| 171 | }; |
| 172 | |
| 173 | TEST_F(TokenTest, TestInit) { |
| 174 | TokenSigner signer(kTokenValiditySeconds, kTokenValiditySeconds, 10); |
| 175 | const TokenVerifier& verifier(signer.verifier()); |
| 176 | |
| 177 | SignedTokenPB token = MakeUnsignedToken(WallTime_Now()); |
| 178 | Status s = signer.SignToken(&token); |
| 179 | ASSERT_TRUE(s.IsIllegalState()) << s.ToString(); |
| 180 | |
| 181 | static const int64_t kKeySeqNum = 100; |
| 182 | PrivateKey private_key; |
| 183 | ASSERT_OK(GeneratePrivateKey(kNumBits, &private_key)); |
| 184 | string private_key_str_der; |
| 185 | ASSERT_OK(private_key.ToString(&private_key_str_der, DataFormat::DER)); |
| 186 | TokenSigningPrivateKeyPB pb; |
| 187 | pb.set_rsa_key_der(private_key_str_der); |
| 188 | pb.set_key_seq_num(kKeySeqNum); |
| 189 | pb.set_expire_unix_epoch_seconds(WallTime_Now() + 120); |
| 190 | |
| 191 | ASSERT_OK(signer.ImportKeys({pb})); |
| 192 | vector<TokenSigningPublicKeyPB> public_keys(verifier.ExportKeys()); |
| 193 | ASSERT_EQ(1, public_keys.size()); |
| 194 | ASSERT_EQ(kKeySeqNum, public_keys[0].key_seq_num()); |
| 195 | |
| 196 | // It should be possible to sign tokens once the signer is initialized. |
| 197 | ASSERT_OK(signer.SignToken(&token)); |
| 198 | ASSERT_TRUE(token.has_signature()); |
| 199 | } |
| 200 | |
| 201 | // Verify that TokenSigner does not allow 'holes' in the sequence numbers |
| 202 | // of the generated keys. The idea is to not allow sequences like '1, 5, 6'. |
nothing calls this directly
no test coverage detected