| 127 | } |
| 128 | |
| 129 | func TestSignVerifyWithDomainCheck(t *testing.T) { |
| 130 | s := NewSigner("test-secret") |
| 131 | h := s.Sign(AuthPayload{ |
| 132 | Verified: true, |
| 133 | Sender: "alice@example.com", |
| 134 | EntityType: "human", |
| 135 | DomainCheck: "spf=pass; dkim=none", |
| 136 | }) |
| 137 | |
| 138 | if h[HeaderDomainCheck] != "spf=pass; dkim=none" { |
| 139 | t.Errorf("DomainCheck = %q, want %q", h[HeaderDomainCheck], "spf=pass; dkim=none") |
| 140 | } |
| 141 | if !s.Verify(h) { |
| 142 | t.Error("expected Verify to return true with DomainCheck") |
| 143 | } |
| 144 | |
| 145 | // Tampering with domain check should break signature |
| 146 | h[HeaderDomainCheck] = "spf=fail; dkim=fail" |
| 147 | if s.Verify(h) { |
| 148 | t.Error("expected Verify to reject tampered DomainCheck") |
| 149 | } |
| 150 | } |
| 151 | |
| 152 | // TestMessageIDIsBound ensures auth headers cannot be lifted from one |
| 153 | // message and reused on another within the replay window. Without |