Feature/signing plugin (#402)
* test commit * delete test commit * signing plugin - changes for review * Initial commit : beckn Signing Plugin Module * Added verification plugin post review discussion with leads below changes are made 1. Commented out the signature expiration validation code for both the signing and verification plugins. will update it based on the confirmation. * Create signing_plugin_test.go Added Test Cases for Signing Plugin * Signing and Verification Plugin Added signing plugin and verification plugin with the unit test cases, achieving the following code coverage Signing Plugin : 91.9% Verification Plugin : 92.3% * Added plugin.go to handle the dynamic loading and usage of the plugin implementation * Update the code to meet the linting standards * Added Test Cases for plugin.go 1.Added test cases for plugin.go for both signer and verifier. 2.Added new Function Close to release the resources (mock implementation) 3.Fixed camelCase Issue. * Updated the code coverage for signing plugin Raised code coverage from 85 to 92 for signing plugin * Changes for review Comments 1. updated directory names from Signer to signer 2. Updated Verifier plugin to take header value 3. Updated the config to use a pointer in the signing plugin * Updated directory name for signer and verifier * Removed the Duplicate directories Signer and Verifier * Updated the code to pass the timestamp as a parameter for the signing plugin * Updates on the review comments * Update on the Review Comments * Test commit for code coverage * Update on the review Comments 1. Renaming of NewSigner to New 2. Removed of .so files. 3. Removed external libraries. * Test commit for code coverage * udpate as per the golint standards * update on the code review comments 1. Rename of Validator to Verifier 2. Removed as a pointer for plugins 3. comment updated for Signer * Test Commit for the code coverage * test commit for code coverage * test commit for code coverage * test commit for code coverage * updated code on review comments * update on review comments * update on review comments --------- Co-authored-by: mohit3367 <mohitkatare4@gmail.com>
This commit is contained in:
MohitKatare-protean
committed by
GitHub
GitHub
parent
b0c827fbd4
commit
9722c3bf68
26
shared/plugin/implementation/signVerifier/cmd/plugin.go
Normal file
26
shared/plugin/implementation/signVerifier/cmd/plugin.go
Normal file
@@ -0,0 +1,26 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
|
||||
"github.com/beckn/beckn-onix/shared/plugin/definition"
|
||||
|
||||
plugin "github.com/beckn/beckn-onix/shared/plugin/definition"
|
||||
verifier "github.com/beckn/beckn-onix/shared/plugin/implementation/signVerifier"
|
||||
)
|
||||
|
||||
// VerifierProvider provides instances of Verifier.
|
||||
type VerifierProvider struct{}
|
||||
|
||||
// New initializes a new Verifier instance.
|
||||
func (vp VerifierProvider) New(ctx context.Context, config map[string]string) (plugin.Verifier, func() error, error) {
|
||||
if ctx == nil {
|
||||
return nil, nil, errors.New("context cannot be nil")
|
||||
}
|
||||
|
||||
return verifier.New(ctx, &verifier.Config{})
|
||||
}
|
||||
|
||||
// Provider is the exported symbol that the plugin manager will look for.
|
||||
var Provider definition.VerifierProvider = VerifierProvider{}
|
||||
89
shared/plugin/implementation/signVerifier/cmd/plugin_test.go
Normal file
89
shared/plugin/implementation/signVerifier/cmd/plugin_test.go
Normal file
@@ -0,0 +1,89 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"testing"
|
||||
)
|
||||
|
||||
// TestVerifierProviderSuccess tests successful creation of a verifier.
|
||||
func TestVerifierProviderSuccess(t *testing.T) {
|
||||
provider := VerifierProvider{}
|
||||
|
||||
tests := []struct {
|
||||
name string
|
||||
ctx context.Context
|
||||
config map[string]string
|
||||
}{
|
||||
{
|
||||
name: "Successful creation",
|
||||
ctx: context.Background(),
|
||||
config: map[string]string{},
|
||||
},
|
||||
{
|
||||
name: "Nil context",
|
||||
ctx: context.TODO(),
|
||||
config: map[string]string{},
|
||||
},
|
||||
{
|
||||
name: "Empty config",
|
||||
ctx: context.Background(),
|
||||
config: map[string]string{},
|
||||
},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
verifier, close, err := provider.New(tt.ctx, tt.config)
|
||||
|
||||
if err != nil {
|
||||
t.Fatalf("Expected no error, but got: %v", err)
|
||||
}
|
||||
if verifier == nil {
|
||||
t.Fatal("Expected verifier instance to be non-nil")
|
||||
}
|
||||
if close != nil {
|
||||
if err := close(); err != nil {
|
||||
t.Fatalf("Test %q failed: cleanup function returned an error: %v", tt.name, err)
|
||||
}
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// TestVerifierProviderFailure tests cases where verifier creation should fail.
|
||||
func TestVerifierProviderFailure(t *testing.T) {
|
||||
provider := VerifierProvider{}
|
||||
|
||||
tests := []struct {
|
||||
name string
|
||||
ctx context.Context
|
||||
config map[string]string
|
||||
wantErr bool
|
||||
}{
|
||||
{
|
||||
name: "Nil context failure",
|
||||
ctx: nil,
|
||||
config: map[string]string{},
|
||||
wantErr: true,
|
||||
},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
verifierInstance, close, err := provider.New(tt.ctx, tt.config)
|
||||
|
||||
if (err != nil) != tt.wantErr {
|
||||
t.Fatalf("Expected error: %v, but got: %v", tt.wantErr, err)
|
||||
}
|
||||
if verifierInstance != nil {
|
||||
t.Fatal("Expected verifier instance to be nil")
|
||||
}
|
||||
if close != nil {
|
||||
if err := close(); err != nil {
|
||||
t.Fatalf("Test %q failed: cleanup function returned an error: %v", tt.name, err)
|
||||
}
|
||||
}
|
||||
|
||||
})
|
||||
}
|
||||
}
|
||||
120
shared/plugin/implementation/signVerifier/signVerifier.go
Normal file
120
shared/plugin/implementation/signVerifier/signVerifier.go
Normal file
@@ -0,0 +1,120 @@
|
||||
package verifier
|
||||
|
||||
import (
|
||||
"context"
|
||||
"crypto/ed25519"
|
||||
"encoding/base64"
|
||||
"fmt"
|
||||
"strconv"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"golang.org/x/crypto/blake2b"
|
||||
)
|
||||
|
||||
// Config struct for Verifier.
|
||||
type Config struct {
|
||||
}
|
||||
|
||||
// Verifier implements the Verifier interface.
|
||||
type Verifier struct {
|
||||
config *Config
|
||||
}
|
||||
|
||||
// New creates a new Verifier instance.
|
||||
func New(ctx context.Context, config *Config) (*Verifier, func() error, error) {
|
||||
v := &Verifier{config: config}
|
||||
|
||||
return v, v.Close, nil
|
||||
}
|
||||
|
||||
// Verify checks the signature for the given payload and public key.
|
||||
func (v *Verifier) Verify(ctx context.Context, body []byte, header []byte, publicKeyBase64 string) (bool, error) {
|
||||
createdTimestamp, expiredTimestamp, signature, err := parseAuthHeader(string(header))
|
||||
if err != nil {
|
||||
// TODO: Return appropriate error code when Error Code Handling Module is ready
|
||||
return false, fmt.Errorf("error parsing header: %w", err)
|
||||
}
|
||||
|
||||
signatureBytes, err := base64.StdEncoding.DecodeString(signature)
|
||||
if err != nil {
|
||||
// TODO: Return appropriate error code when Error Code Handling Module is ready
|
||||
return false, fmt.Errorf("error decoding signature: %w", err)
|
||||
}
|
||||
|
||||
currentTime := time.Now().Unix()
|
||||
if createdTimestamp > currentTime || currentTime > expiredTimestamp {
|
||||
// TODO: Return appropriate error code when Error Code Handling Module is ready
|
||||
return false, fmt.Errorf("signature is expired or not yet valid")
|
||||
}
|
||||
|
||||
createdTime := time.Unix(createdTimestamp, 0)
|
||||
expiredTime := time.Unix(expiredTimestamp, 0)
|
||||
|
||||
signingString := hash(body, createdTime.Unix(), expiredTime.Unix())
|
||||
|
||||
decodedPublicKey, err := base64.StdEncoding.DecodeString(publicKeyBase64)
|
||||
if err != nil {
|
||||
// TODO: Return appropriate error code when Error Code Handling Module is ready
|
||||
return false, fmt.Errorf("error decoding public key: %w", err)
|
||||
}
|
||||
|
||||
if !ed25519.Verify(ed25519.PublicKey(decodedPublicKey), []byte(signingString), signatureBytes) {
|
||||
// TODO: Return appropriate error code when Error Code Handling Module is ready
|
||||
return false, fmt.Errorf("signature verification failed")
|
||||
}
|
||||
|
||||
return true, nil
|
||||
}
|
||||
|
||||
// parseAuthHeader extracts signature values from the Authorization header.
|
||||
func parseAuthHeader(header string) (int64, int64, string, error) {
|
||||
header = strings.TrimPrefix(header, "Signature ")
|
||||
|
||||
parts := strings.Split(header, ",")
|
||||
signatureMap := make(map[string]string)
|
||||
|
||||
for _, part := range parts {
|
||||
keyValue := strings.SplitN(strings.TrimSpace(part), "=", 2)
|
||||
if len(keyValue) == 2 {
|
||||
key := strings.TrimSpace(keyValue[0])
|
||||
value := strings.Trim(keyValue[1], "\"")
|
||||
signatureMap[key] = value
|
||||
}
|
||||
}
|
||||
|
||||
createdTimestamp, err := strconv.ParseInt(signatureMap["created"], 10, 64)
|
||||
if err != nil {
|
||||
// TODO: Return appropriate error code when Error Code Handling Module is ready
|
||||
return 0, 0, "", fmt.Errorf("invalid created timestamp: %w", err)
|
||||
}
|
||||
|
||||
expiredTimestamp, err := strconv.ParseInt(signatureMap["expires"], 10, 64)
|
||||
if err != nil {
|
||||
// TODO: Return appropriate error code when Error Code Handling Module is ready
|
||||
return 0, 0, "", fmt.Errorf("invalid expires timestamp: %w", err)
|
||||
}
|
||||
|
||||
signature := signatureMap["signature"]
|
||||
if signature == "" {
|
||||
// TODO: Return appropriate error code when Error Code Handling Module is ready
|
||||
return 0, 0, "", fmt.Errorf("signature missing in header")
|
||||
}
|
||||
|
||||
return createdTimestamp, expiredTimestamp, signature, nil
|
||||
}
|
||||
|
||||
// hash constructs a signing string for verification.
|
||||
func hash(payload []byte, createdTimestamp, expiredTimestamp int64) string {
|
||||
hasher, _ := blake2b.New512(nil)
|
||||
hasher.Write(payload)
|
||||
hashSum := hasher.Sum(nil)
|
||||
digestB64 := base64.StdEncoding.EncodeToString(hashSum)
|
||||
|
||||
return fmt.Sprintf("(created): %d\n(expires): %d\ndigest: BLAKE-512=%s", createdTimestamp, expiredTimestamp, digestB64)
|
||||
}
|
||||
|
||||
// Close releases resources (mock implementation returning nil).
|
||||
func (v *Verifier) Close() error {
|
||||
return nil
|
||||
}
|
||||
153
shared/plugin/implementation/signVerifier/signVerifier_test.go
Normal file
153
shared/plugin/implementation/signVerifier/signVerifier_test.go
Normal file
@@ -0,0 +1,153 @@
|
||||
package verifier
|
||||
|
||||
import (
|
||||
"context"
|
||||
"crypto/ed25519"
|
||||
"encoding/base64"
|
||||
"strconv"
|
||||
"testing"
|
||||
"time"
|
||||
)
|
||||
|
||||
// generateTestKeyPair generates a new ED25519 key pair for testing.
|
||||
func generateTestKeyPair() (string, string) {
|
||||
publicKey, privateKey, _ := ed25519.GenerateKey(nil)
|
||||
return base64.StdEncoding.EncodeToString(privateKey), base64.StdEncoding.EncodeToString(publicKey)
|
||||
}
|
||||
|
||||
// signTestData creates a valid signature for test cases.
|
||||
func signTestData(privateKeyBase64 string, body []byte, createdAt, expiresAt int64) string {
|
||||
privateKeyBytes, _ := base64.StdEncoding.DecodeString(privateKeyBase64)
|
||||
privateKey := ed25519.PrivateKey(privateKeyBytes)
|
||||
|
||||
signingString := hash(body, createdAt, expiresAt)
|
||||
signature := ed25519.Sign(privateKey, []byte(signingString))
|
||||
|
||||
return base64.StdEncoding.EncodeToString(signature)
|
||||
}
|
||||
|
||||
// TestVerifySuccessCases tests all valid signature verification cases.
|
||||
func TestVerifySuccess(t *testing.T) {
|
||||
privateKeyBase64, publicKeyBase64 := generateTestKeyPair()
|
||||
|
||||
tests := []struct {
|
||||
name string
|
||||
body []byte
|
||||
createdAt int64
|
||||
expiresAt int64
|
||||
}{
|
||||
{
|
||||
name: "Valid Signature",
|
||||
body: []byte("Test Payload"),
|
||||
createdAt: time.Now().Unix(),
|
||||
expiresAt: time.Now().Unix() + 3600,
|
||||
},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
signature := signTestData(privateKeyBase64, tt.body, tt.createdAt, tt.expiresAt)
|
||||
header := `Signature created="` + strconv.FormatInt(tt.createdAt, 10) +
|
||||
`", expires="` + strconv.FormatInt(tt.expiresAt, 10) +
|
||||
`", signature="` + signature + `"`
|
||||
|
||||
verifier, close, _ := New(context.Background(), &Config{})
|
||||
valid, err := verifier.Verify(context.Background(), tt.body, []byte(header), publicKeyBase64)
|
||||
|
||||
if err != nil {
|
||||
t.Fatalf("Expected no error, but got: %v", err)
|
||||
}
|
||||
if !valid {
|
||||
t.Fatal("Expected signature verification to succeed")
|
||||
}
|
||||
if close != nil {
|
||||
if err := close(); err != nil {
|
||||
t.Fatalf("Test %q failed: cleanup function returned an error: %v", tt.name, err)
|
||||
}
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// TestVerifyFailureCases tests all invalid signature verification cases.
|
||||
func TestVerifyFailure(t *testing.T) {
|
||||
privateKeyBase64, publicKeyBase64 := generateTestKeyPair()
|
||||
_, wrongPublicKeyBase64 := generateTestKeyPair()
|
||||
|
||||
tests := []struct {
|
||||
name string
|
||||
body []byte
|
||||
header string
|
||||
pubKey string
|
||||
}{
|
||||
{
|
||||
name: "Missing Authorization Header",
|
||||
body: []byte("Test Payload"),
|
||||
header: "",
|
||||
pubKey: publicKeyBase64,
|
||||
},
|
||||
{
|
||||
name: "Malformed Header",
|
||||
body: []byte("Test Payload"),
|
||||
header: `InvalidSignature created="wrong"`,
|
||||
pubKey: publicKeyBase64,
|
||||
},
|
||||
{
|
||||
name: "Invalid Base64 Signature",
|
||||
body: []byte("Test Payload"),
|
||||
header: `Signature created="` + strconv.FormatInt(time.Now().Unix(), 10) +
|
||||
`", expires="` + strconv.FormatInt(time.Now().Unix()+3600, 10) +
|
||||
`", signature="!!INVALIDBASE64!!"`,
|
||||
pubKey: publicKeyBase64,
|
||||
},
|
||||
{
|
||||
name: "Expired Signature",
|
||||
body: []byte("Test Payload"),
|
||||
header: `Signature created="` + strconv.FormatInt(time.Now().Unix()-7200, 10) +
|
||||
`", expires="` + strconv.FormatInt(time.Now().Unix()-3600, 10) +
|
||||
`", signature="` + signTestData(privateKeyBase64, []byte("Test Payload"), time.Now().Unix()-7200, time.Now().Unix()-3600) + `"`,
|
||||
pubKey: publicKeyBase64,
|
||||
},
|
||||
{
|
||||
name: "Invalid Public Key",
|
||||
body: []byte("Test Payload"),
|
||||
header: `Signature created="` + strconv.FormatInt(time.Now().Unix(), 10) +
|
||||
`", expires="` + strconv.FormatInt(time.Now().Unix()+3600, 10) +
|
||||
`", signature="` + signTestData(privateKeyBase64, []byte("Test Payload"), time.Now().Unix(), time.Now().Unix()+3600) + `"`,
|
||||
pubKey: wrongPublicKeyBase64,
|
||||
},
|
||||
{
|
||||
name: "Invalid Expires Timestamp",
|
||||
body: []byte("Test Payload"),
|
||||
header: `Signature created="` + strconv.FormatInt(time.Now().Unix(), 10) +
|
||||
`", expires="invalid_timestamp"`,
|
||||
pubKey: publicKeyBase64,
|
||||
},
|
||||
{
|
||||
name: "Signature Missing in Headers",
|
||||
body: []byte("Test Payload"),
|
||||
header: `Signature created="` + strconv.FormatInt(time.Now().Unix(), 10) +
|
||||
`", expires="` + strconv.FormatInt(time.Now().Unix()+3600, 10) + `"`,
|
||||
pubKey: publicKeyBase64,
|
||||
},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
verifier, close, _ := New(context.Background(), &Config{})
|
||||
valid, err := verifier.Verify(context.Background(), tt.body, []byte(tt.header), tt.pubKey)
|
||||
|
||||
if err == nil {
|
||||
t.Fatal("Expected an error but got none")
|
||||
}
|
||||
if valid {
|
||||
t.Fatal("Expected verification to fail")
|
||||
}
|
||||
if close != nil {
|
||||
if err := close(); err != nil {
|
||||
t.Fatalf("Test %q failed: cleanup function returned an error: %v", tt.name, err)
|
||||
}
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user