sessiontest

Documentation

Overview

Package sessiontest checks a SessionStore against the contract every session store must keep, so a custom store proves itself with one call rather than by finding out in production which rule it broke. The core's SQL and memory stores and contrib/redis all run it.

It imports only the standard library and the core, so a store's own tests can use it whatever else they depend on.

Index

• func Run(t *testing.T, open func(t *testing.T) auth.SessionStore)
• func RunCache(t *testing.T, open func(t *testing.T) auth.SessionCache)
• func RunRevocations(t *testing.T, open func(t *testing.T) auth.SessionRevocations)
• type T

Functions

func Run

func Run(t *testing.T, open func(t *testing.T) auth.SessionStore)

Run checks the store that open returns. open is called once per case, so every case starts empty; a store backed by a shared server should return a store with a fresh key prefix or a cleared keyspace each time.

func RunCache

func RunCache(t *testing.T, open func(t *testing.T) auth.SessionCache)

RunCache checks the SessionCache that open returns against the contract every cache must keep, whether it holds entries on the server (memory, Redis: Put returns "") or hands the client a copy (the sealed snapshot, the jwt plugin's signed snapshot: Put returns the value). open is called once per case. The core's caches, contrib/redis and plugin/jwt run it.

The rules: an entry comes back whole (every session and user field) for the token it was put for and no other; it is used before its expiry and never at or after it; a client copy that was changed, truncated or made up is a miss, never an error, so the request falls back to the store; a server-side entry is forgotten by Drop; a cache that implements auth.SessionCacheUserDropper forgets every entry of one user, and only that user's, on DropUser.

func RunRevocations

func RunRevocations(t *testing.T, open func(t *testing.T) auth.SessionRevocations)

RunRevocations checks the SessionRevocations that open returns against the contract every revocation list must keep. open is called once per case, so every case starts empty; a list on a shared server returns one with a fresh key prefix. The core's memory list and contrib/redis run it.

The rules: a revoked id is reported revoked until its instant and never at or after it, judged by the time the core passes, not a clock of the list's own; an id never revoked is not; revoking one id leaves every other alone; revoking again with a later instant extends the entry and with an earlier one never shortens it.

Types

type T

type T interface {
	Fatal(args ...any)
	Fatalf(format string, args ...any)
}

T is the part of testing.T a case uses. An interface so the suite's own tests can run a case against a store that breaks a rule and read the failure, which is how the suite proves it would catch that rule.