appcore-security 1.0.1-rc.8

Security contracts and token utilities for AppCore Runtime.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121

// =============================================================================
//        #######
//     ###       ###     F: hashtoken_tests.rs
//    ##   ## ##   ##    P: AppCore-Runtime
//         ## ##
//                       C: 2026/06/04 11:51:26 by dnettoRaw
//    ##   ## ##   ##    U: 2026/06/04 11:51:26 by dnettoRaw
//      ###########      S: 0.6.0
// =============================================================================

use super::HashTokenProvider;
use crate::token::{SecurityError, TokenClaims, TokenProvider};
use crate::{new_rotated_secret, FileSecretKeyring};

fn claims() -> TokenClaims {
    TokenClaims {
        issuer: "runtime-a".to_string(),
        audience: "runtime-b".to_string(),
        salt: "salt-1".to_string(),
        ttl_ms: 2_000,
    }
}

fn provider() -> HashTokenProvider {
    HashTokenProvider::from_secret(b"explicit-test-secret".to_vec()).expect("provider")
}

#[test]
fn sign_and_verify_work() {
    let provider = provider();
    let payload = b"payload";
    let signature = provider.sign(payload, &claims());
    assert!(signature.is_ok());
    let signature = match signature {
        Ok(signature) => signature,
        Err(_) => return,
    };
    assert!(provider.verify(payload, &signature, &claims()).is_ok());
}

#[test]
fn seal_and_open_work() {
    let provider = provider();
    let payload = b"secret";
    let token = provider.seal(payload, &claims());
    assert!(token.is_ok());
    let token = match token {
        Ok(token) => token,
        Err(_) => return,
    };
    let opened = provider.open(&token, &claims());
    assert_eq!(opened.ok(), Some(payload.to_vec()));
}

#[test]
fn issuer_mismatch_fails() {
    let provider = provider();
    let payload = b"payload";
    let signature = provider.sign(payload, &claims());
    assert!(signature.is_ok());
    let signature = match signature {
        Ok(signature) => signature,
        Err(_) => return,
    };
    let wrong = TokenClaims {
        issuer: "wrong".to_string(),
        ..claims()
    };
    assert_eq!(
        provider.verify(payload, &signature, &wrong),
        Err(SecurityError::VerificationFailed)
    );
}

#[test]
fn explicit_secret_is_required() {
    assert!(matches!(
        HashTokenProvider::from_secret(Vec::new()),
        Err(SecurityError::InvalidToken)
    ));
}

#[test]
fn keyring_rotation_keeps_existing_tokens_valid_without_restarting_provider() {
    let root = std::env::temp_dir().join(format!(
        "appcore-hashtoken-keyring-{}-{}",
        std::process::id(),
        super::unix_time_ms()
    ));
    let keyring = FileSecretKeyring::open(&root).unwrap();
    let first = new_rotated_secret(None).unwrap();
    keyring.install_initial(&first).unwrap();
    let provider = HashTokenProvider::from_keyring(
        keyring.clone(),
        vec![b"app-a".to_vec(), b"cluster-a".to_vec()],
    )
    .unwrap();
    let payload = b"rotation-payload";
    let first_signature = provider.sign(payload, &claims()).unwrap();

    let second = new_rotated_secret(None).unwrap();
    keyring.rotate(&second, super::unix_time_ms()).unwrap();
    assert!(provider
        .verify(payload, &first_signature, &claims())
        .is_ok());
    let second_signature = provider.sign(payload, &claims()).unwrap();
    assert_ne!(first_signature, second_signature);
    assert!(provider
        .verify(payload, &second_signature, &claims())
        .is_ok());

    keyring.revoke(&first.metadata.key_id).unwrap();
    assert_eq!(
        provider.verify(payload, &first_signature, &claims()),
        Err(SecurityError::VerificationFailed)
    );
    assert!(provider
        .verify(payload, &second_signature, &claims())
        .is_ok());
    std::fs::remove_dir_all(root).unwrap();
}