32 lines
809 B
Go
32 lines
809 B
Go
package auth
|
|
|
|
import (
|
|
"crypto/sha256"
|
|
"encoding/hex"
|
|
"testing"
|
|
)
|
|
|
|
func TestPasswordHashUsesBcryptAndVerifies(t *testing.T) {
|
|
hash := PasswordHash("correct horse battery staple")
|
|
if len(hash) < 4 || (hash[0:4] != "$2a$" && hash[0:4] != "$2b$") {
|
|
t.Fatalf("hash=%q is not bcrypt", hash)
|
|
}
|
|
if !VerifyPasswordHash(hash, "correct horse battery staple") {
|
|
t.Fatal("bcrypt password did not verify")
|
|
}
|
|
if VerifyPasswordHash(hash, "wrong") {
|
|
t.Fatal("wrong password verified")
|
|
}
|
|
}
|
|
|
|
func TestLegacySHA256PasswordStillVerifies(t *testing.T) {
|
|
sum := sha256.Sum256([]byte("legacy-pass"))
|
|
hash := hex.EncodeToString(sum[:])
|
|
if !VerifyPasswordHash(hash, "legacy-pass") {
|
|
t.Fatal("legacy hash did not verify")
|
|
}
|
|
if VerifyPasswordHash(hash, "wrong") {
|
|
t.Fatal("wrong legacy password verified")
|
|
}
|
|
}
|