ldc-arcadia-api/tests/Unit/Infra/Adapters/Services/HmacSignatureValidatorImplTest.php

59 lines
2.1 KiB
PHP

<?php
declare(strict_types=1);
namespace Tests\Unit\Infra\Adapters\Services;
use Application\Security\Models\ValueObjects\ClientIdentifier;
use Application\Security\Models\ValueObjects\ClientSecret;
use Application\Security\Models\ValueObjects\Request\HttpMethod;
use Application\Security\Models\ValueObjects\Request\Nonce;
use Application\Security\Models\ValueObjects\Request\Request;
use Application\Security\Models\ValueObjects\Request\RequestSignature;
use Application\Security\Models\ValueObjects\Request\RequestTimestamp;
use DateTimeImmutable;
use DateTimeInterface;
use Infra\Adapters\Services\HmacSignatureValidatorImpl;
use Ramsey\Uuid\Uuid;
use Uri\Rfc3986\Uri;
covers(HmacSignatureValidatorImpl::class);
describe('HmacSignatureValidatorImpl Unit Tests', function (): void {
it('validates a matching HMAC signature', function (): void {
// GIVEN
$validator = new HmacSignatureValidatorImpl();
$secret = new ClientSecret(str_repeat('s', 98));
$identifier = new ClientIdentifier(str_repeat('c', 43));
$timestamp = new DateTimeImmutable('2026-08-17T12:00:00+00:00');
$nonce = new Nonce(Uuid::uuid7());
$uri = new Uri('http://localhost/api/v1/test?b=2&a=1');
$expectedPayload = implode('|', [
'GET',
'/api/v1/test?a=1&b=2',
$timestamp->format(DateTimeInterface::ATOM),
$nonce->value->toString(),
'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855',
]);
$signatureHash = hash_hmac('sha256', $expectedPayload, $secret->value);
$signature = new RequestSignature($signatureHash);
$request = new Request(
uri: $uri,
method: HttpMethod::GET,
bodyHash: null,
signature: $signature,
nonce: $nonce,
identifier: $identifier,
timestamp: new RequestTimestamp($timestamp),
);
// WHEN
$isValid = $validator->validate($request, $secret);
// THEN
expect($isValid)->toBeTrue();
});
});