| 62 | } |
| 63 | |
| 64 | func TestVerifyRejectsFutureTimestamp(t *testing.T) { |
| 65 | s := NewSigner("test-secret") |
| 66 | h := s.Sign(AuthPayload{ |
| 67 | Verified: true, |
| 68 | Sender: "alice@example.com", |
| 69 | EntityType: "human", |
| 70 | }) |
| 71 | |
| 72 | // Overwrite timestamp to 2 minutes in the future (beyond 30s grace) |
| 73 | h[HeaderTimestamp] = time.Now().UTC().Add(2 * time.Minute).Format(time.RFC3339) |
| 74 | |
| 75 | if s.Verify(h) { |
| 76 | t.Error("expected Verify to reject future timestamp") |
| 77 | } |
| 78 | } |
| 79 | |
| 80 | func TestVerifyRejectsTamperedHeader(t *testing.T) { |
| 81 | s := NewSigner("test-secret") |