Initial commit

Assisted-by: GLM 5.3

internal/totp/totp_test.go

@@ -0,0 +1,99 @@
+// Copyright (c) 2026 Petr Balvín <opensource@petrbalvin.org> (https://petrbalvin.org)
+// SPDX-License-Identifier: PolyForm-Noncommercial-1.0.0
+
+package totp
+
+import (
+	"testing"
+	"time"
+)
+
+// rfcSecret is the RFC 6238 appendix B seed for SHA-1.
+var rfcSecret = []byte("12345678901234567890")
+
+func at(unix int64) time.Time { return time.Unix(unix, 0).UTC() }
+
+// TestRFCVectors checks the truncation against the appendix B table,
+// reduced to the six digits the URI format promises.
+func TestRFCVectors(t *testing.T) {
+	vectors := []struct {
+		unix int64
+		code string
+	}{
+		{59, "287082"},
+		{1111111109, "081804"},
+		{1111111111, "050471"},
+		{1234567890, "005924"},
+		{2000000000, "279037"},
+		{20000000000, "353130"},
+	}
+	for _, v := range vectors {
+		if got := Code(rfcSecret, at(v.unix)); got != v.code {
+			t.Fatalf("Code(%d) = %q, want %q", v.unix, got, v.code)
+		}
+	}
+}
+
+func TestValidateAcceptsWindow(t *testing.T) {
+	codeTime := at(1_000_000_000)
+	code := Code(rfcSecret, codeTime)
+	for _, drift := range []time.Duration{-Step, 0, Step} {
+		ok, step := Validate(rfcSecret, code, codeTime.Add(drift), 0)
+		if !ok {
+			t.Fatalf("drift %v rejected", drift)
+		}
+		if step != counter(codeTime) {
+			t.Fatalf("drift %v: step = %d, want the code's counter %d",
+				drift, step, counter(codeTime))
+		}
+	}
+}
+
+func TestValidateRefusesOutsideWindow(t *testing.T) {
+	code := Code(rfcSecret, at(1_000_000_000))
+	if ok, _ := Validate(rfcSecret, code, at(1_000_000_000).Add(2*Step), 0); ok {
+		t.Fatal("two steps ahead accepted")
+	}
+	if ok, _ := Validate(rfcSecret, code, at(1_000_000_000).Add(-2*Step), 0); ok {
+		t.Fatal("two steps behind accepted")
+	}
+}
+
+func TestValidateGuardsReplay(t *testing.T) {
+	now := at(1_000_000_000)
+	code := Code(rfcSecret, now)
+	ok, step := Validate(rfcSecret, code, now, 0)
+	if !ok || step == 0 {
+		t.Fatalf("first use failed: ok=%v step=%d", ok, step)
+	}
+	if ok, _ := Validate(rfcSecret, code, now, step); ok {
+		t.Fatal("same counter accepted twice")
+	}
+	if ok, _ := Validate(rfcSecret, code, now.Add(Step), step); ok {
+		t.Fatal("older drifting code accepted after a newer one")
+	}
+	// The next step's code stays valid: the floor is the counter, not
+	// a blanket cooldown.
+	next := Code(rfcSecret, now.Add(2*Step))
+	if ok, newer := Validate(rfcSecret, next, now.Add(2*Step), step); !ok || newer <= step {
+		t.Fatalf("fresh code refused: ok=%v step=%d", ok, newer)
+	}
+}
+
+func TestNormalise(t *testing.T) {
+	for in, want := range map[string]string{
+		"123456":    "123456",
+		" 123 456 ": "123456",
+		"123-456":   "123456",
+		"004203":    "004203",
+	} {
+		if got := normalise(in); got != want {
+			t.Fatalf("normalise(%q) = %q, want %q", in, got, want)
+		}
+	}
+	for _, in := range []string{"", "12345", "1234567", "12345a", "12 34 56 78", "12345\n"} {
+		if got := normalise(in); got != "" {
+			t.Fatalf("normalise(%q) = %q, want empty", in, got)
+		}
+	}
+}