snapshot of https://github.com/ory/kratos.git (master, 2026-09-15; blobs > 131072B omitted)

persistence/sql/persister_hmac_test.go

@@ -0,0 +1,102 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package sql
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/ory/kratos/driver/config"
+	"github.com/ory/kratos/embedx"
+	"github.com/ory/kratos/identity"
+	"github.com/ory/kratos/schema"
+	"github.com/ory/pop/v6"
+	"github.com/ory/x/clock"
+	"github.com/ory/x/configx"
+	"github.com/ory/x/contextx"
+	"github.com/ory/x/dbal"
+	"github.com/ory/x/logrusx"
+	"github.com/ory/x/otelx"
+)
+
+type logRegistryOnly struct {
+	l *logrusx.Logger
+	c *config.Config
+}
+
+func (l *logRegistryOnly) Config() *config.Config {
+	return l.c
+}
+
+func (l *logRegistryOnly) Contextualizer() contextx.Contextualizer {
+	// TODO implement me
+	panic("implement me")
+}
+
+func (l *logRegistryOnly) Logger() *logrusx.Logger {
+	if l.l == nil {
+		l.l = logrusx.New("kratos", "testing")
+	}
+	return l.l
+}
+
+func (l *logRegistryOnly) Audit() *logrusx.Logger {
+	panic("implement me")
+}
+
+func (l *logRegistryOnly) Tracer(context.Context) *otelx.Tracer {
+	return otelx.NewNoop()
+}
+
+func (l *logRegistryOnly) Clock() clock.Clock {
+	return clock.New()
+}
+
+func (l *logRegistryOnly) IdentityTraitsSchemas(context.Context) (schema.IdentitySchemaList, error) {
+	panic("implement me")
+}
+
+func (l *logRegistryOnly) IdentityValidator() *identity.Validator {
+	panic("implement me")
+}
+
+var _ persisterDependencies = &logRegistryOnly{}
+
+func TestPersisterHMAC(t *testing.T) {
+	t.Parallel()
+
+	ctx := context.Background()
+	baseSecret := "foobarbaz"
+	baseSecretBytes := []byte(baseSecret)
+	opts := []configx.OptionModifier{configx.SkipValidation(), configx.WithValue(config.ViperKeySecretsDefault, []string{baseSecret})}
+	conf := config.MustNew(t, logrusx.New("", ""), contextx.NewTestConfigProvider(embedx.ConfigSchema, opts...), opts...)
+	c, err := pop.NewConnection(&pop.ConnectionDetails{URL: dbal.NewSQLiteTestDatabase(t)})
+	require.NoError(t, err)
+	p, err := NewPersister(&logRegistryOnly{c: conf}, c)
+	require.NoError(t, err)
+
+	t.Run("case=behaves deterministically", func(t *testing.T) {
+		assert.Equal(t, hmacValueWithSecret("hashme", baseSecretBytes), p.hmacValue(ctx, "hashme"))
+		assert.NotEqual(t, hmacValueWithSecret("notme", baseSecretBytes), p.hmacValue(ctx, "hashme"))
+		assert.NotEqual(t, hmacValueWithSecret("hashme", baseSecretBytes), p.hmacValue(ctx, "notme"))
+	})
+
+	hash := p.hmacValue(ctx, "hashme")
+	newSecret := "not" + baseSecret
+
+	t.Run("case=with only new sectet", func(t *testing.T) {
+		ctx = contextx.WithConfigValue(ctx, config.ViperKeySecretsDefault, []string{newSecret})
+		assert.NotEqual(t, hmacValueWithSecret("hashme", baseSecretBytes), p.hmacValue(ctx, "hashme"))
+		assert.Equal(t, hmacValueWithSecret("hashme", []byte(newSecret)), p.hmacValue(ctx, "hashme"))
+	})
+
+	t.Run("case=with new and old secret", func(t *testing.T) {
+		ctx = contextx.WithConfigValue(ctx, config.ViperKeySecretsDefault, []string{newSecret, baseSecret})
+		assert.Equal(t, hmacValueWithSecret("hashme", []byte(newSecret)), p.hmacValue(ctx, "hashme"))
+		assert.NotEqual(t, hash, p.hmacValue(ctx, "hashme"))
+	})
+}