git.squeep.com Git - akkoma/blob - test/pleroma/web/plugs/authentication_plug_test.exs

   1 # Pleroma: A lightweight social networking server
   2 # Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
   3 # SPDX-License-Identifier: AGPL-3.0-only
   4
   5 defmodule Pleroma.Web.Plugs.AuthenticationPlugTest do
   6   use Pleroma.Web.ConnCase, async: true
   7
   8   alias Pleroma.User
   9   alias Pleroma.Web.Plugs.AuthenticationPlug
  10   alias Pleroma.Web.Plugs.OAuthScopesPlug
  11   alias Pleroma.Web.Plugs.PlugHelper
  12
  13   import ExUnit.CaptureLog
  14   import Pleroma.Factory
  15
  16   setup %{conn: conn} do
  17     user = %User{
  18       id: 1,
  19       name: "dude",
  20       password_hash: Pleroma.Password.Pbkdf2.hash_pwd_salt("guy")
  21     }
  22
  23     conn =
  24       conn
  25       |> assign(:auth_user, user)
  26
  27     %{user: user, conn: conn}
  28   end
  29
  30   test "it does nothing if a user is assigned", %{conn: conn} do
  31     conn =
  32       conn
  33       |> assign(:user, %User{})
  34
  35     ret_conn =
  36       conn
  37       |> AuthenticationPlug.call(%{})
  38
  39     assert ret_conn == conn
  40   end
  41
  42   test "with a correct password in the credentials, " <>
  43          "it assigns the auth_user and marks OAuthScopesPlug as skipped",
  44        %{conn: conn} do
  45     conn =
  46       conn
  47       |> assign(:auth_credentials, %{password: "guy"})
  48       |> AuthenticationPlug.call(%{})
  49
  50     assert conn.assigns.user == conn.assigns.auth_user
  51     assert conn.assigns.token == nil
  52     assert PlugHelper.plug_skipped?(conn, OAuthScopesPlug)
  53   end
  54
  55   test "with a bcrypt hash, it updates to a pkbdf2 hash", %{conn: conn} do
  56     user = insert(:user, password_hash: Bcrypt.hash_pwd_salt("123"))
  57     assert "$2" <> _ = user.password_hash
  58
  59     conn =
  60       conn
  61       |> assign(:auth_user, user)
  62       |> assign(:auth_credentials, %{password: "123"})
  63       |> AuthenticationPlug.call(%{})
  64
  65     assert conn.assigns.user.id == conn.assigns.auth_user.id
  66     assert conn.assigns.token == nil
  67     assert PlugHelper.plug_skipped?(conn, OAuthScopesPlug)
  68
  69     user = User.get_by_id(user.id)
  70     assert "$pbkdf2" <> _ = user.password_hash
  71   end
  72
  73   @tag :skip_on_mac
  74   test "with a crypt hash, it updates to a pkbdf2 hash", %{conn: conn} do
  75     user =
  76       insert(:user,
  77         password_hash:
  78           "$6$9psBWV8gxkGOZWBz$PmfCycChoxeJ3GgGzwvhlgacb9mUoZ.KUXNCssekER4SJ7bOK53uXrHNb2e4i8yPFgSKyzaW9CcmrDXWIEMtD1"
  79       )
  80
  81     conn =
  82       conn
  83       |> assign(:auth_user, user)
  84       |> assign(:auth_credentials, %{password: "password"})
  85       |> AuthenticationPlug.call(%{})
  86
  87     assert conn.assigns.user.id == conn.assigns.auth_user.id
  88     assert conn.assigns.token == nil
  89     assert PlugHelper.plug_skipped?(conn, OAuthScopesPlug)
  90
  91     user = User.get_by_id(user.id)
  92     assert "$pbkdf2" <> _ = user.password_hash
  93   end
  94
  95   describe "checkpw/2" do
  96     test "check pbkdf2 hash" do
  97       hash =
  98         "$pbkdf2-sha512$160000$loXqbp8GYls43F0i6lEfIw$AY.Ep.2pGe57j2hAPY635sI/6w7l9Q9u9Bp02PkPmF3OrClDtJAI8bCiivPr53OKMF7ph6iHhN68Rom5nEfC2A"
  99
 100       assert AuthenticationPlug.checkpw("test-password", hash)
 101       refute AuthenticationPlug.checkpw("test-password1", hash)
 102     end
 103
 104     @tag :skip_on_mac
 105     test "check sha512-crypt hash" do
 106       hash =
 107         "$6$9psBWV8gxkGOZWBz$PmfCycChoxeJ3GgGzwvhlgacb9mUoZ.KUXNCssekER4SJ7bOK53uXrHNb2e4i8yPFgSKyzaW9CcmrDXWIEMtD1"
 108
 109       assert AuthenticationPlug.checkpw("password", hash)
 110     end
 111
 112     test "check bcrypt hash" do
 113       hash = "$2a$10$uyhC/R/zoE1ndwwCtMusK.TLVzkQ/Ugsbqp3uXI.CTTz0gBw.24jS"
 114
 115       assert AuthenticationPlug.checkpw("password", hash)
 116       refute AuthenticationPlug.checkpw("password1", hash)
 117     end
 118
 119     test "it returns false when hash invalid" do
 120       hash =
 121         "psBWV8gxkGOZWBz$PmfCycChoxeJ3GgGzwvhlgacb9mUoZ.KUXNCssekER4SJ7bOK53uXrHNb2e4i8yPFgSKyzaW9CcmrDXWIEMtD1"
 122
 123       assert capture_log(fn ->
 124                refute AuthenticationPlug.checkpw("password", hash)
 125              end) =~ "[error] Password hash not recognized"
 126     end
 127   end
 128 end