mirror of
https://github.com/jcreek/CosmicClash.git
synced 2026-09-10 16:04:04 +00:00
Josh Creek
d588898f5d
The just-landed signed workload token embedded (allocation_id, match_id, server_id) as claims. That doesn't actually work for its intended delivery channel: the token is meant to be requested as a GameServerAllocation annotation in the SAME request that asks Agones to pick a server, so at mint time the allocator knows allocation_id (it generates it) but not yet which server_id Agones will return -- server_id only exists in Agones's response, after the annotation request has already been sent. Embedding it was simply not possible for the real caller this was built for; only the (allocator -> signed_token) unit tests and hand-constructed integration tests happened to supply it directly, masking the gap. Fixes it by having the token bind only allocation_id (the one identifier actually known at mint time) plus expiry. match_id/server_id are resolved at verify time from the durable allocations table via the new store.AllocationBindingByAllocationID, keyed by allocation_id -- which the allocator already records immediately after Agones responds. This is strictly stronger, not just a workaround: a caller can no longer claim any match/server pairing at all, even one that happens to be internally consistent -- the binding returned is entirely durable-record-derived. Verified: server/workload's unit tests updated for the new two-field claim shape; server/api's Postgres integration suite gains TestWorkloadVerifierFromSignedTokenNeverTrustsCallerSuppliedBinding (two distinct real allocations each resolve to their own, and only their own, match/server pairing) replacing the now-inapplicable mismatched-triple test. Full `go build ./... && go vet ./... && gofmt -l . && go test ./... -race` and `go test -tags integration ./... -race` both clean; the api integration suite re-run 3x clean against a live postgres:17-alpine container.
97 lines
3.2 KiB
Go
97 lines
3.2 KiB
Go
package workload
|
|
|
|
import (
|
|
"errors"
|
|
"testing"
|
|
"time"
|
|
)
|
|
|
|
func TestSignedWorkloadTokenRoundTrips(t *testing.T) {
|
|
secret := []byte("test-secret")
|
|
now := time.Unix(1_700_000_000, 0).UTC()
|
|
token, err := IssueSignedWorkloadToken(secret, "alloc-1", now, time.Minute)
|
|
if err != nil {
|
|
t.Fatalf("issue: %v", err)
|
|
}
|
|
claims, err := ParseSignedWorkloadToken(secret, token, now.Add(30*time.Second))
|
|
if err != nil {
|
|
t.Fatalf("parse: %v", err)
|
|
}
|
|
if claims.AllocationID != "alloc-1" {
|
|
t.Fatalf("unexpected claims: %+v", claims)
|
|
}
|
|
}
|
|
|
|
func TestSignedWorkloadTokenRejectsExpiry(t *testing.T) {
|
|
secret := []byte("test-secret")
|
|
now := time.Unix(1_700_000_000, 0).UTC()
|
|
token, err := IssueSignedWorkloadToken(secret, "alloc-1", now, time.Minute)
|
|
if err != nil {
|
|
t.Fatalf("issue: %v", err)
|
|
}
|
|
if _, err := ParseSignedWorkloadToken(secret, token, now.Add(61*time.Second)); !errors.Is(err, ErrTokenExpired) {
|
|
t.Fatalf("expected ErrTokenExpired, got %v", err)
|
|
}
|
|
// Boundary: exactly at expiry must also be rejected (Before, not
|
|
// Before-or-equal), matching the proposal-expiry read boundary
|
|
// convention used elsewhere in this codebase.
|
|
if _, err := ParseSignedWorkloadToken(secret, token, now.Add(time.Minute)); !errors.Is(err, ErrTokenExpired) {
|
|
t.Fatalf("expected ErrTokenExpired at the boundary, got %v", err)
|
|
}
|
|
}
|
|
|
|
func TestSignedWorkloadTokenRejectsTamperedPayload(t *testing.T) {
|
|
secret := []byte("test-secret")
|
|
now := time.Unix(1_700_000_000, 0).UTC()
|
|
token, err := IssueSignedWorkloadToken(secret, "alloc-1", now, time.Minute)
|
|
if err != nil {
|
|
t.Fatalf("issue: %v", err)
|
|
}
|
|
tampered := token[:len(token)-4] + "AAAA"
|
|
if _, err := ParseSignedWorkloadToken(secret, tampered, now); !errors.Is(err, ErrTokenSignature) && !errors.Is(err, ErrMalformedToken) {
|
|
t.Fatalf("expected signature/malformed rejection, got %v", err)
|
|
}
|
|
}
|
|
|
|
func TestSignedWorkloadTokenRejectsWrongSecret(t *testing.T) {
|
|
now := time.Unix(1_700_000_000, 0).UTC()
|
|
token, err := IssueSignedWorkloadToken([]byte("secret-a"), "alloc-1", now, time.Minute)
|
|
if err != nil {
|
|
t.Fatalf("issue: %v", err)
|
|
}
|
|
if _, err := ParseSignedWorkloadToken([]byte("secret-b"), token, now); !errors.Is(err, ErrTokenSignature) {
|
|
t.Fatalf("expected ErrTokenSignature, got %v", err)
|
|
}
|
|
}
|
|
|
|
func TestSignedWorkloadTokenRejectsMalformedInput(t *testing.T) {
|
|
secret := []byte("test-secret")
|
|
now := time.Unix(1_700_000_000, 0).UTC()
|
|
for _, token := range []string{"", "no-dot-here", ".missing-payload", "missing-signature.", "!!!.!!!"} {
|
|
if _, err := ParseSignedWorkloadToken(secret, token, now); err == nil {
|
|
t.Fatalf("token %q: expected an error, got nil", token)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestIssueSignedWorkloadTokenRejectsInvalidInput(t *testing.T) {
|
|
now := time.Unix(1_700_000_000, 0).UTC()
|
|
cases := []struct {
|
|
name string
|
|
secret []byte
|
|
allocationID string
|
|
now time.Time
|
|
ttl time.Duration
|
|
}{
|
|
{"empty secret", nil, "a", now, time.Minute},
|
|
{"empty allocation id", []byte("k"), "", now, time.Minute},
|
|
{"zero now", []byte("k"), "a", time.Time{}, time.Minute},
|
|
{"non-positive ttl", []byte("k"), "a", now, 0},
|
|
}
|
|
for _, c := range cases {
|
|
if _, err := IssueSignedWorkloadToken(c.secret, c.allocationID, c.now, c.ttl); err == nil {
|
|
t.Fatalf("%s: expected an error, got nil", c.name)
|
|
}
|
|
}
|
|
}
|