feat: add private r2 bucket

pkg/realtime/auth_test.go

@@ -0,0 +1,93 @@
+package realtime
+
+import (
+	"errors"
+	"strings"
+	"testing"
+
+	"go.uber.org/zap"
+)
+
+// testClient builds a client with fixed credentials so signatures are
+// reproducible.
+func testClient(t *testing.T) *SoketiClient {
+	t.Helper()
+	c := NewSoketiClient("app-1", "test-key", "test-secret", "ws.example.com", 443, true, zap.NewNop())
+	if c == nil {
+		t.Fatal("NewSoketiClient returned nil for a fully configured client")
+	}
+	return c
+}
+
+// The expected signatures are HMAC-SHA256 vectors computed independently of
+// this package. Recomputing them with the same code under test would only
+// prove the code equals itself; a fixed vector catches a change to the
+// string-to-sign format, which is what Soketi actually verifies against.
+func TestAuthorizeChannel_MatchesKnownVector(t *testing.T) {
+	auth, err := testClient(t).AuthorizeChannel("1234.5678", "private-notifications.user-a")
+	if err != nil {
+		t.Fatalf("AuthorizeChannel: %v", err)
+	}
+	const want = "test-key:9c436d58a9d030f68b35d636bb3e930c471d5c11edec6745c969e4eee1c3e3df"
+	if auth != want {
+		t.Errorf("auth = %q, want %q", auth, want)
+	}
+}
+
+func TestAuthorizePresence_MatchesKnownVector(t *testing.T) {
+	auth, channelData, err := testClient(t).AuthorizePresence(
+		"1234.5678", "presence-conversation.c1", PresenceData{UserID: "user-a"})
+	if err != nil {
+		t.Fatalf("AuthorizePresence: %v", err)
+	}
+	if channelData != `{"user_id":"user-a"}` {
+		t.Errorf("channel_data = %q", channelData)
+	}
+	const want = "test-key:cf5a222b506d46383cb4edac7707ba620e4ba2bbb83f64d1cf6463b4241efd24"
+	if auth != want {
+		t.Errorf("auth = %q, want %q", auth, want)
+	}
+}
+
+// Presence signing folds channel_data into the signed string; routing a
+// presence channel through AuthorizeChannel would produce a signature Soketi
+// rejects, so it's refused outright rather than silently mis-signed.
+func TestAuthorizeChannel_RejectsPresenceChannel(t *testing.T) {
+	if _, err := testClient(t).AuthorizeChannel("1234.5678", "presence-conversation.c1"); err == nil {
+		t.Fatal("expected an error for a presence channel")
+	}
+}
+
+func TestAuthorize_NilClientReportsNotConfigured(t *testing.T) {
+	var c *SoketiClient
+	if _, err := c.AuthorizeChannel("1234.5678", "private-x"); !errors.Is(err, ErrNotConfigured) {
+		t.Errorf("AuthorizeChannel err = %v, want ErrNotConfigured", err)
+	}
+	if _, _, err := c.AuthorizePresence("1234.5678", "presence-x", PresenceData{UserID: "u"}); !errors.Is(err, ErrNotConfigured) {
+		t.Errorf("AuthorizePresence err = %v, want ErrNotConfigured", err)
+	}
+}
+
+func TestAuthorize_RequiresArguments(t *testing.T) {
+	c := testClient(t)
+	if _, err := c.AuthorizeChannel("", "private-x"); err == nil {
+		t.Error("expected an error for an empty socket_id")
+	}
+	if _, err := c.AuthorizeChannel("1234.5678", ""); err == nil {
+		t.Error("expected an error for an empty channel")
+	}
+	if _, _, err := c.AuthorizePresence("1234.5678", "presence-x", PresenceData{}); err == nil {
+		t.Error("expected an error for presence data with no user_id")
+	}
+}
+
+func TestUserChannels(t *testing.T) {
+	if got := UserChannel("u1"); got != "private-notifications.u1" {
+		t.Errorf("UserChannel = %q", got)
+	}
+	// The legacy name must stay public-prefixed: it exists so already-cached
+	// clients keep receiving events during the migration.
+	if got := LegacyUserChannel("u1"); got != "notifications.u1" || strings.HasPrefix(got, "private-") {
+		t.Errorf("LegacyUserChannel = %q", got)
+	}
+}