trusthook/zoom_test.go at main · eben-vranken/trusthook · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
package trusthook

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"errors"
	"net/http"
	"strconv"
	"testing"
	"time"
)

func TestZoomValidSignature(t *testing.T) {
	secret := "whsec_test"
	body := []byte(`{"id":"evt_123"}`)

	ts := strconv.FormatInt(time.Now().Unix(), 10)

	mac := hmac.New(sha256.New, []byte(secret))
	mac.Write([]byte("v0:" + ts + ":" + string(body)))
	sig := hex.EncodeToString(mac.Sum(nil))

	headers := http.Header{}
	headers.Set("x-zm-signature", "v0="+sig)
	headers.Set("x-zm-request-timestamp", ts)

	err := Verify(Zoom, body, headers, secret)
	if err != nil {
		t.Errorf("got %v, want %v", err, nil)
	}
}

func TestZoomMissingTimestampHeader(t *testing.T) {
	secret := "whsec_test"
	body := []byte(`{"id":"evt_123"}`)

	ts := strconv.FormatInt(time.Now().Unix(), 10)

	mac := hmac.New(sha256.New, []byte(secret))
	mac.Write([]byte("v0:" + ts + ":" + string(body)))
	sig := hex.EncodeToString(mac.Sum(nil))

	headers := http.Header{}
	headers.Set("x-zm-signature", "v0="+sig)

	err := Verify(Zoom, body, headers, secret)
	if !errors.Is(err, ErrMissingHeader) {
		t.Errorf("got %v, want %v", err, ErrMissingHeader)
	}
}

func TestZoomMissingSignatureHeader(t *testing.T) {
	secret := "whsec_test"
	body := []byte(`{"id":"evt_123"}`)

	ts := strconv.FormatInt(time.Now().Unix(), 10)

	mac := hmac.New(sha256.New, []byte(secret))
	mac.Write([]byte("v0:" + ts + ":" + string(body)))

	headers := http.Header{}
	headers.Set("x-zm-request-timestamp", ts)

	err := Verify(Zoom, body, headers, secret)
	if !errors.Is(err, ErrMissingHeader) {
		t.Errorf("got %v, want %v", err, ErrMissingHeader)
	}
}

func TestZoomMalformedSignature(t *testing.T) {
	secret := "whsec_test"
	body := []byte(`{"id":"evt_123"}`)

	ts := strconv.FormatInt(time.Now().Unix(), 10)

	mac := hmac.New(sha256.New, []byte(secret))
	mac.Write([]byte("v0:" + ts + ":" + string(body)))

	headers := http.Header{}
	headers.Set("x-zm-signature", "v0=nothex")
	headers.Set("x-zm-request-timestamp", ts)

	err := Verify(Zoom, body, headers, secret)
	if !errors.Is(err, ErrMalformedSignature) {
		t.Errorf("got %v, want %v", err, ErrMalformedSignature)
	}
}