totp_test.go

package otpgo

import (
	"encoding/json"
	"testing"
	"time"

	"github.com/jltorresm/otpgo/config"
)

func TestTOTP_Generate(t *testing.T) {
	t.Run("Normal Generation", testTOTPNormalGeneration)
	t.Run("Bad Key", testTOTPBadKey)
	t.Run("Default Params", testTOTPDefaultParams)
	t.Run("Autogenerated Key", testTOTPAutogeneratedKey)
	t.Run("Lower Case Key", testTOTPLowerCaseKey)
}

func testTOTPNormalGeneration(t *testing.T) {
	key := "73QK7D3A3PIZ6NUQQBF4BNFYQBRVUHUQ"

	totp := &TOTP{
		Key:       key,
		Period:    TOTPDefaultPeriod,
		Algorithm: config.HmacSHA256,
		Length:    config.Length6,
	}

	expectedOTP, err := getExpectedTOTP(key, totp.getCounter(time.Now().Unix()), config.Length6, config.HmacSHA256)
	if err != nil {
		t.Errorf("unexpected error: %s", err)
		t.FailNow()
	}

	actualOTP, err := totp.Generate()
	if err != nil {
		t.Errorf("unexpected error: %s", err)
	}

	if actualOTP != expectedOTP {
		t.Errorf("wrong totp\nexpected: %s\n  actual: %s", expectedOTP, actualOTP)
	}
}

func testTOTPBadKey(t *testing.T) {
	totp := &TOTP{
		Key:       "invalid-base-32",
		Period:    TOTPDefaultPeriod,
		Algorithm: config.HmacSHA256,
		Length:    config.Length6,
	}

	_, err := totp.Generate()
	expectedErr := ErrorInvalidKey{msg: "illegal base32 data at input byte 7"}
	if err != expectedErr {
		t.Errorf("unexpected error: %s", err)
	}
}

func testTOTPDefaultParams(t *testing.T) {
	key := "73QK7D3A3PIZ6NUQQBF4BNFYQBRVUHUQ"
	expectedPeriod := TOTPDefaultPeriod
	expectedDelay := TOTPDefaultDelay
	expectedAlg := config.HmacSHA1
	expectedLength := config.Length6

	totp := &TOTP{Key: key}

	otp, err := totp.Generate()
	if err != nil {
		t.Errorf("unexpected error: %s", err)
	}

	if totp.Period != expectedPeriod {
		t.Errorf("unexpected period\nexpected: %d\n  actual: %d", expectedPeriod, totp.Period)
	}

	if totp.Delay != expectedDelay {
		t.Errorf("unexpected delay\nexpected: %d\n  actual: %d", expectedDelay, totp.Delay)
	}

	if totp.Algorithm != expectedAlg {
		t.Errorf("unexpected hash algorithm\nexpected: %d (SHA1)\n  actual: %d", expectedAlg, totp.Algorithm)
	}

	if totp.Length != expectedLength {
		t.Errorf("unexpected length\nexpected: %d\n  actual: %d", expectedLength, totp.Length)
	}

	// Make sure to generate the counter after the defaults have been loaded
	counter := totp.getCounter(time.Now().Unix())

	expectedOTP, err := getExpectedTOTP(key, counter, expectedLength, expectedAlg)
	if err != nil {
		t.Errorf("unexpected error: %s", err)
		t.FailNow()
	}

	if otp != expectedOTP {
		t.Errorf("unexpected totp\nexpected: %s\n  actual: %s", expectedOTP, otp)
	}
}

func testTOTPAutogeneratedKey(t *testing.T) {
	totp := &TOTP{}

	_, err := totp.Generate()

	if err != nil {
		t.Errorf("unexpected error: %s", err)
	}

	if totp.Key == "" {
		t.Error("expected Key to be populated")
	}
}

func testTOTPLowerCaseKey(t *testing.T) {
	totp := &TOTP{Key: "73qk7d3a3piz6nuqqbf4bnfyqbrvuhuq"}

	_, err := totp.Generate()

	if err != nil {
		t.Errorf("unexpected error: %s", err)
	}

	if totp.Key == "" {
		t.Error("expected Key to be populated")
	}
}

func TestTOTP_Validate(t *testing.T) {
	t.Run("Success", testTOTPValidateSuccess)
	t.Run("Failure", testTOTPValidateFailure)
	t.Run("Delayed Validation", testTOTPValidateDelayed)
	t.Run("Missing Key", testTOTPValidateMissingKey)
}

func testTOTPValidateSuccess(t *testing.T) {
	t.Parallel()

	totp := &TOTP{
		Key:       "73QK7D3A3PIZ6NUQQBF4BNFYQBRVUHUQ",
		Period:    TOTPDefaultPeriod,
		Delay:     TOTPDefaultDelay,
		Algorithm: config.HmacSHA512,
		Length:    config.Length8,
	}

	expectedOTP, err := getExpectedTOTP(totp.Key, totp.getCounter(time.Now().Unix()), totp.Length, totp.Algorithm)
	if err != nil {
		t.Errorf("unexpected error: %s", err)
		t.FailNow()
	}

	isValid, err := totp.Validate(expectedOTP)
	if err != nil {
		t.Errorf("unexpected error: %s", err)
	}

	if !isValid {
		t.Errorf("invalid token\nexpected %s to be valid", expectedOTP)
	}
}

func testTOTPValidateFailure(t *testing.T) {
	t.Parallel()

	invalidOTP := "111111"

	totp := &TOTP{Key: "73QK7D3A3PIZ6NUQQBF4BNFYQBRVUHUQ", Length: config.Length8}

	isValid, err := totp.Validate(invalidOTP)
	if err != nil {
		t.Errorf("unexpected error: %s", err)
	}

	if isValid {
		t.Errorf("unexpected valid token\nexpected %s to be invalid", invalidOTP)
	}
}

func testTOTPValidateDelayed(t *testing.T) {
	t.Parallel()

	totp := &TOTP{
		Key:       "73QK7D3A3PIZ6NUQQBF4BNFYQBRVUHUQ",
		Period:    10,
		Delay:     2,
		Algorithm: config.HmacSHA256,
		Length:    config.Length7,
	}

	cases := []struct {
		label         string
		modifier      int
		shouldBeValid bool
	}{
		{"On Time", 0, true},
		{"One Step Delay", -1, true},
		{"One Step Forward", 1, true},
		{"Two Step Delay", -2, true},
		{"Two Step Forward", +2, true},
		{"Three Step Delay", -3, false},
		{"Three Step Forward", 3, false},
	}

	for _, c := range cases {
		t.Run(c.label, func(t *testing.T) {
			counter := totp.getCounter(time.Now().Unix() + int64(totp.Period*c.modifier))
			expectedOTP, err := getExpectedTOTP(totp.Key, counter, totp.Length, totp.Algorithm)
			if err != nil {
				t.Errorf("unexpected error: %s", err)
				t.FailNow()
			}

			isValid, err := totp.Validate(expectedOTP)
			if err != nil {
				t.Errorf("unexpected error: %s", err)
			}

			if isValid != c.shouldBeValid {
				t.Errorf("unexpected result from Validate()\nexpected %s to be valid", c.label)
			}
		})
	}
}

func testTOTPValidateMissingKey(t *testing.T) {
	totp := &TOTP{}

	isValid, err := totp.Validate("irrelevant")
	if err == nil {
		t.Error("expected error")
		t.FailNow()
	}

	if err.Error() != "missing secret key for validation" {
		t.Errorf("unexpected error: %s", err)
	}

	if isValid {
		t.Errorf("token should be invalid")
	}
}

func TestTOTP_KeyUri(t *testing.T) {
	totp := TOTP{Key: "JOC773H4BTUR5U6M422M2AT7S4MTQ7BLR75Y252JK3A"}
	_, _ = totp.Generate()

	accountName := "jòhn.doe@example.com"
	issuer := "Acme Inc"
	expectedUri := "otpauth://totp/Acme%20Inc:j%C3%B2hn.doe@example.com?algorithm=SHA1&digits=6&issuer=Acme+Inc&period=30&secret=JOC773H4BTUR5U6M422M2AT7S4MTQ7BLR75Y252JK3A"

	uri := totp.KeyUri(accountName, issuer)

	if expectedUri != uri.String() {
		t.Errorf("unexpected key URI\nexpected: %s\n  actual: %s", expectedUri, uri.String())
	}
}

func TestTOTPJson(t *testing.T) {
	h := TOTP{
		Key:       "73QK7D3A3PIZ6NUQQBF4BNFYQBRVUHUQ",
		Period:    30,
		Delay:     1,
		Algorithm: config.HmacSHA256,
		Length:    config.Length7,
	}

	expectedJson := `{"key":"73QK7D3A3PIZ6NUQQBF4BNFYQBRVUHUQ","period":30,"delay":1,"algorithm":"SHA256","length":7}`

	j, err := json.Marshal(h)
	if err != nil {
		t.Errorf("unexpected error: %s", err)
		t.FailNow()
	}

	if expectedJson != string(j) {
		t.Errorf("unexpected json:\nexpected: %s\n  actual: %s", expectedJson, j)
	}
}

func getExpectedTOTP(key string, counter uint64, length config.Length, algorithm config.HmacAlgorithm) (string, error) {
	expectedOTP, err := generateOTP(key, counter, length, algorithm)
	if err != nil {
		return "", err
	}

	return expectedOTP, nil
}