Warp/server/internal/userapi/password_test.go

package userapi

import (
	"errors"
	"strings"
	"testing"

	"golang.org/x/crypto/argon2"
)

func TestHashAndVerifyPassword(t *testing.T) {
	const password = "correct horse battery staple"

	hash, err := HashPassword(password)
	if err != nil {
		t.Fatalf("HashPassword: %v", err)
	}
	if !strings.HasPrefix(hash, "$argon2id$v=") {
		t.Fatalf("hash %q is not in the PHC format", hash)
	}

	ok, err := VerifyPassword(hash, password)
	if err != nil || !ok {
		t.Fatalf("VerifyPassword of the right password = %v, %v", ok, err)
	}

	ok, err = VerifyPassword(hash, password+"!")
	if err != nil {
		t.Fatalf("VerifyPassword: %v", err)
	}
	if ok {
		t.Error("the wrong password verified")
	}
}

// TestHashIsSalted is what makes a stolen table worth attacking one row at a
// time rather than all at once.
func TestHashIsSalted(t *testing.T) {
	first, err := HashPassword("same password")
	if err != nil {
		t.Fatal(err)
	}
	second, err := HashPassword("same password")
	if err != nil {
		t.Fatal(err)
	}
	if first == second {
		t.Error("two hashes of the same password are identical, so the salt is not random")
	}
}

// TestHashRecordsItsParameters is what lets the cost be raised later without
// invalidating every existing password.
func TestHashRecordsItsParameters(t *testing.T) {
	hash, err := HashPassword("x")
	if err != nil {
		t.Fatal(err)
	}
	params, salt, key, err := decodeHash(hash)
	if err != nil {
		t.Fatalf("decodeHash of our own output: %v", err)
	}
	if params.memory != argonMemoryKiB || params.time != argonTime || params.lanes != argonLanes {
		t.Errorf("recorded parameters = %+v, want the current constants", params)
	}
	if len(salt) != argonSaltLen || len(key) != argonKeyLen {
		t.Errorf("salt is %d bytes and key %d bytes", len(salt), len(key))
	}
}

// TestVerifyAgainstAnOlderCost proves the point of recording them: a hash
// made with weaker parameters still verifies.
func TestVerifyAgainstAnOlderCost(t *testing.T) {
	const password = "from an older release"
	// A hash as a previous, cheaper, configuration would have written it.
	salt := []byte("0123456789abcdef")
	key := argon2.IDKey([]byte(password), salt, 1, 8*1024, 1, 32)
	hash := "$argon2id$v=19$m=8192,t=1,p=1$" + b64.EncodeToString(salt) + "$" + b64.EncodeToString(key)

	ok, err := VerifyPassword(hash, password)
	if err != nil || !ok {
		t.Fatalf("VerifyPassword against older parameters = %v, %v", ok, err)
	}
}

// TestVerifyRejectsMalformedHashes keeps a corrupt row from looking like a
// wrong password for ever.
func TestVerifyRejectsMalformedHashes(t *testing.T) {
	good, err := HashPassword("x")
	if err != nil {
		t.Fatal(err)
	}
	parts := strings.Split(good, "$")

	for name, hash := range map[string]string{
		"empty":              "",
		"not a hash":         "hunter2",
		"too few fields":     "$argon2id$v=19$m=19456,t=2,p=1$" + parts[4],
		"wrong algorithm":    "$argon2i$v=19$" + strings.Join(parts[3:], "$"),
		"unknown version":    "$argon2id$v=16$" + strings.Join(parts[3:], "$"),
		"unparseable params": "$argon2id$v=19$m=lots,t=2,p=1$" + parts[4] + "$" + parts[5],
		"zero memory":        "$argon2id$v=19$m=0,t=2,p=1$" + parts[4] + "$" + parts[5],
		"bad base64 salt":    "$argon2id$v=19$m=19456,t=2,p=1$not!base64$" + parts[5],
		"empty key":          "$argon2id$v=19$m=19456,t=2,p=1$" + parts[4] + "$",
	} {
		t.Run(name, func(t *testing.T) {
			ok, err := VerifyPassword(hash, "x")
			if ok {
				t.Fatal("a malformed hash verified")
			}
			if !errors.Is(err, ErrInvalidPasswordHash) {
				t.Errorf("error = %v, want ErrInvalidPasswordHash", err)
			}
		})
	}
}

func TestPasswordLengthIsBounded(t *testing.T) {
	long := strings.Repeat("x", MaxPasswordLength+1)

	if _, err := HashPassword(long); !errors.Is(err, ErrPasswordTooLong) {
		t.Errorf("HashPassword of an overlong password = %v, want ErrPasswordTooLong", err)
	}

	hash, err := HashPassword(strings.Repeat("x", MaxPasswordLength))
	if err != nil {
		t.Fatalf("a password at the limit must be accepted: %v", err)
	}
	if _, err := VerifyPassword(hash, long); !errors.Is(err, ErrPasswordTooLong) {
		t.Errorf("VerifyPassword of an overlong password = %v, want ErrPasswordTooLong", err)
	}
}

// TestNonASCIIPasswords: the hash takes bytes, so there is nothing to
// normalise, but a client sending one must not be refused.
func TestNonASCIIPasswords(t *testing.T) {
	const password = "übers3kr1t 🔐"

	hash, err := HashPassword(password)
	if err != nil {
		t.Fatal(err)
	}
	if ok, err := VerifyPassword(hash, password); err != nil || !ok {
		t.Errorf("VerifyPassword = %v, %v", ok, err)
	}
}

// TestDummyPasswordHashIsUsable: the dummy hash exists so that a login for
// an account that does not exist costs the same as one that does. If it ever
// stopped being a valid hash, that work would vanish and the timing would
// leak which user names are real.
func TestDummyPasswordHashIsUsable(t *testing.T) {
	ok, err := VerifyPassword(dummyPasswordHash, "anything")
	if err != nil {
		t.Fatalf("the dummy hash is not verifiable: %v", err)
	}
	if ok {
		t.Error("the dummy hash matched a password")
	}
}