macaroons: reject unknown macaroon versions

We've only ever made macaroons with the v2 versions, so we should
explicitly reject those that aren't actually v2. We add a basic test
along the way, and also add a similar check for the version encoded in
the macaroon ID.
This commit is contained in:
Olaoluwa Osuntokun committed 2023-10-31 13:23:50 -07:00
1 parent c382268201
commit 9287b755d8
5 files changed
+110 -2

No files matched your search

+10
View File
@@ -30,6 +30,8 @@ func createDummyMacaroon(t *testing.T) *macaroon.Macaroon {
// TestAddConstraints tests that constraints can be added to an existing
// macaroon and therefore tighten its restrictions.
func TestAddConstraints(t *testing.T) {
t.Parallel()
// We need a dummy macaroon to start with. Create one without
// a bakery, because we mock everything anyway.
initialMac := createDummyMacaroon(t)
@@ -55,6 +57,8 @@ func TestAddConstraints(t *testing.T) {
// TestTimeoutConstraint tests that a caveat for the lifetime of
// a macaroon is created.
func TestTimeoutConstraint(t *testing.T) {
t.Parallel()
// Get a configured version of the constraint function.
constraintFunc := macaroons.TimeoutConstraint(3)
@@ -79,6 +83,8 @@ func TestTimeoutConstraint(t *testing.T) {
// TestTimeoutConstraint tests that a caveat for the lifetime of
// a macaroon is created.
func TestIpLockConstraint(t *testing.T) {
t.Parallel()
// Get a configured version of the constraint function.
constraintFunc := macaroons.IPLockConstraint("127.0.0.1")
@@ -99,6 +105,8 @@ func TestIpLockConstraint(t *testing.T) {
// TestIPLockBadIP tests that an IP constraint cannot be added if the
// provided string is not a valid IP address.
func TestIPLockBadIP(t *testing.T) {
t.Parallel()
constraintFunc := macaroons.IPLockConstraint("127.0.0/800")
testMacaroon := createDummyMacaroon(t)
err := constraintFunc(testMacaroon)
@@ -110,6 +118,8 @@ func TestIPLockBadIP(t *testing.T) {
// TestCustomConstraint tests that a custom constraint with a name and value can
// be added to a macaroon.
func TestCustomConstraint(t *testing.T) {
t.Parallel()
// Test a custom caveat with a value first.
constraintFunc := macaroons.CustomConstraint("unit-test", "test-value")
testMacaroon := createDummyMacaroon(t)