feat: add ticket and session policy

server/domain/auth_test.go

@@ -0,0 +1,63 @@
+package domain
+
+import (
+	"errors"
+	"testing"
+	"time"
+)
+
+func TestTicketVerifierBindsAppIdentityExpiryAndSingleUse(t *testing.T) {
+	now := time.Unix(1000, 0)
+	verifier, _ := NewTicketVerifier(480)
+	ticket := SteamTicket{TicketID: "ticket-1", SteamID: "steam-1", AppID: 480, ExpiresAt: now.Add(time.Minute)}
+	resolve := func(steamID string) (string, bool) { return "player-1", steamID == "steam-1" }
+	identity, err := verifier.Verify(ticket, resolve, now)
+	if err != nil || identity.PlayerID != "player-1" || identity.SteamID != "steam-1" {
+		t.Fatalf("identity = %+v err=%v", identity, err)
+	}
+	if _, err := verifier.Verify(ticket, resolve, now); !errors.Is(err, ErrTicketRejected) {
+		t.Fatalf("ticket replay accepted: %v", err)
+	}
+	wrong := ticket
+	wrong.TicketID = "ticket-2"
+	wrong.AppID = 481
+	if _, err := verifier.Verify(wrong, resolve, now); !errors.Is(err, ErrTicketRejected) {
+		t.Fatalf("wrong app accepted: %v", err)
+	}
+	expired := ticket
+	expired.TicketID = "ticket-3"
+	expired.ExpiresAt = now
+	if _, err := verifier.Verify(expired, resolve, now); !errors.Is(err, ErrTicketRejected) {
+		t.Fatalf("expired ticket accepted: %v", err)
+	}
+	unknown := ticket
+	unknown.TicketID = "ticket-4"
+	unknown.SteamID = "steam-unknown"
+	if _, err := verifier.Verify(unknown, resolve, now); !errors.Is(err, ErrTicketRejected) {
+		t.Fatalf("unresolved SteamID accepted: %v", err)
+	}
+}
+
+func TestSessionIsOpaqueShortLivedAndRevocable(t *testing.T) {
+	now := time.Unix(1000, 0)
+	store := NewSessionStore()
+	session, token, err := store.Issue("player-1", time.Minute, now)
+	if err != nil || token == "" || session.PlayerID != "player-1" {
+		t.Fatalf("issue = %+v token=%q err=%v", session, token, err)
+	}
+	if _, err := store.Authenticate(session.SessionID, "wrong", now); !errors.Is(err, ErrSessionRejected) {
+		t.Fatalf("wrong token accepted: %v", err)
+	}
+	if got, err := store.Authenticate(session.SessionID, token, now.Add(59*time.Second)); err != nil || got.SessionID != session.SessionID {
+		t.Fatalf("valid auth = %+v err=%v", got, err)
+	}
+	if err := store.Revoke(session.SessionID, now); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := store.Authenticate(session.SessionID, token, now); !errors.Is(err, ErrSessionRejected) {
+		t.Fatalf("revoked session accepted: %v", err)
+	}
+	if _, err := store.Authenticate(session.SessionID, token, now.Add(time.Minute)); !errors.Is(err, ErrSessionRejected) {
+		t.Fatalf("expired session accepted: %v", err)
+	}
+}