24 lines
788 B
Go
24 lines
788 B
Go
|
package voiceprovider
|
||
|
|
|
||
|
|
import (
|
||
|
|
"testing"
|
||
|
|
"time"
|
||
|
|
)
|
||
|
|
|
||
|
|
func TestCallbackSignatureBindsTimestampAndBody(t *testing.T) {
|
||
|
|
secret := []byte("01234567890123456789012345678901")
|
||
|
|
now := time.Date(2026, 8, 23, 12, 0, 0, 0, time.UTC)
|
||
|
|
timestamp := now.Format(time.RFC3339)
|
||
|
|
body := []byte(`{"event":"started"}`)
|
||
|
|
signature := SignCallback(secret, timestamp, body)
|
||
|
|
if err := VerifyCallback(secret, timestamp, signature, body, now, time.Minute); err != nil {
|
||
|
|
t.Fatal(err)
|
||
|
|
}
|
||
|
|
if err := VerifyCallback(secret, timestamp, signature, append(body, ' '), now, time.Minute); err == nil {
|
||
|
|
t.Fatal("tampered callback body was accepted")
|
||
|
|
}
|
||
|
|
if err := VerifyCallback(secret, timestamp, signature, body, now.Add(2*time.Minute), time.Minute); err == nil {
|
||
|
|
t.Fatal("expired callback was accepted")
|
||
|
|
}
|
||
|
|
}
|