initial commit

internal/session/session_test.go

@@ -0,0 +1,43 @@
+package session
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+func TestSessionRoundTrip(t *testing.T) {
+	manager := New("01234567890123456789012345678901", false)
+	recorder := httptest.NewRecorder()
+	if err := manager.Set(recorder, Claims{UserID: "user-1", Email: "a@example.com"}); err != nil {
+		t.Fatalf("Set() error = %v", err)
+	}
+	request := httptest.NewRequest("GET", "/", nil)
+	request.AddCookie(recorder.Result().Cookies()[0])
+	claims, err := manager.Get(request)
+	if err != nil {
+		t.Fatalf("Get() error = %v", err)
+	}
+	if claims.UserID != "user-1" {
+		t.Fatalf("UserID = %q", claims.UserID)
+	}
+}
+
+func TestRejectsTamperedSession(t *testing.T) {
+	manager := New("01234567890123456789012345678901", false)
+	request := httptest.NewRequest("GET", "/", nil)
+	request.AddCookie(&http.Cookie{Name: cookieName, Value: "tampered.value"})
+	if _, err := manager.Get(request); err == nil {
+		t.Fatal("expected tampered session to fail")
+	}
+}
+
+func TestSignedValueAllowsDots(t *testing.T) {
+	manager := New("01234567890123456789012345678901", false)
+	value := "/connect/authorize?redirect_uri=https://app.example.test/callback"
+	signed := manager.SignedState(value)
+	got, ok := manager.VerifySigned(signed)
+	if !ok || got != value {
+		t.Fatalf("VerifySigned() = %q, %v", got, ok)
+	}
+}