feat: validate workload-bound result credentials

server/domain/workload_test.go

@@ -0,0 +1,80 @@
+package domain
+
+import (
+	"errors"
+	"testing"
+	"time"
+)
+
+func testCredential(binding WorkloadBinding, now time.Time) WorkloadCredential {
+	return WorkloadCredential{
+		Issuer: binding.Issuer, Audience: binding.Audience, IssuedAt: now.Add(-time.Minute), ExpiresAt: now.Add(time.Minute),
+		Namespace: binding.Namespace, ServiceAcct: binding.ServiceAcct, PodUID: binding.PodUID,
+		GameServerUID: binding.GameServerUID, AllocationID: binding.AllocationID, MatchID: binding.MatchID,
+		ServerID: binding.ServerID, Signature: []byte("attestation"),
+	}
+}
+
+func TestWorkloadCredentialValidatesOneAllocationIdentity(t *testing.T) {
+	now := time.Unix(1000, 0).UTC()
+	binding := testBinding()
+	policy, err := NewWorkloadCredentialPolicy(binding, func(credential WorkloadCredential) bool {
+		return string(credential.Signature) == "attestation"
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	got, err := policy.Validate(testCredential(binding, now), now)
+	if err != nil || got != binding {
+		t.Fatalf("valid credential = %+v, err=%v", got, err)
+	}
+}
+
+func TestWorkloadCredentialRejectsEveryBindingAndTimeMutation(t *testing.T) {
+	now := time.Unix(1000, 0).UTC()
+	binding := testBinding()
+	policy, _ := NewWorkloadCredentialPolicy(binding, func(credential WorkloadCredential) bool { return true })
+	mutate := []func(*WorkloadCredential){
+		func(c *WorkloadCredential) { c.Issuer = "other" },
+		func(c *WorkloadCredential) { c.Audience = "other" },
+		func(c *WorkloadCredential) { c.Namespace = "other" },
+		func(c *WorkloadCredential) { c.ServiceAcct = "other" },
+		func(c *WorkloadCredential) { c.PodUID = "other" },
+		func(c *WorkloadCredential) { c.GameServerUID = "other" },
+		func(c *WorkloadCredential) { c.AllocationID = "other" },
+		func(c *WorkloadCredential) { c.MatchID = "other" },
+		func(c *WorkloadCredential) { c.ServerID = "other" },
+		func(c *WorkloadCredential) { c.ExpiresAt = now },
+		func(c *WorkloadCredential) { c.IssuedAt = now.Add(time.Second) },
+	}
+	for i, change := range mutate {
+		credential := testCredential(binding, now)
+		change(&credential)
+		if _, err := policy.Validate(credential, now); !errors.Is(err, ErrWorkloadCredential) {
+			t.Fatalf("mutation %d accepted: %v", i, err)
+		}
+	}
+	badSignature, _ := NewWorkloadCredentialPolicy(binding, func(WorkloadCredential) bool { return false })
+	if _, err := badSignature.Validate(testCredential(binding, now), now); !errors.Is(err, ErrWorkloadCredential) {
+		t.Fatalf("unverified signature accepted: %v", err)
+	}
+}
+
+func TestWorkloadCredentialRejectsMissingClaimsAndBoundaryExpiry(t *testing.T) {
+	now := time.Unix(1000, 0).UTC()
+	binding := testBinding()
+	policy, _ := NewWorkloadCredentialPolicy(binding, func(WorkloadCredential) bool { return true })
+	credential := testCredential(binding, now)
+	credential.Signature = nil
+	if _, err := policy.Validate(credential, now); !errors.Is(err, ErrWorkloadCredential) {
+		t.Fatalf("missing signature accepted: %v", err)
+	}
+	credential = testCredential(binding, now)
+	if _, err := policy.Validate(credential, credential.ExpiresAt); !errors.Is(err, ErrWorkloadCredential) {
+		t.Fatalf("expiry boundary accepted: %v", err)
+	}
+	credential = testCredential(binding, now)
+	if _, err := policy.Validate(credential, credential.IssuedAt.Add(-time.Nanosecond)); !errors.Is(err, ErrWorkloadCredential) {
+		t.Fatalf("not-before boundary accepted: %v", err)
+	}
+}