test(auth): cover representable hmac-secret responses

Dami committed Jul 235bbfd34

Handle the dependency's dual-output HmacSecret2 variant explicitly and replace synthetic byte-slice tests with production-shaped assertion cases.

commit: 5bbfd34688603a986e5a777e89dadd77139f63ff
parent: 62b851816139b4469efafe74324939be63d9958e
author: Dami <dami.etoile@gmail.com>

1 file changed, +44 -21wrap lines

src-tauri/src/commands/auth.rs

++++++++++++++++++++----------

M src-tauri/src/commands/auth.rs +44 -21

@@ -82,8 +82,14 @@ pub fn extract_hmac_secret(assertions: &[Assertion]) -> anyhow::Result<[u8; 32]>
8282     )?;8383 8484     for ext in &assertion.extensions {85-        if let Gext::HmacSecret(Some(output)) = ext {86-            return validate_hmac_secret_output(output);85+        match ext {86+            Gext::HmacSecret(Some(output)) => return Ok(*output),87+            Gext::HmacSecret2(Some(_)) => {88+                anyhow::bail!(89+                    "Security key returned a two-output hmac-secret response (64 bytes); Portal requires exactly one 32-byte output. Reconnect the key or use a compatible FIDO2 key."90+                )91+            }92+            _ => {}8793         }8894     }8995     anyhow::bail!(@@ -91,15 +97,6 @@ pub fn extract_hmac_secret(assertions: &[Assertion]) -> anyhow::Result<[u8; 32]>
9197     )9298 }9399 94-fn validate_hmac_secret_output(output: &[u8]) -> anyhow::Result<[u8; 32]> {95-    output.try_into().map_err(|_| {96-        anyhow::anyhow!(97-            "Security key returned malformed hmac-secret output: expected 32 bytes, received {}. Reconnect the key or try a compatible FIDO2 key.",98-            output.len()99-        )100-    })101-}102-103100 pub fn derive_iroh_secret_from_key(pin: &str) -> anyhow::Result<SecretKey> {104101     let hmac_secret = derive_secret_from_key(pin)?;105102     Ok(portal_client_secret_from_hmac(hmac_secret))@@ -268,16 +265,42 @@ mod tests {
268265     }269266 270267     #[test]271-    fn validate_hmac_secret_output_rejects_non_32_byte_values() {272-        for output in [&[0x2a; 31][..], &[0x2a; 33][..]] {273-            let error =274-                validate_hmac_secret_output(output).expect_err("invalid length must fail closed");275-            assert!(276-                error277-                    .to_string()278-                    .contains(&format!("expected 32 bytes, received {}", output.len()))279-            );280-        }268+    fn extract_hmac_secret_rejects_two_output_response() {269+        let assertion = Assertion {270+            extensions: vec![Gext::HmacSecret2(Some(([0x2a; 32], [0x2b; 32])))],271+            ..Default::default()272+        };273+274+        let error =275+            extract_hmac_secret(&[assertion]).expect_err("two-output response must fail closed");276+        assert_eq!(277+            error.to_string(),278+            "Security key returned a two-output hmac-secret response (64 bytes); Portal requires exactly one 32-byte output. Reconnect the key or use a compatible FIDO2 key."279+        );280+    }281+282+    #[test]283+    fn extract_hmac_secret_rejects_extension_without_output() {284+        let assertion = Assertion {285+            extensions: vec![Gext::HmacSecret(None)],286+            ..Default::default()287+        };288+289+        let error = extract_hmac_secret(&[assertion]).expect_err("absent output must fail closed");290+        assert_eq!(291+            error.to_string(),292+            "Security key assertion did not contain hmac-secret output. Use a compatible FIDO2 key and try again."293+        );294+    }295+296+    #[test]297+    fn extract_hmac_secret_rejects_assertion_without_extension() {298+        let error = extract_hmac_secret(&[Assertion::default()])299+            .expect_err("missing extension must fail closed");300+        assert_eq!(301+            error.to_string(),302+            "Security key assertion did not contain hmac-secret output. Use a compatible FIDO2 key and try again."303+        );281304     }282305 283306     #[test]