spend-vibes: check the person's token by who it is for, not its string (#380)

OP OpenVibers committed 4 days ago · 12138fdcfc · 1 file, +5 −1

userToken() stamps iat with the current second, so a token minted for the comparison differed from
the one the request carried whenever the second turned between them (Actor #379's CI, 11-09). The
test now checks Network's mock signed it and its subject_id is the person's.

Changes

ddiff --git a/test/spend-vibes.test.js b/test/spend-vibes.test.js
iindex 38d891e..183bae9 100644
---- a/test/spend-vibes.test.js
++++ b/test/spend-vibes.test.js
@@@ -242,7 +242,11 @@ const doneTurn = { content: 'The tip was sent.' };
              assert.strictEqual(res.status, 303, res.text.slice(0, 200));
              assert.strictEqual(tips.calls.length, 1, 'the tip was paid once');
              const call = tips.calls[0];
--            assert.strictEqual(call.auth, `Bearer ${t.network.userToken(ada)}`, 'paid with the person\'s own token');
++            // The person's own token: one Network signed, for this person (a fresh userToken() differs by its iat
++            // whenever the second turns between the two, so compare who it is for, not the string).
++            const [jh, jp, js] = String(call.auth).replace(/^Bearer /, '').split('.');
++            assert.ok(crypto.verify('RSA-SHA256', Buffer.from(`${jh}.${jp}`), t.network.publicPem, Buffer.from(js || '', 'base64url')), 'a token Network signed');
++            assert.strictEqual(JSON.parse(Buffer.from(jp, 'base64url').toString('utf8')).subject_id, ada.subject, 'paid with the person\'s own token');
              assert.strictEqual(call.key, ask.id, 'the approval id is the idempotency key');
              assert.strictEqual(call.contentType, 'application/json');
              assert.deepStrictEqual(call.body, { creator, amount: 12, message: 'thanks for the stream', pay_with: 'credit' });

diff --git a/test/spend-vibes.test.js b/test/spend-vibes.test.js

index 38d891e..183bae9 100644

--- a/test/spend-vibes.test.js

+++ b/test/spend-vibes.test.js

@@ -242,7 +242,11 @@ const doneTurn = { content: 'The tip was sent.' };

assert.strictEqual(res.status, 303, res.text.slice(0, 200));

assert.strictEqual(tips.calls.length, 1, 'the tip was paid once');

const call = tips.calls[0];

- assert.strictEqual(call.auth, `Bearer ${t.network.userToken(ada)}`, 'paid with the person\'s own token');

+ // The person's own token: one Network signed, for this person (a fresh userToken() differs by its iat

+ // whenever the second turns between the two, so compare who it is for, not the string).

+ const [jh, jp, js] = String(call.auth).replace(/^Bearer /, '').split('.');

+ assert.ok(crypto.verify('RSA-SHA256', Buffer.from(`${jh}.${jp}`), t.network.publicPem, Buffer.from(js || '', 'base64url')), 'a token Network signed');

+ assert.strictEqual(JSON.parse(Buffer.from(jp, 'base64url').toString('utf8')).subject_id, ada.subject, 'paid with the person\'s own token');

assert.strictEqual(call.key, ask.id, 'the approval id is the idempotency key');

assert.strictEqual(call.contentType, 'application/json');

assert.deepStrictEqual(call.body, { creator, amount: 12, message: 'thanks for the stream', pay_with: 'credit' });