Janady13/missionmatch / internal/platform/security/totp_test.go

Source identity

Field	Recorded value
Source type	GitHub source
Original record	Janady13/missionmatch / internal/platform/security/totp_test.go
Date	Not specified in source
Repository	Janady13/missionmatch
Revision	720d47fae476b0d38477ae4401697d372b1ea2bc
Branch	feature/opportunity-to-outcome
Path or archive member	internal/platform/security/totp_test.go
Original SHA-256	ec246e5295adac2397783dcf76cabb2ef0ce5d921bd6a41175494d71634acd53
Git blob SHA	97c72f1ffb9c55d86bf44f6e54d12f4b3fe2ffe2
Reading-copy SHA-256	ec246e5295adac2397783dcf76cabb2ef0ce5d921bd6a41175494d71634acd53

Original source ↗

Every recorded occurrence

These 36 records contain identical original source bytes. Their paths and revisions remain part of the archive.

Original record	Branch or archive	Revision / identifier	Original location
Janady13/missionmatch / internal/platform/security/totp_test.go	feature/opportunity-to-outcome	720d47fae476b0d38477ae4401697d372b1ea2bc	Open original
Janady13/missionmatch / internal/platform/security/totp_test.go	per-tenant-routing	9bde0f9a74b89d01980fa658e5253acda7528d0c	Open original
Janady13/missionmatch / internal/platform/security/totp_test.go	collision-deconfliction	4ee5a09972608ed89f8377c6665542d5f450f0a6	Open original
Janady13/missionmatch / internal/platform/security/totp_test.go	ws6-retrieval	6c56e29231ec05735927fa265c97d517499dfeaf	Open original
Janady13/missionmatch / internal/platform/security/totp_test.go	workstream-a-shared-core	e0de03ac3a1ec826bd15d0e048e3b02baa23eeff	Open original
Janady13/missionmatch / internal/platform/security/totp_test.go	m5-price-to-win	41000ad30fff4129fdaf5ec84e15ba14c27d4890	Open original
Janady13/missionmatch / internal/platform/security/totp_test.go	workstream-c-slatematch	5cd60c918301b46ecd6ed3e03e20c395da0062e2	Open original
Janady13/missionmatch / internal/platform/security/totp_test.go	ws1-ontology-sync	b596f449a32a1016fbd403c36505cc00a1ac9ee6	Open original
Janady13/missionmatch / internal/platform/security/totp_test.go	master	1e9249840a4302ec82e123b9c9cb6f75badea3e4	Open original
Janady13/missionmatch / internal/platform/security/totp_test.go	ws8-teaching-loop	c823f0fb6bb2aba0f39001eb6de96f4000d9321f	Open original
Janady13/missionmatch / internal/platform/security/totp_test.go	w3-ai-staffing-recommendations	43d56387270ef4da4cabd794d97ca6a49909bc7d	Open original
Janady13/missionmatch / internal/platform/security/totp_test.go	mag-substrate	b82c7100a492dec67dfd1eda6b3f53def859be35	Open original
Janady13/missionmatch / internal/platform/security/totp_test.go	ws3-clearance	4b8e7ce594c068621867f9c9deed0ec64ae6c553	Open original
Janady13/missionmatch / internal/platform/security/totp_test.go	workstream-d-command-center	255e7d1d420abf5e277d0cd8c9b14f6f72b6acb9	Open original
Janady13/missionmatch / internal/platform/security/totp_test.go	phase2-eval-fairness	d361af254701975fe239927656ababb56374655e	Open original
Janady13/missionmatch / internal/platform/security/totp_test.go	workstream-e-dataflow-deploy	433815a042f9741411e60fa553fe72143e9b10db	Open original
Janady13/missionmatch / internal/platform/security/totp_test.go	ruthless-debug-sweep	b7d742f8f032984be3817efffa3eb8b13b651c1f	Open original
Janady13/missionmatch / internal/platform/security/totp_test.go	time-to-fill-survival	b66e1e505863d4f17741a4b9ede73509e45bd6c6	Open original
Janady13/missionmatch / internal/platform/security/totp_test.go	ai-intelligence-layer	5d5ddff70393a197c5f54a45280bb5dd42b24755	Open original
Janady13/missionmatch / internal/platform/security/totp_test.go	graphrag-foundation	b0ddeb9f633fd138d09309d1a17b7d13bc3a67f7	Open original
Janady13/missionmatch / internal/platform/security/totp_test.go	workstream-a-opportunity-intelligence	1675031db74316e100782d063e9eda1a597fe3a1	Open original
Janady13/missionmatch / internal/platform/security/totp_test.go	deploy-and-ops	bdacd9d0b4d5998d25fc74bf4007f4c3ec538c7a	Open original
Janady13/missionmatch / internal/platform/security/totp_test.go	ws9-bench-ingestion	f585a9ef32fa554663ce1fba9a414a54b6e49cf0	Open original
Janady13/missionmatch / internal/platform/security/totp_test.go	ws2-alias-relationship	e4dada4601c6eb101830f9d223a9655dfa120616	Open original
Janady13/missionmatch / internal/platform/security/totp_test.go	presentation-readiness	eb574acaa29d71ce4d0f852572e87c275c79fdb7	Open original
Janady13/missionmatch / internal/platform/security/totp_test.go	vendor-intelligence	fe9796a19c261951d3f2565206c0c1b5ac294465	Open original
Janady13/missionmatch / internal/platform/security/totp_test.go	workstream-b-screenmatch	09015496d565a172bcaa15cfe9a8e4b072b13df0	Open original
Janady13/missionmatch / internal/platform/security/totp_test.go	ws7-federal-signal	6a9f6ce9cfb13345ffb47770d4960e7c2d9c17c2	Open original
Janady13/missionmatch / internal/platform/security/totp_test.go	workstream-e-commercial-stubs	4437da660539284a400ee380b9b427a300c369ee	Open original
Janady13/missionmatch / internal/platform/security/totp_test.go	ai-brain-live	aac32fc49c878cc5bca099459307611562d0bac1	Open original
Janady13/missionmatch / internal/platform/security/totp_test.go	workstream-d-missionmatch	3be46ba89edb737182075a2b320509b42dc916f8	Open original
Janady13/missionmatch / internal/platform/security/totp_test.go	phase2-connectors	e038d4c687aec16f8bd9bc4d907eea14d91f8704	Open original
Janady13/missionmatch / internal/platform/security/totp_test.go	workstream-b-sam-contract-awards	d5101cceb98e70000cebb31d3e7ac73d747d3a6d	Open original
Janady13/missionmatch / internal/platform/security/totp_test.go	w0-aedt-compliance	39df94f92b2a33f852481fe1954dabed841524bb	Open original
Janady13/missionmatch / internal/platform/security/totp_test.go	feature/aioe-upgrade	2178e7298d0e5d9af83afa12402fd587f0ba6ed8	Open original
Janady13/missionmatch / internal/platform/security/totp_test.go	capture-readiness	bae6af7cb2997e819174a9e9cfff5e16067a1975	Open original

Recovered source transcript

Download complete source text ↓112 lines · 3.4 KB

package security

import (
	"crypto/hmac"
	"crypto/sha1"
	"encoding/binary"
	"fmt"
	"strings"
	"testing"
	"time"
)

func TestGenerateSecretLength(t *testing.T) {
	secret, err := GenerateSecret()
	if err != nil {
		t.Fatalf("GenerateSecret: %v", err)
	}
	if len(secret) != totpSecretSize {
		t.Fatalf("secret length = %d, want %d", len(secret), totpSecretSize)
	}
}

func TestTOTPValidateAcceptsCurrentStep(t *testing.T) {
	secret, _ := GenerateSecret()
	now := time.Unix(1_700_000_000, 0)
	step := CurrentStep(now)
	current := code(secret, uint64(step))

	var totp TOTP
	ok, used := totp.Validate(secret, current, now, 0)
	if !ok {
		t.Fatal("Validate rejected a freshly computed current code")
	}
	if used != step {
		t.Fatalf("usedStep = %d, want %d", used, step)
	}
}

func TestTOTPMonotonicReplayGuard(t *testing.T) {
	secret, _ := GenerateSecret()
	now := time.Unix(1_700_000_000, 0)
	step := CurrentStep(now)
	var totp TOTP

	// Consume the current step.
	ok, used := totp.Validate(secret, code(secret, uint64(step)), now, 0)
	if !ok || used != step {
		t.Fatalf("first use failed: ok=%v used=%d", ok, used)
	}

	// Replaying the consumed code is rejected once lastUsedStep is the consumed step.
	if ok, _ := totp.Validate(secret, code(secret, uint64(step)), now, step); ok {
		t.Fatal("replay of the consumed code was accepted")
	}
	// An earlier in window step (step minus one) is also rejected after the consume.
	if ok, _ := totp.Validate(secret, code(secret, uint64(step-1)), now, step); ok {
		t.Fatal("an earlier in window code was accepted after a later success")
	}
	// The next code (step plus one) is the legitimate advance and is accepted, moving the marker.
	ok, used = totp.Validate(secret, code(secret, uint64(step+1)), now, step)
	if !ok || used != step+1 {
		t.Fatalf("legitimate next code rejected: ok=%v used=%d", ok, used)
	}
}

func TestTOTPRejectsSHA1Code(t *testing.T) {
	// The server is pinned to SHA 256. A code derived with SHA 1 for the same secret and step must be
	// rejected, which is what catches an authenticator that silently defaulted to SHA 1.
	secret, _ := GenerateSecret()
	now := time.Unix(1_700_000_000, 0)
	step := CurrentStep(now)

	sha1Code := func(secret []byte, counter uint64) string {
		var buf [8]byte
		binary.BigEndian.PutUint64(buf[:], counter)
		mac := hmac.New(sha1.New, secret)
		mac.Write(buf[:])
		sum := mac.Sum(nil)
		offset := sum[len(sum)-1] & 0x0f
		bin := (uint32(sum[offset])&0x7f)<<24 | uint32(sum[offset+1])<<16 | uint32(sum[offset+2])<<8 | uint32(sum[offset+3])
		return fmt.Sprintf("%06d", bin%totpModulo)
	}

	var totp TOTP
	bad := sha1Code(secret, uint64(step))
	good := code(secret, uint64(step))
	if bad == good {
		t.Skip("sha1 and sha256 codes collided for this secret, skipping")
	}
	if ok, _ := totp.Validate(secret, bad, now, 0); ok {
		t.Fatal("Validate accepted a SHA 1 derived code")
	}
}

func TestProvisioningURIPinsAlgorithm(t *testing.T) {
	secret, _ := GenerateSecret()
	uri := ProvisioningURI(secret, "owner@example.com", "missionMATCH")
	for _, want := range []string{"otpauth://totp/", "algorithm=SHA256", "digits=6", "period=30", "issuer=missionMATCH"} {
		if !strings.Contains(uri, want) {
			t.Fatalf("provisioning URI %q missing %q", uri, want)
		}
	}
}

func TestTOTPRejectsWrongLength(t *testing.T) {
	secret, _ := GenerateSecret()
	var totp TOTP
	if ok, _ := totp.Validate(secret, "123", time.Unix(1_700_000_000, 0), 0); ok {
		t.Fatal("Validate accepted a code of the wrong length")
	}
}