sdforge 0.3.1

Multi-protocol SDK framework with unified macro configuration
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212

// Copyright (c) 2026 Kirky.X
// SPDX-License-Identifier: MIT
//! Tests for `AuthGrpcInterceptor` JWT bearer token validation behavior.

#[cfg(feature = "security")]
use super::super::make_auth_interceptor;
#[cfg(feature = "security")]
use super::make_test_jwt;
#[cfg(feature = "security")]
use tonic::service::Interceptor;

// ============================================================================
// gRPC Auth Interceptor Tests
// ============================================================================

/// Test: valid token → interceptor returns Ok
#[cfg(feature = "security")]
#[test]
fn test_auth_interceptor_valid_token() {
    let secret = "ValidSecret123!ABCDEFGHIJKLMNOPQRSTUVWXYZ";
    let auth = crate::security::BearerAuth::try_new(secret).expect("valid secret");
    let mut interceptor = make_auth_interceptor(Some(auth));

    // Generate a token that expires in 1 year
    let exp = chrono::Utc::now().timestamp() + 365 * 24 * 3600;
    let valid_token = make_test_jwt(secret, exp);
    let auth_value: tonic::metadata::MetadataValue<tonic::metadata::Ascii> =
        tonic::metadata::MetadataValue::try_from(format!("Bearer {}", valid_token).as_str())
            .expect("valid metadata value");

    let mut req = tonic::Request::new(());
    req.metadata_mut().insert("authorization", auth_value);

    let result = interceptor.call(req);
    assert!(
        result.is_ok(),
        "Valid token should be accepted by interceptor"
    );
}

/// Test: missing authorization header → interceptor returns Err
#[cfg(feature = "security")]
#[test]
fn test_auth_interceptor_missing_auth_header() {
    let secret = "ValidSecret123!ABCDEFGHIJKLMNOPQRSTUVWXYZ";
    let auth = crate::security::BearerAuth::try_new(secret).expect("valid secret");
    let mut interceptor = make_auth_interceptor(Some(auth));

    // Request without any authorization header
    let req = tonic::Request::new(());
    let result = interceptor.call(req);

    assert!(result.is_err(), "Missing auth header should be rejected");
    let status = result.unwrap_err();
    assert_eq!(status.code(), tonic::Code::Unauthenticated);
    assert_eq!(
        status.message(),
        "Missing authorization header",
        "Error message should match expected text"
    );
}

/// Test: invalid token (bad signature) → interceptor returns Err
#[cfg(feature = "security")]
#[test]
fn test_auth_interceptor_invalid_token() {
    let secret = "ValidSecret123!ABCDEFGHIJKLMNOPQRSTUVWXYZ";
    let auth = crate::security::BearerAuth::try_new(secret).expect("valid secret");
    let mut interceptor = make_auth_interceptor(Some(auth));

    // Generate a token signed with a DIFFERENT secret
    let wrong_secret = "WrongSecret000!ABCDEFGHIJKLMNOPQRSTUVWXYZ";
    let exp = chrono::Utc::now().timestamp() + 365 * 24 * 3600;
    let invalid_token = make_test_jwt(wrong_secret, exp);
    let auth_value: tonic::metadata::MetadataValue<tonic::metadata::Ascii> =
        tonic::metadata::MetadataValue::try_from(format!("Bearer {}", invalid_token).as_str())
            .expect("valid metadata value");

    let mut req = tonic::Request::new(());
    req.metadata_mut().insert("authorization", auth_value);

    let result = interceptor.call(req);
    assert!(result.is_err(), "Invalid token should be rejected");
    let status = result.unwrap_err();
    assert_eq!(status.code(), tonic::Code::Unauthenticated);
    assert_eq!(
        status.message(),
        "Invalid or expired token",
        "Error message should match expected text"
    );
}

/// Test: expired token → interceptor returns Err
#[cfg(feature = "security")]
#[test]
fn test_auth_interceptor_expired_token() {
    let secret = "ValidSecret123!ABCDEFGHIJKLMNOPQRSTUVWXYZ";
    let auth = crate::security::BearerAuth::try_new(secret).expect("valid secret");
    let mut interceptor = make_auth_interceptor(Some(auth));

    // Generate a token that expired in 2000
    let expired_token = make_test_jwt(secret, 946684799); // 2000-01-01
    let auth_value: tonic::metadata::MetadataValue<tonic::metadata::Ascii> =
        tonic::metadata::MetadataValue::try_from(format!("Bearer {}", expired_token).as_str())
            .expect("valid metadata value");

    let mut req = tonic::Request::new(());
    req.metadata_mut().insert("authorization", auth_value);

    let result = interceptor.call(req);
    assert!(result.is_err(), "Expired token should be rejected");
    let status = result.unwrap_err();
    assert_eq!(status.code(), tonic::Code::Unauthenticated);
    assert_eq!(
        status.message(),
        "Invalid or expired token",
        "Error message should match expected text"
    );
}

/// Test: no auth configured → interceptor allows all requests (pass-through)
#[cfg(feature = "security")]
#[test]
fn test_auth_interceptor_no_auth_configured() {
    let mut interceptor = make_auth_interceptor(None);

    // Even with an authorization header, when no auth is configured, it should pass
    let req = tonic::Request::new(());
    let result = interceptor.call(req);
    assert!(
        result.is_ok(),
        "When no auth is configured, interceptor should pass through all requests"
    );
}

// ============================================================================
// Auth Interceptor Extended Tests
// ============================================================================

#[cfg(feature = "security")]
#[test]
fn test_auth_interceptor_with_malformed_bearer_prefix() {
    let secret = "ValidSecret123!ABCDEFGHIJKLMNOPQRSTUVWXYZ";
    let auth = crate::security::BearerAuth::try_new(secret).expect("valid secret");
    let mut interceptor = make_auth_interceptor(Some(auth));

    let auth_value: tonic::metadata::MetadataValue<tonic::metadata::Ascii> =
        tonic::metadata::MetadataValue::try_from("Bearerinvalid_token")
            .expect("valid metadata value");

    let mut req = tonic::Request::new(());
    req.metadata_mut().insert("authorization", auth_value);

    let result = interceptor.call(req);
    assert!(result.is_err());
}

#[cfg(feature = "security")]
#[test]
fn test_auth_interceptor_with_basic_auth_instead_of_bearer() {
    let secret = "ValidSecret123!ABCDEFGHIJKLMNOPQRSTUVWXYZ";
    let auth = crate::security::BearerAuth::try_new(secret).expect("valid secret");
    let mut interceptor = make_auth_interceptor(Some(auth));

    let auth_value: tonic::metadata::MetadataValue<tonic::metadata::Ascii> =
        tonic::metadata::MetadataValue::try_from("Basic dXNlcjpwYXNz")
            .expect("valid metadata value");

    let mut req = tonic::Request::new(());
    req.metadata_mut().insert("authorization", auth_value);

    let result = interceptor.call(req);
    assert!(result.is_err());
}

#[cfg(feature = "security")]
#[test]
fn test_auth_interceptor_with_empty_token() {
    let secret = "ValidSecret123!ABCDEFGHIJKLMNOPQRSTUVWXYZ";
    let auth = crate::security::BearerAuth::try_new(secret).expect("valid secret");
    let mut interceptor = make_auth_interceptor(Some(auth));

    let auth_value: tonic::metadata::MetadataValue<tonic::metadata::Ascii> =
        tonic::metadata::MetadataValue::try_from("Bearer ").expect("valid metadata value");

    let mut req = tonic::Request::new(());
    req.metadata_mut().insert("authorization", auth_value);

    let result = interceptor.call(req);
    assert!(result.is_err());
}

#[cfg(feature = "security")]
#[test]
fn test_auth_interceptor_metadata_key_lowercase_required() {
    let secret = "ValidSecret123!ABCDEFGHIJKLMNOPQRSTUVWXYZ";
    let auth = crate::security::BearerAuth::try_new(secret).expect("valid secret");
    let mut interceptor = make_auth_interceptor(Some(auth));

    let exp = chrono::Utc::now().timestamp() + 365 * 24 * 3600;
    let valid_token = make_test_jwt(secret, exp);

    let auth_value: tonic::metadata::MetadataValue<tonic::metadata::Ascii> =
        tonic::metadata::MetadataValue::try_from(format!("Bearer {}", valid_token).as_str())
            .expect("valid metadata value");

    let mut req = tonic::Request::new(());
    req.metadata_mut().insert("authorization", auth_value);

    let result = interceptor.call(req);
    assert!(result.is_ok(), "Lowercase 'authorization' key should work");
}