Function TestReplayProtection

internal/e2e/e2e_test.go:202–233

(t *testing.T)

}

func TestReplayProtection(t *testing.T) {
	pool := testutil.TestDB(t)
	receiver := testutil.SubscriberReceiver(t)
	ts := testutil.TestServer(t, pool)

	user, _, _ := setupDomainAndAgent(t, ts, "agent@replay.example.com", "replay.example.com", "", "")
	registerWebhook(t, ts, user.ID, receiver.Server.URL+"/received",
		[]string{"email.received"}, identity.WebhookFilters{})

	msg := "From: alice@test.com\r\nTo: agent@replay.example.com\r\nSubject: Replay\r\n\r\nTest"
	smtp.SendMail(ts.SMTPAddr, nil, "alice@test.com", []string{"agent@replay.example.com"}, []byte(msg))

	tick(t, ts)
	got := receiver.WaitFor(t, 5*time.Second, func(c []testutil.SubscriberCaptured) bool { return len(c) >= 1 })
	if len(got) != 1 {
		t.Fatalf("got %d captures, want 1", len(got))
	}
	data, _ := got[0].Envelope["data"].(map[string]any)
	authHeaders := headers.AuthHeaders(receivedAuthHeaders(data))
	secrets := authHeaderSecrets(t, ts, user.ID)

	// Should verify with normal window
	if !headers.Verify(secrets, authHeaders) {
		t.Error("expected auth headers to verify within normal window")
	}

	// Should reject with very tight window
	time.Sleep(5 * time.Millisecond)
	if headers.VerifyWithMaxAge(secrets, authHeaders, 1*time.Millisecond) {
		t.Error("expected replay protection to reject stale headers")
	}
}

func TestOutboundResponseFormat(t *testing.T) {
	t.Skip("requires an outbound SMTP relay configured in testutil.TestServer — tracked as test-infra work")