chore: establish local platform baseline

2026-08-26 06:41:54 +08:00
commit 29bdf4900f
575 changed files with 95644 additions and 0 deletions
@@ -0,0 +1,88 @@
+package rtc
+
+import (
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/binary"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestVolcengineTokenIssuerProducesSignedScopedDeterministicToken(t *testing.T) {
+	const appID = "661e7ae5543cf00000000000"
+	appKey := "unit-test-" + strings.Repeat("x", 23)
+	issuer, err := NewVolcengineTokenIssuer(appID, appKey, 5*time.Minute)
+	if err != nil {
+		t.Fatal(err)
+	}
+	expiresAt := time.Unix(1_800_000_000, 0).UTC()
+	first, err := issuer.Issue("room-1", "device-1", expiresAt)
+	if err != nil {
+		t.Fatal(err)
+	}
+	second, err := issuer.Issue("room-1", "device-1", expiresAt)
+	if err != nil || second != first {
+		t.Fatalf("idempotent issue mismatch: err=%v equal=%v", err, second == first)
+	}
+	if len(first) <= 27 || first[:27] != "001"+appID {
+		t.Fatalf("unexpected token prefix: %q", first)
+	}
+
+	content, err := base64.StdEncoding.DecodeString(first[27:])
+	if err != nil {
+		t.Fatal(err)
+	}
+	message, rest := readTokenBytes(t, content)
+	signature, rest := readTokenBytes(t, rest)
+	if len(rest) != 0 {
+		t.Fatalf("unexpected trailing token bytes: %d", len(rest))
+	}
+	mac := hmac.New(sha256.New, []byte(appKey))
+	_, _ = mac.Write(message)
+	if !hmac.Equal(signature, mac.Sum(nil)) {
+		t.Fatal("token signature is invalid")
+	}
+
+	offset := 4 // deterministic nonce
+	issuedAt := binary.LittleEndian.Uint32(message[offset : offset+4])
+	offset += 4
+	expires := binary.LittleEndian.Uint32(message[offset : offset+4])
+	offset += 4
+	room, remaining := readTokenBytes(t, message[offset:])
+	user, remaining := readTokenBytes(t, remaining)
+	if string(room) != "room-1" || string(user) != "device-1" || issuedAt != uint32(expiresAt.Add(-5*time.Minute).Unix()) || expires != uint32(expiresAt.Unix()) {
+		t.Fatalf("unexpected token scope room=%s user=%s issued=%d expires=%d", room, user, issuedAt, expires)
+	}
+	if len(remaining) != 2+5*6 || binary.LittleEndian.Uint16(remaining[:2]) != 5 {
+		t.Fatalf("unexpected privileges payload: %x", remaining)
+	}
+	for index, want := range []uint16{0, 1, 2, 3, 4} {
+		position := 2 + index*6
+		if got := binary.LittleEndian.Uint16(remaining[position : position+2]); got != want {
+			t.Fatalf("privilege[%d]=%d want=%d", index, got, want)
+		}
+		if got := binary.LittleEndian.Uint32(remaining[position+2 : position+6]); got != uint32(expiresAt.Unix()) {
+			t.Fatalf("privilege[%d] expiry=%d", index, got)
+		}
+	}
+}
+
+func TestVolcengineTokenIssuerValidatesApplicationIdentity(t *testing.T) {
+	if _, err := NewVolcengineTokenIssuer("short", "0123456789abcdef", time.Minute); err == nil {
+		t.Fatal("expected invalid app ID to be rejected")
+	}
+}
+
+func readTokenBytes(t *testing.T, input []byte) ([]byte, []byte) {
+	t.Helper()
+	if len(input) < 2 {
+		t.Fatal("truncated token field length")
+	}
+	length := int(binary.LittleEndian.Uint16(input[:2]))
+	if len(input) < 2+length {
+		t.Fatal("truncated token field")
+	}
+	return input[2 : 2+length], input[2+length:]
+}