egutierrez
eff5771b03
Fase 2 del issue 0010 — auth core: - jwt_generate/validate: HS256 manual con crypto/hmac + crypto/sha256 - password_hash/verify: wrappers de golang.org/x/crypto/bcrypt (cost 12 default) - JWT rechaza alg != HS256 para mitigar ataque 'alg=none' - hmac.Equal para comparacion constant-time de firmas
35 lines
747 B
Go
35 lines
747 B
Go
package infra
|
|
|
|
import (
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestPasswordHash_DefaultCost(t *testing.T) {
|
|
hash, err := PasswordHash("hunter2", 0)
|
|
if err != nil {
|
|
t.Fatalf("PasswordHash error: %v", err)
|
|
}
|
|
if !strings.HasPrefix(hash, "$2") {
|
|
t.Errorf("hash no tiene prefijo bcrypt: %q", hash)
|
|
}
|
|
}
|
|
|
|
func TestPasswordHash_CustomCost(t *testing.T) {
|
|
hash, err := PasswordHash("password", 4) // 4 = minimum, rapido para tests
|
|
if err != nil {
|
|
t.Fatalf("PasswordHash error: %v", err)
|
|
}
|
|
if hash == "" {
|
|
t.Fatal("hash vacio")
|
|
}
|
|
}
|
|
|
|
func TestPasswordHash_DifferentSalts(t *testing.T) {
|
|
h1, _ := PasswordHash("same-password", 4)
|
|
h2, _ := PasswordHash("same-password", 4)
|
|
if h1 == h2 {
|
|
t.Fatal("los hashes deben diferir por salt distinto")
|
|
}
|
|
}
|