Harden lease lifecycle durability

internal/authz/authz_test.go

@@ -5,6 +5,8 @@ import (
 	"net/http/httptest"
 	"testing"
 	"time"
+
+	"golang.org/x/crypto/bcrypt"
 )
 
 func TestSurfaceCapabilities(t *testing.T) {
@@ -51,7 +53,9 @@ func TestSystemSurfaceDowngradedByHTTPMiddleware(t *testing.T) {
 // B18: the web UI is a full control plane. A session cookie must be an
 // alternative *presentation* of the Web token, never a widening of it.
 func TestWebSessionCookieGatesControlPathsOnly(t *testing.T) {
-	tokens := map[Surface]string{Web: "secret"}
+	// An empty legacy Web bearer-token slot must not open the browser surface:
+	// providing Sessions means the caller needs a session cookie.
+	tokens := map[Surface]string{}
 	sessions := &Sessions{}
 	h := HTTPWithSessions(tokens, sessions, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(http.StatusOK)
@@ -96,6 +100,28 @@ func TestWebSessionCookieGatesControlPathsOnly(t *testing.T) {
 	}
 }
 
+func TestWebCredentialsAuthenticate(t *testing.T) {
+	hash, err := bcrypt.GenerateFromPassword([]byte("correct horse battery staple"), bcrypt.MinCost)
+	if err != nil {
+		t.Fatal(err)
+	}
+	c := WebCredentials{Username: "operator", PasswordHash: string(hash)}
+	if err := c.Validate(); err != nil {
+		t.Fatalf("Validate: %v", err)
+	}
+	if !c.Authenticate("operator", "correct horse battery staple") {
+		t.Fatal("correct credentials rejected")
+	}
+	for _, attempt := range []struct{ username, password string }{{"operator", "wrong"}, {"other", "correct horse battery staple"}} {
+		if c.Authenticate(attempt.username, attempt.password) {
+			t.Fatalf("invalid credentials accepted: %+v", attempt)
+		}
+	}
+	if err := (WebCredentials{Username: "operator", PasswordHash: "not-a-bcrypt-hash"}).Validate(); err == nil {
+		t.Fatal("invalid bcrypt hash accepted")
+	}
+}
+
 func TestFederationRequestsUseTheirOwnCredentials(t *testing.T) {
 	tokens := map[Surface]string{Web: "web-secret"}
 	h := HTTPWithSessions(tokens, nil, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {