Function TestTurnAuthFailure

test/singlenode_test.go:1408–1528

(t *testing.T)

}

func TestTurnAuthFailure(t *testing.T) {
	if testing.Short() {
		t.SkipNow()
		return
	}

	const turnUDPPort = 3478

	s := createSingleNodeServer(func(c *config.Config) {
		c.TURN.Enabled = true
		c.TURN.UDPPort = turnUDPPort
	})
	go func() {
		if err := s.Start(); err != nil {
			logger.Errorw("server returned error", err)
		}
	}()
	defer s.Stop(true)

	waitForServerToStart(s)

	// build a known-good username/password pair so individual cases can mutate
	// only the part they are exercising.
	pID := livekit.ParticipantID("PA_authfail")
	authHandler := service.NewTURNAuthHandler(auth.NewSimpleKeyProvider(testApiKey, testApiSecret))
	validUsername, validExpiry := authHandler.CreateUsername(testApiKey, pID, 300)
	validPassword, err := authHandler.CreatePassword(testApiKey, pID, validExpiry)
	require.NoError(t, err)

	// username encoded with an already-expired timestamp.
	expiredUsername, _ := authHandler.CreateUsername(testApiKey, pID, -10)

	// username encoded with an api key the server does not know about.
	unknownAPIKeyUsername, _ := authHandler.CreateUsername("unknown-api-key", pID, 300)

	// password whose hash was generated for an expiry that doesn't match the
	// one encoded in the username. The server reconstructs the password using
	// the username's expiry, so the integrity check fails.
	mismatchedExpiryPassword, err := authHandler.CreatePassword(testApiKey, pID, validExpiry+60)
	require.NoError(t, err)
	require.NotEqual(t, validPassword, mismatchedExpiryPassword)

	// username carrying expiry=0 must be rejected outright; constructed
	// directly because CreateUsername always stamps a real expiry.
	zeroExpiryUsername := base62.EncodeToString(fmt.Appendf(nil, "%s|%s|%d", testApiKey, pID, 0))

	// username with only apiKey|pID (no expiry component) is the legacy
	// pre-expiry form and must be rejected.
	twoPartUsername := base62.EncodeToString(fmt.Appendf(nil, "%s|%s", testApiKey, pID))

	testCases := []struct {
		name     string
		username string
		password string
	}{
		{
			name:     "unparseable-username",
			username: "not-base62!!!",