1 files changed, 127 insertions, 9 deletions

diff --git a/activesupport/test/message_verifier_test.rb b/activesupport/test/message_verifier_test.rb
index 668d78492e..05d5c1cbc3 100644
--- a/activesupport/test/message_verifier_test.rb
+++ b/activesupport/test/message_verifier_test.rb
@@ -1,10 +1,12 @@
-require 'abstract_unit'
-require 'openssl'
-require 'active_support/time'
-require 'active_support/json'
+# frozen_string_literal: true
 
-class MessageVerifierTest < ActiveSupport::TestCase
+require "abstract_unit"
+require "openssl"
+require "active_support/time"
+require "active_support/json"
+require_relative "metadata/shared_metadata_tests"
 
+class MessageVerifierTest < ActiveSupport::TestCase
   class JSONSerializer
     def dump(value)
       ActiveSupport::JSON.encode(value)
@@ -17,7 +19,8 @@ class MessageVerifierTest < ActiveSupport::TestCase
 
   def setup
     @verifier = ActiveSupport::MessageVerifier.new("Hey, I'm a secret!")
-    @data = { :some => "data", :now => Time.local(2010) }
+    @data = { some: "data", now: Time.utc(2010) }
+    @secret = SecureRandom.random_bytes(32)
   end
 
   def test_valid_message
@@ -49,8 +52,8 @@ class MessageVerifierTest < ActiveSupport::TestCase
   def test_alternative_serialization_method
     prev = ActiveSupport.use_standard_json_time_format
     ActiveSupport.use_standard_json_time_format = true
-    verifier = ActiveSupport::MessageVerifier.new("Hey, I'm a secret!", :serializer => JSONSerializer.new)
-    message = verifier.generate({ :foo => 123, 'bar' => Time.utc(2010) })
+    verifier = ActiveSupport::MessageVerifier.new("Hey, I'm a secret!", serializer: JSONSerializer.new)
+    message = verifier.generate(:foo => 123, "bar" => Time.utc(2010))
     exp = { "foo" => 123, "bar" => "2010-01-01T00:00:00.000Z" }
     assert_equal exp, verifier.verified(message)
     assert_equal exp, verifier.verify(message)
@@ -81,6 +84,121 @@ class MessageVerifierTest < ActiveSupport::TestCase
     exception = assert_raise(ArgumentError) do
       ActiveSupport::MessageVerifier.new(nil)
     end
-    assert_equal exception.message, 'Secret should not be nil.'
+    assert_equal "Secret should not be nil.", exception.message
+  end
+
+  def test_backward_compatibility_messages_signed_without_metadata
+    signed_message = "BAh7BzoJc29tZUkiCWRhdGEGOgZFVDoIbm93SXU6CVRpbWUNIIAbgAAAAAAHOgtvZmZzZXRpADoJem9uZUkiCFVUQwY7BkY=--d03c52c91dfe4ccc5159417c660461bcce005e96"
+    assert_equal @data, @verifier.verify(signed_message)
+  end
+
+  def test_rotating_secret
+    old_message = ActiveSupport::MessageVerifier.new("old", digest: "SHA1").generate("old")
+
+    verifier = ActiveSupport::MessageVerifier.new(@secret, digest: "SHA1")
+    verifier.rotate "old"
+
+    assert_equal "old", verifier.verified(old_message)
   end
+
+  def test_multiple_rotations
+    old_message   = ActiveSupport::MessageVerifier.new("old", digest: "SHA256").generate("old")
+    older_message = ActiveSupport::MessageVerifier.new("older", digest: "SHA1").generate("older")
+
+    verifier = ActiveSupport::MessageVerifier.new(@secret, digest: "SHA512")
+    verifier.rotate "old",   digest: "SHA256"
+    verifier.rotate "older", digest: "SHA1"
+
+    assert_equal "new",   verifier.verified(verifier.generate("new"))
+    assert_equal "old",   verifier.verified(old_message)
+    assert_equal "older", verifier.verified(older_message)
+  end
+
+  def test_on_rotation_is_called_and_verified_returns_message
+    older_message = ActiveSupport::MessageVerifier.new("older", digest: "SHA1").generate(encoded: "message")
+
+    verifier = ActiveSupport::MessageVerifier.new(@secret, digest: "SHA512")
+    verifier.rotate "old",   digest: "SHA256"
+    verifier.rotate "older", digest: "SHA1"
+
+    rotated = false
+    message = verifier.verified(older_message, on_rotation: proc { rotated = true })
+
+    assert_equal({ encoded: "message" }, message)
+    assert rotated
+  end
+
+  def test_rotations_with_metadata
+    old_message = ActiveSupport::MessageVerifier.new("old").generate("old", purpose: :rotation)
+
+    verifier = ActiveSupport::MessageVerifier.new(@secret)
+    verifier.rotate "old"
+
+    assert_equal "old", verifier.verified(old_message, purpose: :rotation)
+  end
+end
+
+class MessageVerifierMetadataTest < ActiveSupport::TestCase
+  include SharedMessageMetadataTests
+
+  setup do
+    @verifier = ActiveSupport::MessageVerifier.new("Hey, I'm a secret!", verifier_options)
+  end
+
+  def test_verify_raises_when_purpose_differs
+    assert_raise(ActiveSupport::MessageVerifier::InvalidSignature) do
+      @verifier.verify(generate(data, purpose: "payment"), purpose: "shipping")
+    end
+  end
+
+  def test_verify_raises_when_expired
+    signed_message = generate(data, expires_in: 1.month)
+
+    travel 2.months
+    assert_raise(ActiveSupport::MessageVerifier::InvalidSignature) do
+      @verifier.verify(signed_message)
+    end
+  end
+
+  private
+    def generate(message, **options)
+      @verifier.generate(message, options)
+    end
+
+    def parse(message, **options)
+      @verifier.verified(message, options)
+    end
+
+    def verifier_options
+      Hash.new
+    end
+end
+
+class MessageVerifierMetadataMarshalTest < MessageVerifierMetadataTest
+  private
+    def verifier_options
+      { serializer: Marshal }
+    end
+end
+
+class MessageVerifierMetadataJSONTest < MessageVerifierMetadataTest
+  private
+    def verifier_options
+      { serializer: MessageVerifierTest::JSONSerializer.new }
+    end
+end
+
+class MessageEncryptorMetadataNullSerializerTest < MessageVerifierMetadataTest
+  private
+    def data
+      "string message"
+    end
+
+    def null_serializing?
+      true
+    end
+
+    def verifier_options
+      { serializer: ActiveSupport::MessageEncryptor::NullSerializer }
+    end
 end