v0.11.0 harden persistence and prepare game replays

internal/server/service/user_test.go

@@ -0,0 +1,48 @@
+package service
+
+import (
+	"testing"
+
+	"github.com/lixenwraith/auth"
+)
+
+func TestValidateTokenRequiresSessionBoundToSubject(t *testing.T) {
+	svc := newPersistentTestService(t)
+	user, sessionID, err := svc.RegisterUser("alice", "", "Password1", false)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	validToken, err := svc.GenerateUserToken(user.UserID, sessionID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if gotUserID, _, err := svc.ValidateToken(validToken); err != nil || gotUserID != user.UserID {
+		t.Fatalf("valid token rejected: user=%q err=%v", gotUserID, err)
+	}
+
+	missingSession, err := auth.GenerateHS256Token(svc.jwtSecret, user.UserID, nil, SessionTTL)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, _, err := svc.ValidateToken(missingSession); err == nil {
+		t.Fatal("token without a persisted session was accepted")
+	}
+
+	wrongSubject, err := auth.GenerateHS256Token(svc.jwtSecret, "other-user", map[string]any{
+		"session_id": sessionID,
+	}, SessionTTL)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, _, err := svc.ValidateToken(wrongSubject); err == nil {
+		t.Fatal("session was accepted for a different JWT subject")
+	}
+
+	if err := svc.InvalidateSession(sessionID); err != nil {
+		t.Fatal(err)
+	}
+	if _, _, err := svc.ValidateToken(validToken); err == nil {
+		t.Fatal("invalidated session was accepted")
+	}
+}