(t *testing.T)
| 61 | } |
| 62 | |
| 63 | func TestDecodeCursorTamperedPayload(t *testing.T) { |
| 64 | type cur struct { |
| 65 | Agent string `json:"agent"` |
| 66 | } |
| 67 | enc := EncodeMust(t, testSecret, cur{Agent: "agent_a"}) |
| 68 | // Flip a byte in the base64 payload segment (before the '.'); the |
| 69 | // signature no longer matches. |
| 70 | dot := strings.IndexByte(enc, '.') |
| 71 | if dot <= 0 { |
| 72 | t.Fatalf("expected a signature separator in %q", enc) |
| 73 | } |
| 74 | b := []byte(enc) |
| 75 | // Swap the first payload byte for a different base64url char. |
| 76 | if b[0] == 'A' { |
| 77 | b[0] = 'B' |
| 78 | } else { |
| 79 | b[0] = 'A' |
| 80 | } |
| 81 | var out cur |
| 82 | if err := DecodeCursor([]string{testSecret}, string(b), &out); err != ErrInvalidCursor { |
| 83 | t.Fatalf("tampered payload: want ErrInvalidCursor, got %v", err) |
| 84 | } |
| 85 | } |
| 86 | |
| 87 | func TestDecodeCursorWrongSecret(t *testing.T) { |
| 88 | type cur struct { |
nothing calls this directly
no test coverage detected