25 lines
924 B
PHP
25 lines
924 B
PHP
<?php
|
|
declare(strict_types=1);
|
|
namespace App\Tests;
|
|
use App\Security\Hmac;
|
|
use PHPUnit\Framework\TestCase;
|
|
|
|
final class HmacTest extends TestCase
|
|
{
|
|
public function testSignMatchesPythonEdgeContract(): void
|
|
{
|
|
// P1-A edge/alert.py::sign = HMAC-SHA256(nonce+ts+body, secret) hex
|
|
$sig = Hmac::sign('secret', 'n1', '1000.0', '{"a":1}');
|
|
$expected = hash_hmac('sha256', 'n1' . '1000.0' . '{"a":1}', 'secret');
|
|
$this->assertSame($expected, $sig);
|
|
$this->assertSame(64, strlen($sig));
|
|
}
|
|
|
|
public function testVerifyTrueOnMatchFalseOnTamper(): void
|
|
{
|
|
$sig = Hmac::sign('secret', 'n1', '1000.0', 'body');
|
|
$this->assertTrue(Hmac::verify('secret', 'n1', '1000.0', 'body', $sig));
|
|
$this->assertFalse(Hmac::verify('secret', 'n1', '1000.0', 'body-TAMPERED', $sig));
|
|
$this->assertFalse(Hmac::verify('wrong', 'n1', '1000.0', 'body', $sig));
|
|
}
|
|
}
|