feat(muxterm): WebSocket server with HMAC token auth and PTY relay

muxterm/ws_test.go

@@ -0,0 +1,171 @@
+package main
+
+import (
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/gorilla/websocket"
+)
+
+// makeToken creates a valid HMAC-SHA256 token: sig.timestamp
+func makeToken(secret string, ts int64) string {
+	tsStr := fmt.Sprintf("%d", ts)
+	mac := hmac.New(sha256.New, []byte(secret))
+	mac.Write([]byte(tsStr))
+	sig := hex.EncodeToString(mac.Sum(nil))
+	return sig + "." + tsStr
+}
+
+func TestValidateToken_ValidToken(t *testing.T) {
+	secret := "test-secret"
+	ts := time.Now().Unix()
+	token := makeToken(secret, ts)
+
+	if !ValidateToken(token, secret, 30) {
+		t.Error("expected valid token to pass validation")
+	}
+}
+
+func TestValidateToken_ExpiredToken(t *testing.T) {
+	secret := "test-secret"
+	ts := time.Now().Unix() - 60 // 60 seconds ago, TTL is 30
+	token := makeToken(secret, ts)
+
+	if ValidateToken(token, secret, 30) {
+		t.Error("expected expired token to fail validation")
+	}
+}
+
+func TestValidateToken_FutureToken_WithinSkew(t *testing.T) {
+	secret := "test-secret"
+	ts := time.Now().Unix() + 3 // 3 seconds in future, within 5s skew
+	token := makeToken(secret, ts)
+
+	if !ValidateToken(token, secret, 30) {
+		t.Error("expected near-future token within clock skew to pass")
+	}
+}
+
+func TestValidateToken_FutureToken_BeyondSkew(t *testing.T) {
+	secret := "test-secret"
+	ts := time.Now().Unix() + 10 // 10 seconds in future, beyond 5s skew
+	token := makeToken(secret, ts)
+
+	if ValidateToken(token, secret, 30) {
+		t.Error("expected far-future token beyond clock skew to fail")
+	}
+}
+
+func TestValidateToken_BadSignature(t *testing.T) {
+	ts := time.Now().Unix()
+	token := makeToken("right-secret", ts)
+
+	if ValidateToken(token, "wrong-secret", 30) {
+		t.Error("expected wrong secret to fail validation")
+	}
+}
+
+func TestValidateToken_MalformedToken(t *testing.T) {
+	if ValidateToken("not-a-valid-token", "secret", 30) {
+		t.Error("expected malformed token (no dot) to fail")
+	}
+	if ValidateToken("abc.def", "secret", 30) {
+		t.Error("expected non-numeric timestamp to fail")
+	}
+	if ValidateToken("", "secret", 30) {
+		t.Error("expected empty token to fail")
+	}
+}
+
+func TestHandleWebSocket_RejectsNoToken(t *testing.T) {
+	pool := NewPool()
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		HandleWebSocket(pool, "test-secret", w, r)
+	}))
+	defer server.Close()
+
+	// Try to connect without a token
+	wsURL := "ws" + strings.TrimPrefix(server.URL, "http") + "?token="
+	_, resp, err := websocket.DefaultDialer.Dial(wsURL, nil)
+	if err == nil {
+		t.Error("expected connection to fail without valid token")
+	}
+	if resp != nil && resp.StatusCode != http.StatusForbidden {
+		t.Errorf("expected 403 Forbidden, got %d", resp.StatusCode)
+	}
+}
+
+func TestHandleWebSocket_RejectsExpiredToken(t *testing.T) {
+	pool := NewPool()
+	secret := "test-secret"
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		HandleWebSocket(pool, secret, w, r)
+	}))
+	defer server.Close()
+
+	ts := time.Now().Unix() - 60
+	token := makeToken(secret, ts)
+	wsURL := "ws" + strings.TrimPrefix(server.URL, "http") + "?token=" + token
+	_, resp, err := websocket.DefaultDialer.Dial(wsURL, nil)
+	if err == nil {
+		t.Error("expected connection to fail with expired token")
+	}
+	if resp != nil && resp.StatusCode != http.StatusForbidden {
+		t.Errorf("expected 403 Forbidden, got %d", resp.StatusCode)
+	}
+}
+
+func TestHandleWebSocket_AcceptsValidToken(t *testing.T) {
+	pool := NewPool()
+	secret := "test-secret"
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		HandleWebSocket(pool, secret, w, r)
+	}))
+	defer server.Close()
+
+	ts := time.Now().Unix()
+	token := makeToken(secret, ts)
+	wsURL := "ws" + strings.TrimPrefix(server.URL, "http") + "?token=" + token
+	conn, _, err := websocket.DefaultDialer.Dial(wsURL, nil)
+	if err != nil {
+		t.Fatalf("expected connection to succeed with valid token, got: %v", err)
+	}
+	defer conn.Close()
+}
+
+func TestHandleWebSocket_DetachMessage(t *testing.T) {
+	pool := NewPool()
+	secret := "test-secret"
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		HandleWebSocket(pool, secret, w, r)
+	}))
+	defer server.Close()
+
+	ts := time.Now().Unix()
+	token := makeToken(secret, ts)
+	wsURL := "ws" + strings.TrimPrefix(server.URL, "http") + "?token=" + token
+	conn, _, err := websocket.DefaultDialer.Dial(wsURL, nil)
+	if err != nil {
+		t.Fatalf("expected connection to succeed, got: %v", err)
+	}
+	defer conn.Close()
+
+	// Send detach - should not crash, just clear state
+	err = conn.WriteMessage(websocket.TextMessage, []byte(`{"detach":true}`))
+	if err != nil {
+		t.Fatalf("failed to send detach message: %v", err)
+	}
+}
+
+func TestSendSIGWINCH_NilProcess(t *testing.T) {
+	// Should not panic with nil Cmd or nil Process
+	sess := &Session{}
+	sendSIGWINCH(sess) // should not panic
+}