promptjuggler-go-sdk/webhooks_test.go at main · motleyhand/promptjuggler-go-sdk · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
package promptjuggler_test

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"strconv"
	"testing"

	promptjuggler "go.promptjuggler.com/sdk"
)

const (
	webhookSecret  = "whsec_test"
	webhookPayload = `{"event":"promptrun.finished","id":"run1"}`
	webhookTS      = int64(1_700_000_000)
)

func signHeader(payload, secret string, ts int64) string {
	mac := hmac.New(sha256.New, []byte(secret))
	mac.Write([]byte(strconv.FormatInt(ts, 10) + "." + payload))
	return "t=" + strconv.FormatInt(ts, 10) + ",v1=" + hex.EncodeToString(mac.Sum(nil))
}

func TestVerifyAcceptsCorrectSignature(t *testing.T) {
	if !promptjuggler.VerifyWebhookSignatureAt(
		webhookPayload,
		signHeader(webhookPayload, webhookSecret, webhookTS),
		webhookSecret,
		300,
		webhookTS,
	) {
		t.Error("expected valid signature to verify")
	}
}

func TestVerifyRejectsTamperedPayload(t *testing.T) {
	if promptjuggler.VerifyWebhookSignatureAt(
		webhookPayload+" ",
		signHeader(webhookPayload, webhookSecret, webhookTS),
		webhookSecret,
		300,
		webhookTS,
	) {
		t.Error("expected tampered payload to be rejected")
	}
}

func TestVerifyRejectsWrongSecret(t *testing.T) {
	if promptjuggler.VerifyWebhookSignatureAt(
		webhookPayload,
		signHeader(webhookPayload, webhookSecret, webhookTS),
		"whsec_wrong",
		300,
		webhookTS,
	) {
		t.Error("expected wrong secret to be rejected")
	}
}

func TestVerifyRejectsExpiredTimestamp(t *testing.T) {
	if promptjuggler.VerifyWebhookSignatureAt(
		webhookPayload,
		signHeader(webhookPayload, webhookSecret, webhookTS),
		webhookSecret,
		300,
		webhookTS+301,
	) {
		t.Error("expected expired timestamp to be rejected")
	}
}

func TestVerifyAcceptsTimestampAtEdge(t *testing.T) {
	if !promptjuggler.VerifyWebhookSignatureAt(
		webhookPayload,
		signHeader(webhookPayload, webhookSecret, webhookTS),
		webhookSecret,
		300,
		webhookTS+300,
	) {
		t.Error("expected timestamp at the tolerance edge to verify")
	}
}

func TestVerifyRejectsMalformedHeader(t *testing.T) {
	if promptjuggler.VerifyWebhookSignatureAt(
		webhookPayload,
		"not-a-signature",
		webhookSecret,
		300,
		webhookTS,
	) {
		t.Error("expected malformed header to be rejected")
	}
}

func TestVerifyRejectsEmptyHeader(t *testing.T) {
	if promptjuggler.VerifyWebhookSignature(webhookPayload, "", webhookSecret) {
		t.Error("expected empty header to be rejected")
	}
}