Add tests for SetExpiresAfter functionality

Test that expiresAfter correctly computes expires as created + delay,
that setting both SetExpires and SetExpiresAfter returns an error,
and that the handler rejects expired signatures using SetExpiresAfter.

Author: krichprollsch

handler_test.go

@@ -59,13 +59,15 @@ func Test_WrapHandler(t *testing.T) {
 
 // test various failures
 func TestWrapHandlerServerSigns(t *testing.T) {
-	serverSignsTestCase := func(t *testing.T, nilSigner, dontSignResponse, earlyExpires, noSigner, badKey, badAlgs, verifyRequest bool) {
+	serverSignsTestCase := func(t *testing.T, nilSigner, dontSignResponse, earlyExpires, earlyExpiresAfter, noSigner, badKey, badAlgs, verifyRequest bool) {
 		// Callback to let the server locate its signing key and configuration
 		var signConfig *SignConfig
-		if !earlyExpires {
-			signConfig = NewSignConfig()
-		} else {
+		if earlyExpires {
 			signConfig = NewSignConfig().SetExpires(2000)
+		} else if earlyExpiresAfter {
+			signConfig = NewSignConfig().SetExpiresAfter(1).setFakeCreated(1000)
+		} else {
+			signConfig = NewSignConfig()
 		}
 		fetchSigner := func(res http.Response, r *http.Request) (string, *Signer) {
 			sigName := "sig1"
@@ -128,29 +130,33 @@ func TestWrapHandlerServerSigns(t *testing.T) {
 		}
 	}
 	nilSigner := func(t *testing.T) {
-		serverSignsTestCase(t, true, false, false, false, false, false, false)
+		serverSignsTestCase(t, true, false, false, false, false, false, false, false)
 	}
 	dontSignResponse := func(t *testing.T) {
-		serverSignsTestCase(t, false, true, false, false, false, false, false)
+		serverSignsTestCase(t, false, true, false, false, false, false, false, false)
 	}
 	earlyExpires := func(t *testing.T) {
-		serverSignsTestCase(t, false, false, true, false, false, false, false)
+		serverSignsTestCase(t, false, false, true, false, false, false, false, false)
+	}
+	earlyExpiresAfter := func(t *testing.T) {
+		serverSignsTestCase(t, false, false, false, true, false, false, false, false)
 	}
 	noSigner := func(t *testing.T) {
-		serverSignsTestCase(t, false, false, false, true, false, false, false)
+		serverSignsTestCase(t, false, false, false, false, true, false, false, false)
 	}
 	badKey := func(t *testing.T) {
-		serverSignsTestCase(t, false, false, false, false, true, false, false)
+		serverSignsTestCase(t, false, false, false, false, false, true, false, false)
 	}
 	badAlgs := func(t *testing.T) {
-		serverSignsTestCase(t, false, false, false, false, false, true, false)
+		serverSignsTestCase(t, false, false, false, false, false, false, true, false)
 	}
 	failVerify := func(t *testing.T) {
-		serverSignsTestCase(t, false, false, false, false, false, false, true)
+		serverSignsTestCase(t, false, false, false, false, false, false, false, true)
 	}
 	t.Run("nil Signer", nilSigner)
 	t.Run("don't sign response", dontSignResponse)
 	t.Run("early expires field", earlyExpires)
+	t.Run("early expires after field", earlyExpiresAfter)
 	t.Run("bad fetch Signer", noSigner)
 	t.Run("wrong verification key", badKey)
 	t.Run("failed algorithm check", badAlgs)

signatures_test.go

@@ -981,6 +981,36 @@ func TestMessageSignAndVerifyResponseHMAC(t *testing.T) {
 	}
 }
 
+func TestExpiresAfterCalculation(t *testing.T) {
+	fields := Headers("@status", "date", "content-type")
+	signatureName := "sigres"
+	key, _ := base64.StdEncoding.DecodeString("uzvJfB4u3N0Jy4T7NZ75MDVcr8zSTInedJtkgcu46YW4XByzNJjxBdtjUkdJPBtbmHhIDi6pcl8jsasjlTMtDQ==")
+	config := NewSignConfig().SetExpiresAfter(60).setFakeCreated(1000).SetKeyID("test-shared-secret")
+	signer, _ := NewHMACSHA256Signer(key, config, fields)
+	res := readResponse(httpres2)
+	sigInput, _, err := SignResponse(signatureName, *signer, res, nil)
+	if err != nil {
+		t.Fatalf("SignResponse failed: %s", err)
+	}
+	// expires should be fakeCreated + expiresAfter = 1000 + 60 = 1060
+	if !strings.Contains(sigInput, "expires=1060") {
+		t.Errorf("expected expires=1060 in signature input, got: %s", sigInput)
+	}
+}
+
+func TestExpiresAndExpiresAfterConflict(t *testing.T) {
+	fields := Headers("@status", "date", "content-type")
+	signatureName := "sigres"
+	key, _ := base64.StdEncoding.DecodeString("uzvJfB4u3N0Jy4T7NZ75MDVcr8zSTInedJtkgcu46YW4XByzNJjxBdtjUkdJPBtbmHhIDi6pcl8jsasjlTMtDQ==")
+	config := NewSignConfig().SetExpires(2000).SetExpiresAfter(60).SetKeyID("test-shared-secret")
+	signer, _ := NewHMACSHA256Signer(key, config, fields)
+	res := readResponse(httpres2)
+	_, _, err := SignResponse(signatureName, *signer, res, nil)
+	if err == nil {
+		t.Errorf("expected error when both SetExpires and SetExpiresAfter are set")
+	}
+}
+
 func TestSignAndVerifyRSAPSS(t *testing.T) {
 	config := NewSignConfig().SignAlg(false).setFakeCreated(1618884475).SetKeyID("test-key-rsa-pss")
 	fields := Headers("@authority", "date", "content-type")