Function TestUserAuthenticatePasswordHashUpgrade

auth/user_test.go:61–135

(t *testing.T)

}

func TestUserAuthenticatePasswordHashUpgrade(t *testing.T) {
	const (
		username      = "alice"
		oldPassword   = "hunter2"
		newBcryptCost = 12
	)

	base.SetUpTestLogging(t, base.LevelDebug, base.KeyAuth)
	ctx := base.TestCtx(t)
	bucket := base.GetTestBucket(t)
	defer bucket.Close(ctx)
	dataStore := bucket.GetSingleDataStore()

	// Not NewTestAuthenticator, since we're testing BcryptCost and want the actual bcrypt default.
	auth := NewAuthenticator(dataStore, nil, DefaultAuthenticatorOptions(ctx))

	// Create user
	u, err := auth.NewUser(username, oldPassword, base.Set{})
	require.NoError(t, err)
	require.NotNil(t, u)

	user := u.(*userImpl)
	oldHash := user.PasswordHash_

	// Make sure their password was hashed with the desired cost
	cost, err := bcrypt.Cost(user.PasswordHash_)
	require.NoError(t, err)
	assert.Equal(t, DefaultBcryptCost, cost)

	// Try to auth with an incorrect password
	assert.False(t, u.Authenticate("test"))

	// Make sure the hash has not changed
	newHash := user.PasswordHash_
	assert.Equal(t, string(oldHash), string(newHash))

	// Authenticate correctly
	assert.True(t, u.Authenticate(oldPassword))

	// Make sure the hash has still not changed (we've not changed the cost yet)
	newHash = user.PasswordHash_
	assert.Equal(t, string(oldHash), string(newHash))

	// Check the cost is still the old value
	cost, err = bcrypt.Cost(user.PasswordHash_)
	require.NoError(t, err)
	assert.Equal(t, DefaultBcryptCost, cost)

	// Now bump the global bcrypt cost
	err = auth.SetBcryptCost(newBcryptCost)
	require.NoError(t, err)

	// Reset bcrypt cost after test
	defer func() { require.NoError(t, auth.SetBcryptCost(DefaultBcryptCost)) }()

	// Authenticate incorrectly again
	assert.False(t, u.Authenticate("test"))