| 298 | } |
| 299 | |
| 300 | func TestSign_ParametricMatchesSignerWrapper(t *testing.T) { |
| 301 | // The legacy Signer wrapper should produce identical output to the |
| 302 | // new free Sign function for any given secret. (Timestamp is the |
| 303 | // only non-deterministic field; we check everything else.) |
| 304 | const secret = "consistency-test" |
| 305 | payload := AuthPayload{ |
| 306 | Verified: true, |
| 307 | Sender: "consistency@test.example", |
| 308 | EntityType: "human", |
| 309 | DomainCheck: "spf=pass; dkim=pass", |
| 310 | MessageID: "msg_consistency", |
| 311 | BodyHash: "abc123", |
| 312 | } |
| 313 | free := Sign(secret, payload) |
| 314 | wrapped := NewSigner(secret).Sign(payload) |
| 315 | |
| 316 | for _, k := range []string{HeaderVerified, HeaderSender, HeaderEntityType, HeaderDomainCheck, HeaderMessageID, HeaderBodyHash} { |
| 317 | if free[k] != wrapped[k] { |
| 318 | t.Errorf("%s differs: free=%q wrapped=%q", k, free[k], wrapped[k]) |
| 319 | } |
| 320 | } |
| 321 | } |