1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
|
package game
// Login regressions for the off-owner password path: the production entry
// point verifies passwords and hashes new-account passwords on the
// connection goroutine (never the owner), then completes the state
// transition on the owner. The observable login behavior is unchanged.
import (
"crypto/sha256"
"encoding/base64"
"strings"
"testing"
"time"
"thehouseoficarus/internal/net"
"thehouseoficarus/internal/player"
)
// waitForOutput polls the queued session writer until substr appears or the
// deadline passes.
func waitForOutput(t *testing.T, conn *chanConn, substr string) {
t.Helper()
deadline := time.Now().Add(3 * time.Second)
for !conn.Contains(substr) && time.Now().Before(deadline) {
time.Sleep(time.Millisecond)
}
if !conn.Contains(substr) {
t.Fatalf("output %q never arrived; got:\n%s", substr, conn.Bytes())
}
}
// TestLoginThroughServerEntryUsesOffOwnerPathAndUpgradesLegacyHash drives
// the real server entry point (HandleSessionOnOwner) through: legacy-hash
// account creation, a WRONG password attempt, and a correct login that
// rehashes the legacy SHA-256 hash to Argon2id durably.
func TestLoginThroughServerEntryUsesOffOwnerPathAndUpgradesLegacyHash(t *testing.T) {
h := newHarness(t)
h.seedAccount("alice")
h.seedCharacter("alice", "alice")
acc, err := h.g.AccountStore.LoadAccount("alice")
if err != nil {
t.Fatal(err)
}
// Downgrade to a legacy salted SHA-256 hash so the login exercises the
// transparent rehash.
salt := []byte("0123456789abcdef")
sum := sha256.Sum256(append(append([]byte{}, salt...), []byte("pw")...))
acc.PasswordHash = "sha256:" + base64.RawStdEncoding.EncodeToString(salt) + ":" + strings.ToLower(sha256HashHex(sum))
if err := h.g.AccountStore.SaveAccount(acc); err != nil {
t.Fatal(err)
}
conn := newChanConn()
sess := &net.Session{Conn: conn, State: net.StateAccountName}
sess.StartWriter()
lines := make(chan string, 8)
go h.input(sess, lines)
lines <- "alice" // existing account → password prompt (echo off)
lines <- "wrongpw" // rejected, echo restored, back to account name
waitForOutput(t, conn, "Wrong password.")
lines <- "alice" // account name again
lines <- "pw" // correct password through the off-owner path
waitForOutput(t, conn, "Welcome back to Vesta, alice.")
if sess.Account == nil || sess.Account.Name != "alice" || len(sess.Account.Characters) != 1 {
t.Fatalf("login did not complete: %+v", sess.Account)
}
upgraded, err := h.g.AccountStore.LoadAccount("alice")
if err != nil {
t.Fatal(err)
}
if !strings.HasPrefix(upgraded.PasswordHash, "argon2id:") {
t.Errorf("legacy hash not upgraded on login: %s", upgraded.PasswordHash[:12])
}
if !player.CheckPassword("pw", upgraded.PasswordHash) {
t.Error("upgraded hash no longer verifies the password")
}
}
// TestNewAccountThroughServerEntryHashesOffOwner drives account creation
// through the real server entry point.
func TestNewAccountThroughServerEntryHashesOffOwner(t *testing.T) {
h := newHarness(t)
conn := newChanConn()
sess := &net.Session{Conn: conn, State: net.StateAccountName}
sess.StartWriter()
lines := make(chan string, 8)
go h.input(sess, lines)
lines <- "newbie" // unknown name → new-account password prompt
lines <- "hunter2pass"
lines <- "hunter2pw" // mismatch → restart account entry (Account reset)
waitForOutput(t, conn, "Passwords do not match.")
lines <- "newbie" // account name again
lines <- "hunter2pw"
lines <- "hunter2pw"
lines <- "n" // color prompt
waitForOutput(t, conn, "Welcome back to Vesta, newbie.")
created, err := h.g.AccountStore.LoadAccount("newbie")
if err != nil {
t.Fatal(err)
}
if !strings.HasPrefix(created.PasswordHash, "argon2id:") {
t.Errorf("created account did not hash with Argon2id: %s", created.PasswordHash[:12])
}
if !player.CheckPassword("hunter2pw", created.PasswordHash) {
t.Error("created hash does not verify the password")
}
}
// sha256HashHex formats like hex.EncodeToString for the legacy hash check.
func sha256HashHex(sum [32]byte) string {
const hexdigits = "0123456789abcdef"
out := make([]byte, 64)
for i, b := range sum {
out[i*2] = hexdigits[b>>4]
out[i*2+1] = hexdigits[b&0x0f]
}
return string(out)
}
|
