38 lines
1.5 KiB
PHP
38 lines
1.5 KiB
PHP
<?php
|
|
declare(strict_types=1);
|
|
namespace App\Tests;
|
|
use App\Security\Hmac;
|
|
use PHPUnit\Framework\TestCase;
|
|
|
|
final class HmacTest extends TestCase
|
|
{
|
|
public function testSignMatchesPythonEdgeContract(): void
|
|
{
|
|
// P1-A edge/alert.py::sign = HMAC-SHA256(nonce+ts+body, secret) hex
|
|
$sig = Hmac::sign('secret', 'n1', '1000.0', '{"a":1}');
|
|
$expected = hash_hmac('sha256', 'n1' . '1000.0' . '{"a":1}', 'secret');
|
|
$this->assertSame($expected, $sig);
|
|
$this->assertSame(64, strlen($sig));
|
|
}
|
|
|
|
public function testVerifyTrueOnMatchFalseOnTamper(): void
|
|
{
|
|
$sig = Hmac::sign('secret', 'n1', '1000.0', 'body');
|
|
$this->assertTrue(Hmac::verify('secret', 'n1', '1000.0', 'body', $sig));
|
|
$this->assertFalse(Hmac::verify('secret', 'n1', '1000.0', 'body-TAMPERED', $sig));
|
|
$this->assertFalse(Hmac::verify('wrong', 'n1', '1000.0', 'body', $sig));
|
|
}
|
|
|
|
public function testMatchesGoldenVectorsFromPythonEdgeSigner(): void
|
|
{
|
|
// Golden hex produced by running P1-A edge/alert.py::sign — proves cross-language byte-for-byte interop.
|
|
$this->assertSame(
|
|
'a151bb402f070c3678056776b1bcc5638bd150dec1e516aaa07cac1a089f63b9',
|
|
Hmac::sign('secret', 'n1', '1000.0', '{"a":1}')
|
|
);
|
|
$this->assertSame(
|
|
'71865248fe94517dc0305a5c233e2b6c97db95fc9e38815e7c20580d2aa784c9',
|
|
Hmac::sign('sekret', 'abc123', '1700000000.5', '{"device_id":"pi-1","event_type":"fall"}')
|
|
);
|
|
}
|
|
}
|