"github.com/navidrome/navidrome/tests"
	. "github.com/onsi/ginkgo/v2"
	. "github.com/onsi/gomega"
)

func TestAuth(t *testing.T) {
	log.SetLevel(log.LevelFatal)
	RegisterFailHandler(Fail)
	RunSpecs(t, "Auth Test Suite")
}

const (
	oneDay = 24 * time.Hour
)

var _ = BeforeSuite(func() {
	conf.Server.SessionTimeout = 2 * oneDay
})

var _ = Describe("Auth", func() {

	BeforeEach(func() {
		ds := &tests.MockDataStore{
			MockedProperty: &tests.MockedPropertyRepo{},
		}
		auth.Init(ds)
	})

	Describe("Validate", func() {
		It("returns error with an invalid JWT token", func() {
			_, err := auth.Validate("invalid.token")
			Expect(err).To(HaveOccurred())
		})

		It("returns the claims from a valid JWT token", func() {
			claims := map[string]any{}
			claims["iss"] = "issuer"
			claims["iat"] = time.Now().Unix()
			claims["exp"] = time.Now().Add(1 * time.Minute).Unix()
			_, tokenStr, err := auth.TokenAuth.Encode(claims)
			Expect(err).NotTo(HaveOccurred())

			decodedClaims, err := auth.Validate(tokenStr)
			Expect(err).NotTo(HaveOccurred())
			Expect(decodedClaims.Issuer).To(Equal("issuer"))
		})

		It("returns ErrExpired if the `exp` field is in the past", func() {
			claims := map[string]any{}
			claims["iss"] = "issuer"
			claims["exp"] = time.Now().Add(-1 * time.Minute).Unix()
			_, tokenStr, err := auth.TokenAuth.Encode(claims)
			Expect(err).NotTo(HaveOccurred())

			_, err = auth.Validate(tokenStr)
			Expect(err).To(MatchError("token is expired"))
		})
	})

	Describe("CreateToken", func() {
		It("creates a valid token", func() {
			u := &model.User{
				ID:       "123",
				UserName: "johndoe",
				IsAdmin:  true,
			}
			tokenStr, err := auth.CreateToken(u)
			Expect(err).NotTo(HaveOccurred())

			claims, err := auth.Validate(tokenStr)
			Expect(err).NotTo(HaveOccurred())

			Expect(claims.Issuer).To(Equal(consts.JWTIssuer))
			Expect(claims.Subject).To(Equal("johndoe"))
			Expect(claims.UserID).To(Equal("123"))
			Expect(claims.IsAdmin).To(Equal(true))
			Expect(claims.ExpiresAt).To(BeTemporally(">", time.Now()))
		})
	})

	Describe("Session/Public secret split", func() {
		claims := func() map[string]any {
			return map[string]any{"iss": "issuer", "exp": time.Now().Add(1 * time.Minute).Unix()}
		}

		It("verifies a session token via Validate but not ValidatePublic", func() {
			_, tokenStr, err := auth.TokenAuth.Encode(claims())
			Expect(err).NotTo(HaveOccurred())
			_, err = auth.Validate(tokenStr)
			Expect(err).NotTo(HaveOccurred())
			_, err = auth.ValidatePublic(tokenStr)
			Expect(err).To(HaveOccurred())
		})

		It("verifies a public token via ValidatePublic but not Validate", func() {
			_, tokenStr, err := auth.PublicTokenAuth.Encode(claims())
			Expect(err).NotTo(HaveOccurred())
			_, err = auth.ValidatePublic(tokenStr)
			Expect(err).NotTo(HaveOccurred())
			_, err = auth.Validate(tokenStr)
			Expect(err).To(HaveOccurred())
		})

		It("decodes public tokens minted by CreatePublicToken via PublicTokenAuth", func() {
			tokenStr, err := auth.CreatePublicToken(auth.Claims{ID: "art-1"})
			Expect(err).NotTo(HaveOccurred())
			claims, err := auth.ValidatePublic(tokenStr)
			Expect(err).NotTo(HaveOccurred())
			Expect(claims.ID).To(Equal("art-1"))
			_, err = auth.Validate(tokenStr)
			Expect(err).To(HaveOccurred())
		})

		It("decodes expiring public tokens minted by CreateExpiringPublicToken via PublicTokenAuth", func() {
			exp := time.Now().Add(1 * time.Hour)
			tokenStr, err := auth.CreateExpiringPublicToken(exp, auth.Claims{ID: "art-2"})
			Expect(err).NotTo(HaveOccurred())
			claims, err := auth.ValidatePublic(tokenStr)
			Expect(err).NotTo(HaveOccurred())
			Expect(claims.ID).To(Equal("art-2"))
			_, err = auth.Validate(tokenStr)
			Expect(err).To(HaveOccurred())
		})
	})

	Describe("TouchToken", func() {
		It("updates the expiration time", func() {
			yesterday := time.Now().Add(-oneDay)
			claims := map[string]any{}
			claims["iss"] = "issuer"
			claims["exp"] = yesterday.Unix()
			token, _, err := auth.TokenAuth.Encode(claims)
			Expect(err).NotTo(HaveOccurred())

			touched, err := auth.TouchToken(token)
			Expect(err).NotTo(HaveOccurred())

			decodedClaims, err := auth.Validate(touched)
			Expect(err).NotTo(HaveOccurred())
			Expect(decodedClaims.ExpiresAt.Sub(yesterday)).To(BeNumerically(">=", oneDay))
		})
	})
})