snapshot of https://github.com/seaweedfs/seaweedfs.git (master, 2026-09-16; blobs > 131072B omitted)

weed/iam/sts/session_claims_test.go

@@ -0,0 +1,285 @@
+package sts
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestSTSSessionClaimsToSessionInfo tests the ToSessionInfo conversion
+func TestSTSSessionClaimsToSessionInfo(t *testing.T) {
+	sessionId := "test-session-123"
+	issuer := "test-issuer"
+	expiresAt := time.Now().Add(time.Hour)
+
+	claims := NewSTSSessionClaims(sessionId, issuer, expiresAt).
+		WithSessionName("test-session-name").
+		WithRoleInfo(
+			"arn:aws:iam::123456789012:role/test-role",
+			"arn:aws:iam::123456789012:assumed-role/test-role/session",
+			"arn:aws:iam::123456789012:assumed-role/test-role/session",
+		).
+		WithIdentityProvider("oidc", "user-123", "https://issuer.example.com").
+		WithMaxDuration(time.Hour)
+
+	sessionInfo := claims.ToSessionInfo()
+
+	// Verify basic claims are converted
+	assert.Equal(t, sessionId, sessionInfo.SessionId)
+	assert.Equal(t, "test-session-name", sessionInfo.SessionName)
+	assert.Equal(t, "arn:aws:iam::123456789012:role/test-role", sessionInfo.RoleArn)
+	assert.Equal(t, "arn:aws:iam::123456789012:assumed-role/test-role/session", sessionInfo.AssumedRoleUser)
+	assert.Equal(t, "oidc", sessionInfo.IdentityProvider)
+	assert.Equal(t, "user-123", sessionInfo.ExternalUserId)
+
+	// Verify credentials are generated
+	assert.NotNil(t, sessionInfo.Credentials, "credentials should be populated")
+	assert.NotEmpty(t, sessionInfo.Credentials.AccessKeyId, "access key should be generated")
+	assert.NotEmpty(t, sessionInfo.Credentials.SecretAccessKey, "secret key should be generated")
+	// Credential expiration may have sub-second differences, so just check they're close
+	assert.True(t, sessionInfo.Credentials.Expiration.Sub(expiresAt) < time.Second, "credential expiration should match session expiration")
+
+	// Verify expiration is preserved (within 1 second tolerance for timing differences)
+	assert.WithinDuration(t, expiresAt, sessionInfo.ExpiresAt, 1*time.Second)
+}
+
+// TestSTSSessionClaimsToSessionInfoCredentialGeneration tests that credentials are deterministically generated for access key and session token
+func TestSTSSessionClaimsToSessionInfoCredentialGeneration(t *testing.T) {
+	sessionId := "deterministic-session-id"
+	issuer := "test-issuer"
+	expiresAt := time.Now().Add(time.Hour).Truncate(time.Second)
+
+	claims1 := NewSTSSessionClaims(sessionId, issuer, expiresAt)
+	sessionInfo1 := claims1.ToSessionInfo()
+
+	// Create another claims object with the same session ID and expiration
+	claims2 := NewSTSSessionClaims(sessionId, issuer, expiresAt)
+	sessionInfo2 := claims2.ToSessionInfo()
+
+	// Verify that both have valid credentials
+	assert.NotNil(t, sessionInfo1.Credentials, "credentials should be populated")
+	assert.NotNil(t, sessionInfo2.Credentials, "credentials should be populated")
+
+	// Verify deterministic generation: same SessionId should produce identical access key ID
+	// (based on hash of session ID, not random)
+	assert.Equal(t, sessionInfo1.Credentials.AccessKeyId, sessionInfo2.Credentials.AccessKeyId,
+		"same session ID should produce identical access key ID (deterministic hash-based generation)")
+
+	// Session token is also deterministic (hash-based on session ID)
+	assert.Equal(t, sessionInfo1.Credentials.SessionToken, sessionInfo2.Credentials.SessionToken,
+		"same session ID should produce identical session token (deterministic hash-based generation)")
+
+	// Secret access key is NOW deterministic (hash-based on session ID, not random!)
+	// This is critical for signature verification: the same session ID must regenerate
+	// the same secret key so that signature verification succeeds.
+	assert.Equal(t, sessionInfo1.Credentials.SecretAccessKey, sessionInfo2.Credentials.SecretAccessKey,
+		"same session ID should produce identical secret access key (deterministic hash-based generation)")
+
+	// Expiration should match
+	assert.WithinDuration(t, sessionInfo1.Credentials.Expiration, sessionInfo2.Credentials.Expiration, 1*time.Second,
+		"credentials expiration should match")
+}
+
+// TestSTSSessionClaimsToSessionInfoPreservesAllFields tests that all fields are preserved
+func TestSTSSessionClaimsToSessionInfoPreservesAllFields(t *testing.T) {
+	sessionId := "test-session-id"
+	issuer := "test-issuer"
+	expiresAt := time.Now().Add(2 * time.Hour)
+
+	policies := []string{"policy1", "policy2"}
+	sessionPolicy := `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["s3:GetObject"],"Resource":["arn:aws:s3:::bucket/*"]}]}`
+	requestContext := map[string]interface{}{
+		"sourceIp":  "192.168.1.1",
+		"userAgent": "test-agent",
+	}
+
+	claims := NewSTSSessionClaims(sessionId, issuer, expiresAt).
+		WithSessionName("session-name").
+		WithRoleInfo("role-arn", "assumed-role", "principal").
+		WithIdentityProvider("provider", "external-id", "issuer").
+		WithPolicies(policies).
+		WithSessionPolicy(sessionPolicy).
+		WithRequestContext(requestContext).
+		WithMaxDuration(2 * time.Hour)
+
+	sessionInfo := claims.ToSessionInfo()
+
+	// Verify all fields are preserved
+	assert.Equal(t, sessionId, sessionInfo.SessionId)
+	assert.Equal(t, "session-name", sessionInfo.SessionName)
+	assert.Equal(t, "role-arn", sessionInfo.RoleArn)
+	assert.Equal(t, "assumed-role", sessionInfo.AssumedRoleUser)
+	assert.Equal(t, "principal", sessionInfo.Principal)
+	assert.Equal(t, "provider", sessionInfo.IdentityProvider)
+	assert.Equal(t, "external-id", sessionInfo.ExternalUserId)
+	assert.Equal(t, "issuer", sessionInfo.ProviderIssuer)
+	assert.Equal(t, policies, sessionInfo.Policies)
+	assert.Equal(t, sessionPolicy, sessionInfo.SessionPolicy)
+	assert.Equal(t, requestContext, sessionInfo.RequestContext)
+	assert.WithinDuration(t, expiresAt, sessionInfo.ExpiresAt, 1*time.Second)
+}
+
+// TestSTSSessionClaimsToSessionInfoEmptyFields tests handling of empty/nil fields
+func TestSTSSessionClaimsToSessionInfoEmptyFields(t *testing.T) {
+	sessionId := "minimal-session"
+	issuer := "issuer"
+	expiresAt := time.Now().Add(time.Hour)
+
+	// Create claims with minimal fields
+	claims := NewSTSSessionClaims(sessionId, issuer, expiresAt)
+
+	sessionInfo := claims.ToSessionInfo()
+
+	// Verify basic fields are preserved
+	assert.Equal(t, sessionId, sessionInfo.SessionId)
+	assert.Empty(t, sessionInfo.SessionName)
+	assert.Empty(t, sessionInfo.RoleArn)
+
+	// Verify credentials are still generated even with minimal fields
+	assert.NotNil(t, sessionInfo.Credentials)
+	assert.NotEmpty(t, sessionInfo.Credentials.AccessKeyId)
+	assert.NotEmpty(t, sessionInfo.Credentials.SecretAccessKey)
+}
+
+// TestSTSSessionClaimsToSessionInfoCredentialExpiration tests credential expiration
+func TestSTSSessionClaimsToSessionInfoCredentialExpiration(t *testing.T) {
+	sessionId := "test-session"
+	issuer := "issuer"
+
+	tests := []struct {
+		name             string
+		expiresAt        time.Time
+		expectNotExpired bool
+		description      string
+	}{
+		{
+			name:             "future_expiration",
+			expiresAt:        time.Now().Add(time.Hour),
+			expectNotExpired: true,
+			description:      "Credentials should not be expired if ExpiresAt is in the future",
+		},
+		{
+			name:             "past_expiration",
+			expiresAt:        time.Now().Add(-time.Hour),
+			expectNotExpired: false,
+			description:      "Credentials should be expired if ExpiresAt is in the past",
+		},
+		{
+			name:             "near_future_expiration",
+			expiresAt:        time.Now().Add(time.Minute),
+			expectNotExpired: true,
+			description:      "Credentials should not be expired even if close to expiration",
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			claims := NewSTSSessionClaims(sessionId, issuer, tc.expiresAt)
+			sessionInfo := claims.ToSessionInfo()
+
+			assert.NotNil(t, sessionInfo.Credentials)
+			// Check expiration within 1 second due to timing precision (symmetric tolerance)
+			assert.WithinDuration(t, tc.expiresAt, sessionInfo.Credentials.Expiration, time.Second,
+				"credential expiration should be within 1 second of session expiration")
+			// We set tc.expiresAt to past/future values to exercise expiration handling.
+			// Assert the credentials' expiration relative to now to exercise code behavior
+			if tc.expectNotExpired {
+				assert.True(t, time.Now().Before(sessionInfo.Credentials.Expiration), tc.description)
+			} else {
+				assert.True(t, time.Now().After(sessionInfo.Credentials.Expiration), tc.description)
+			}
+		})
+	}
+}
+
+// TestSessionInfoIntegration tests the full integration of session info flow
+func TestSessionInfoIntegration(t *testing.T) {
+	// Create a session claim
+	sessionId, err := GenerateSessionId()
+	require.NoError(t, err)
+
+	expiresAt := time.Now().Add(time.Hour)
+	claims := NewSTSSessionClaims(sessionId, "test-issuer", expiresAt).
+		WithSessionName("integration-test").
+		WithRoleInfo(
+			"arn:aws:iam::123456789012:role/integration",
+			"arn:aws:iam::123456789012:assumed-role/integration/test",
+			"arn:aws:iam::123456789012:assumed-role/integration/test",
+		).
+		WithIdentityProvider("test-provider", "user-id", "https://test.example.com")
+
+	// Convert to SessionInfo
+	sessionInfo := claims.ToSessionInfo()
+
+	// Verify the session info has valid credentials
+	assert.NotNil(t, sessionInfo.Credentials)
+	assert.NotEmpty(t, sessionInfo.Credentials.AccessKeyId)
+	assert.NotEmpty(t, sessionInfo.Credentials.SecretAccessKey)
+
+	// Verify basic session properties
+	assert.Equal(t, sessionId, sessionInfo.SessionId)
+	assert.Equal(t, "integration-test", sessionInfo.SessionName)
+	assert.False(t, sessionInfo.ExpiresAt.IsZero())
+
+	// Verify that the session is valid
+	assert.True(t, sessionInfo.ExpiresAt.After(time.Now()), "session should not be expired")
+	assert.False(t, sessionInfo.Credentials.Expiration.Before(time.Now()), "credentials should not be expired")
+}
+
+// TestSecretAccessKeyDeterminism verifies that secret access keys are deterministically
+// generated from the session ID. This is CRITICAL for STS signature verification:
+// The client generates a secret key and signs the request. When the server receives
+// the request, it must regenerate the exact same secret key from the JWT claims
+// to verify the signature. If the secret key is random, verification will always fail.
+func TestSecretAccessKeyDeterminism(t *testing.T) {
+	sessionId := "critical-determinism-test"
+	expiration := time.Now().Add(time.Hour)
+
+	// Generate credentials multiple times with the same session ID
+	credGen := NewCredentialGenerator()
+
+	cred1, err := credGen.GenerateTemporaryCredentials(sessionId, expiration)
+	assert.NoError(t, err)
+	assert.NotNil(t, cred1)
+
+	cred2, err := credGen.GenerateTemporaryCredentials(sessionId, expiration)
+	assert.NoError(t, err)
+	assert.NotNil(t, cred2)
+
+	cred3, err := credGen.GenerateTemporaryCredentials(sessionId, expiration)
+	assert.NoError(t, err)
+	assert.NotNil(t, cred3)
+
+	// All three should have IDENTICAL secret access keys
+	assert.Equal(t, cred1.SecretAccessKey, cred2.SecretAccessKey,
+		"same sessionId must produce identical secret key on first and second call")
+	assert.Equal(t, cred2.SecretAccessKey, cred3.SecretAccessKey,
+		"same sessionId must produce identical secret key on second and third call")
+
+	// All three should have IDENTICAL access key IDs
+	assert.Equal(t, cred1.AccessKeyId, cred2.AccessKeyId,
+		"same sessionId must produce identical access key ID")
+	assert.Equal(t, cred2.AccessKeyId, cred3.AccessKeyId,
+		"same sessionId must produce identical access key ID")
+
+	// All three should have IDENTICAL session tokens
+	assert.Equal(t, cred1.SessionToken, cred2.SessionToken,
+		"same sessionId must produce identical session token")
+	assert.Equal(t, cred2.SessionToken, cred3.SessionToken,
+		"same sessionId must produce identical session token")
+
+	// Different session IDs should produce different secrets
+	otherSessionId := "different-session"
+	credOther, err := credGen.GenerateTemporaryCredentials(otherSessionId, expiration)
+	assert.NoError(t, err)
+	assert.NotNil(t, credOther)
+
+	assert.NotEqual(t, cred1.SecretAccessKey, credOther.SecretAccessKey,
+		"different session IDs must produce different secret keys")
+	assert.NotEqual(t, cred1.AccessKeyId, credOther.AccessKeyId,
+		"different session IDs must produce different access key IDs")
+	assert.NotEqual(t, cred1.SessionToken, credOther.SessionToken,
+		"different session IDs must produce different session tokens")
+}