hotp_test.go

package otpgo

import (
	"encoding/json"
	"testing"

	"github.com/jltorresm/otpgo/config"
)

func TestHOTP_Generate(t *testing.T) {
	t.Run("Normal Generation", testHOTPNormalGeneration)
	t.Run("Bad Key", testHOTPBadKey)
	t.Run("Default Params", testHOTPDefaultParams)
	t.Run("Autogenerated Key", testHOTPAutogeneratedKey)
	t.Run("Lower Case Key", testHOTPLowerCaseKey)
}

func testHOTPNormalGeneration(t *testing.T) {
	t.Parallel()

	h := &HOTP{
		Key:       "73QK7D3A3PIZ6NUQQBF4BNFYQBRVUHUP",
		Counter:   363,
		Algorithm: config.HmacSHA256,
		Length:    config.Length6,
	}

	expectedOtp := "363033"

	otp, err := h.Generate()
	if err != nil {
		t.Errorf("unexpected error: %s", err)
	}

	if otp != expectedOtp {
		t.Errorf("wrong hotp\nexpected: %s\n  actual: %s", expectedOtp, otp)
	}
}

func testHOTPBadKey(t *testing.T) {
	t.Parallel()

	h := &HOTP{
		Key:       "invalid-base-32",
		Counter:   363,
		Algorithm: config.HmacSHA256,
		Length:    config.Length6,
	}

	_, err := h.Generate()
	expectedErr := ErrorInvalidKey{msg: "illegal base32 data at input byte 7"}
	if err != expectedErr {
		t.Errorf("unexpected error: %s", err)
	}
}

func testHOTPDefaultParams(t *testing.T) {
	t.Parallel()

	h := &HOTP{Key: "73QK7D3A3PIZ6NUQQBF4BNFYQBRVUHUQ"}

	expectedLeeway := HOTPDefaultLeeway
	expectedAlg := config.HmacSHA1
	expectedLength := config.Length6
	expectedOtp := "769784"

	otp, err := h.Generate()

	if err != nil {
		t.Errorf("unexpected error: %s", err)
	}

	if h.Leeway != expectedLeeway {
		t.Errorf("unexpected hash algorithm\nexpected: %d (SHA1)\n  actual: %d", expectedLeeway, h.Leeway)
	}

	if h.Algorithm != expectedAlg {
		t.Errorf("unexpected hash algorithm\nexpected: %d (SHA1)\n  actual: %d", expectedAlg, h.Algorithm)
	}

	if h.Length != expectedLength {
		t.Errorf("unexpected length\nexpected: %d\n  actual: %d", expectedLength, h.Length)
	}

	if otp != expectedOtp {
		t.Errorf("unexpected hotp\nexpected: %s\n  actual: %s", expectedOtp, otp)
	}
}

func testHOTPAutogeneratedKey(t *testing.T) {
	t.Parallel()

	h := &HOTP{}

	_, err := h.Generate()

	if err != nil {
		t.Errorf("unexpected error: %s", err)
	}

	if h.Key == "" {
		t.Error("expected Key to be populated")
	}
}

func testHOTPLowerCaseKey(t *testing.T) {
	t.Parallel()

	h := &HOTP{Key: "73qk7d3a3piz6nuqqbf4bnfyqbrvuhuq"}

	_, err := h.Generate()

	if err != nil {
		t.Errorf("unexpected error: %s", err)
	}

	if h.Key == "" {
		t.Error("expected Key to be populated")
	}
}

func TestHOTP_Validate(t *testing.T) {
	t.Run("Success", testHOTPValidateSuccess)
	t.Run("Failure", testHOTPValidateFailure)
	t.Run("Look Ahead Validation", testHOTPValidateLeeway)
	t.Run("Missing Key", testHOTPValidateMissingKey)
}

func testHOTPValidateSuccess(t *testing.T) {
	t.Parallel()

	h := &HOTP{
		Key:       "73QK7D3A3PIZ6NUQQBF4BNFYQBRVUHUQ",
		Counter:   363,
		Algorithm: config.HmacSHA256,
		Length:    config.Length6,
	}

	// Corresponds to h.Counter = 363. Successful validation will increase the
	// internal h.Counter, so that the next generated code corresponds to
	// h.Counter = 364.
	expectedOTP := "561655"

	isValid, err := h.Validate(expectedOTP)
	if err != nil {
		t.Errorf("unexpected error: %s", err)
	}
	if !isValid {
		t.Errorf("invalid token\nexpected %s to be valid", expectedOTP)
	}

	otp, err := h.Generate()
	if err != nil {
		t.Errorf("unexpected error: %s", err)
	}
	if otp == expectedOTP {
		t.Error("invalid token\nexpected generated token to be different after successful validation")
	}

	isValid, err = h.Validate(otp)
	if err != nil {
		t.Errorf("unexpected error: %s", err)
	}
	if !isValid {
		t.Errorf("invalid token\nexpected %s to be valid", otp)
	}
}

func testHOTPValidateFailure(t *testing.T) {
	t.Parallel()

	invalidOTP := "1111111"

	h := &HOTP{Key: "73QK7D3A3PIZ6NUQQBF4BNFYQBRVUHUQ", Length: config.Length8}

	isValid, err := h.Validate(invalidOTP)
	if err != nil {
		t.Errorf("unexpected error: %s", err)
	}

	if isValid {
		t.Errorf("unexpected valid token\nexpected %s to be invalid", invalidOTP)
	}
}

func testHOTPValidateLeeway(t *testing.T) {
	t.Parallel()

	h := &HOTP{
		Key:       "73QK7D3A3PIZ6NUQQBF4BNFYQBRVUHUT",
		Counter:   362,
		Leeway:    2,
		Algorithm: config.HmacSHA512,
		Length:    config.Length7,
	}

	cases := []struct {
		label         string
		modifier      int
		shouldBeValid bool
	}{
		{"Correct Step", 0, true},
		{"One Step Behind", -1, true},
		{"One Step Ahead", 1, true},
		{"Two Step Behind", -2, true},
		{"Two Step Ahead", +2, true},
		{"Three Step Behind", -3, false},
		{"Three Step Ahead", 3, false},
	}

	for _, c := range cases {
		t.Run(c.label, func(t *testing.T) {
			h.Counter = uint64(int(h.Counter) + c.modifier)
			otp, err := h.Generate()
			if err != nil {
				t.Errorf("unexpected error: %s", err)
				t.FailNow()
			}

			// Return to original counter before validation
			h.Counter = uint64(int(h.Counter) - c.modifier)

			isValid, err := h.Validate(otp)
			if err != nil {
				t.Errorf("unexpected error: %s", err)
			}

			if isValid != c.shouldBeValid {
				t.Errorf("unexpected result from Validate()\nexpected %s to be %v", c.label, c.shouldBeValid)
			}
		})
	}
}

func testHOTPValidateMissingKey(t *testing.T) {
	h := &HOTP{}

	isValid, err := h.Validate("irrelevant")
	if err == nil {
		t.Error("expected error")
		t.FailNow()
	}

	if err.Error() != "missing secret key for validation" {
		t.Errorf("unexpected error: %s", err)
	}

	if isValid {
		t.Errorf("token should be invalid")
	}
}

func TestHOTP_KeyUri(t *testing.T) {
	h := HOTP{
		Key:       "JOC773H4BTUR5U6M422M2AT7S4MTQ7BLR75Y252JK3A",
		Counter:   759,
		Algorithm: config.HmacSHA256,
	}
	_, _ = h.Generate()

	accountName := "jòhn.doe@example.com"
	issuer := "Acme Inc"
	expectedUri := "otpauth://hotp/Acme%20Inc:j%C3%B2hn.doe@example.com?algorithm=SHA256&counter=759&digits=6&issuer=Acme+Inc&secret=JOC773H4BTUR5U6M422M2AT7S4MTQ7BLR75Y252JK3A"

	uri := h.KeyUri(accountName, issuer)

	if expectedUri != uri.String() {
		t.Errorf("unexpected key URI\nexpected: %s\n  actual: %s", expectedUri, uri.String())
	}
}

func TestHOTPJson(t *testing.T) {
	h := HOTP{
		Key:       "73QK7D3A3PIZ6NUQQBF4BNFYQBRVUHUQ",
		Counter:   9338,
		Leeway:    1,
		Algorithm: config.HmacSHA256,
		Length:    config.Length7,
	}

	expectedJson := `{"key":"73QK7D3A3PIZ6NUQQBF4BNFYQBRVUHUQ","counter":9338,"leeway":1,"algorithm":"SHA256","length":7}`

	j, err := json.Marshal(h)
	if err != nil {
		t.Errorf("unexpected error: %s", err)
		t.FailNow()
	}

	if expectedJson != string(j) {
		t.Errorf("unexpected json:\nexpected: %s\n  actual: %s", expectedJson, j)
	}
}