25 lines
982 B
JavaScript
25 lines
982 B
JavaScript
import { describe, expect, test } from "bun:test";
|
|
import { hashPassword, randomToken, verifyPassword } from "./auth-crypto";
|
|
|
|
describe("API authentication crypto", () => {
|
|
test("round trips a password without accepting another password", async () => {
|
|
const hash = await hashPassword("correct horse battery staple");
|
|
|
|
expect(hash).toMatch(/^pbkdf2-sha256\$100000\$/);
|
|
expect(await verifyPassword("correct horse battery staple", hash)).toBe(true);
|
|
expect(await verifyPassword("incorrect", hash)).toBe(false);
|
|
});
|
|
|
|
test("rejects malformed or intentionally weak hashes", async () => {
|
|
expect(await verifyPassword("password", "plaintext")).toBe(false);
|
|
expect(await verifyPassword("password", "pbkdf2-sha256$99999$c2FsdA$aGFzaA")).toBe(false);
|
|
});
|
|
|
|
test("creates URL-safe tokens with the requested entropy length", () => {
|
|
const token = randomToken(32);
|
|
|
|
expect(token).toMatch(/^[A-Za-z0-9_-]+$/);
|
|
expect(token.length).toBe(43);
|
|
});
|
|
});
|