biss
ae472aabb0
兼容现有 PBKDF2 密码和 hz_session Cookie TOTP 绑定、二步登录、防重放、恢复码与 AES-GCM 密钥 与 Node 完全一致的 Redis 键格式，可跨运行时共享会话 生产环境开启原生认证时强制要求 Redis 默认保持兼容代理；设置 AUTH_NATIVE_ENABLED=true 即可切换
48 lines
1.9 KiB
C#
48 lines
1.9 KiB
C#
using Eis.Infrastructure.Authentication;
|
|
|
|
namespace Eis.Infrastructure.Tests.Authentication;
|
|
|
|
public sealed class TotpCompatibilityServiceTests
|
|
{
|
|
private const string EncryptionKey = "test-only-totp-encryption-key-32-characters";
|
|
private readonly TotpCompatibilityService _service = new(AuthenticationOptions.CreateForTests(EncryptionKey));
|
|
|
|
[Fact]
|
|
public void MatchesRfc6238NodeVector()
|
|
{
|
|
Assert.Equal("287082", _service.AtStep("GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ", 1));
|
|
}
|
|
|
|
[Fact]
|
|
public void DecryptsNodeAesGcmPayloadAndRoundTripsDotnetPayload()
|
|
{
|
|
const string nodePayload = "v1.BW3b8OSqNLprCfpr.UUw1AKfqGvmo11YQUhHuPQ.GbPra-HNEUS3uWPJqwVpw2utLYbs89rlPOwhuNl7QYk";
|
|
const string secret = "GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ";
|
|
|
|
Assert.Equal(secret, _service.DecryptSecret(nodePayload));
|
|
Assert.Equal(secret, _service.DecryptSecret(_service.EncryptSecret(secret)));
|
|
}
|
|
|
|
[Fact]
|
|
public void MatchesNodeRecoveryHashAndOtpAuthUri()
|
|
{
|
|
Assert.Equal(
|
|
"662bf005217b529934526e0c8755c0c48d4dab012dfe96191080a6675334559c",
|
|
_service.HashRecoveryCode("ABCDE-23456"));
|
|
Assert.Equal(
|
|
"otpauth://totp/%E6%B5%B7%E5%B7%9E%20%E8%80%83%E8%AF%95%E4%B8%AD%E5%BF%83%3A2026%200001?secret=ABCDEF234567&issuer=%E6%B5%B7%E5%B7%9E+%E8%80%83%E8%AF%95%E4%B8%AD%E5%BF%83&algorithm=SHA1&digits=6&period=30",
|
|
_service.BuildOtpAuthUri("ABCDEF234567", "2026 0001", "海州 考试中心"));
|
|
}
|
|
|
|
[Fact]
|
|
public void RecoveryCodeCanOnlyBeConsumedOnce()
|
|
{
|
|
var hashes = new[] { _service.HashRecoveryCode("ABCDE-23456"), _service.HashRecoveryCode("FGHJK-78923") };
|
|
var remaining = _service.ConsumeRecoveryCode("abcde 23456", hashes);
|
|
|
|
Assert.NotNull(remaining);
|
|
Assert.Single(remaining);
|
|
Assert.Null(_service.ConsumeRecoveryCode("ABCDE-23456", remaining));
|
|
}
|
|
}
|