org.simantics.maps.server/node/node-v4.8.0-win-x64/node_modules/npm/node_modules/request/node_modules/hawk/test/server.js

   1 // Load modules
   2
   3 var Url = require('url');
   4 var Code = require('code');
   5 var Hawk = require('../lib');
   6 var Hoek = require('hoek');
   7 var Lab = require('lab');
   8
   9
  10 // Declare internals
  11
  12 var internals = {};
  13
  14
  15 // Test shortcuts
  16
  17 var lab = exports.lab = Lab.script();
  18 var describe = lab.experiment;
  19 var it = lab.test;
  20 var expect = Code.expect;
  21
  22
  23 describe('Server', function () {
  24
  25     var credentialsFunc = function (id, callback) {
  26
  27         var credentials = {
  28             id: id,
  29             key: 'werxhqb98rpaxn39848xrunpaw3489ruxnpa98w4rxn',
  30             algorithm: (id === '1' ? 'sha1' : 'sha256'),
  31             user: 'steve'
  32         };
  33
  34         return callback(null, credentials);
  35     };
  36
  37     describe('authenticate()', function () {
  38
  39         it('parses a valid authentication header (sha1)', function (done) {
  40
  41             var req = {
  42                 method: 'GET',
  43                 url: '/resource/4?filter=a',
  44                 host: 'example.com',
  45                 port: 8080,
  46                 authorization: 'Hawk id="1", ts="1353788437", nonce="k3j4h2", mac="zy79QQ5/EYFmQqutVnYb73gAc/U=", ext="hello"'
  47             };
  48
  49             Hawk.server.authenticate(req, credentialsFunc, { localtimeOffsetMsec: 1353788437000 - Hawk.utils.now() }, function (err, credentials, artifacts) {
  50
  51                 expect(err).to.not.exist();
  52                 expect(credentials.user).to.equal('steve');
  53                 done();
  54             });
  55         });
  56
  57         it('parses a valid authentication header (sha256)', function (done) {
  58
  59             var req = {
  60                 method: 'GET',
  61                 url: '/resource/1?b=1&a=2',
  62                 host: 'example.com',
  63                 port: 8000,
  64                 authorization: 'Hawk id="dh37fgj492je", ts="1353832234", nonce="j4h3g2", mac="m8r1rHbXN6NgO+KIIhjO7sFRyd78RNGVUwehe8Cp2dU=", ext="some-app-data"'
  65             };
  66
  67             Hawk.server.authenticate(req, credentialsFunc, { localtimeOffsetMsec: 1353832234000 - Hawk.utils.now() }, function (err, credentials, artifacts) {
  68
  69                 expect(err).to.not.exist();
  70                 expect(credentials.user).to.equal('steve');
  71                 done();
  72             });
  73         });
  74
  75         it('parses a valid authentication header (host override)', function (done) {
  76
  77             var req = {
  78                 method: 'GET',
  79                 url: '/resource/4?filter=a',
  80                 headers: {
  81                     host: 'example1.com:8080',
  82                     authorization: 'Hawk id="1", ts="1353788437", nonce="k3j4h2", mac="zy79QQ5/EYFmQqutVnYb73gAc/U=", ext="hello"'
  83                 }
  84             };
  85
  86             Hawk.server.authenticate(req, credentialsFunc, { host: 'example.com', localtimeOffsetMsec: 1353788437000 - Hawk.utils.now() }, function (err, credentials, artifacts) {
  87
  88                 expect(err).to.not.exist();
  89                 expect(credentials.user).to.equal('steve');
  90                 done();
  91             });
  92         });
  93
  94         it('parses a valid authentication header (host port override)', function (done) {
  95
  96             var req = {
  97                 method: 'GET',
  98                 url: '/resource/4?filter=a',
  99                 headers: {
 100                     host: 'example1.com:80',
 101                     authorization: 'Hawk id="1", ts="1353788437", nonce="k3j4h2", mac="zy79QQ5/EYFmQqutVnYb73gAc/U=", ext="hello"'
 102                 }
 103             };
 104
 105             Hawk.server.authenticate(req, credentialsFunc, { host: 'example.com', port: 8080, localtimeOffsetMsec: 1353788437000 - Hawk.utils.now() }, function (err, credentials, artifacts) {
 106
 107                 expect(err).to.not.exist();
 108                 expect(credentials.user).to.equal('steve');
 109                 done();
 110             });
 111         });
 112
 113         it('parses a valid authentication header (POST with payload)', function (done) {
 114
 115             var req = {
 116                 method: 'POST',
 117                 url: '/resource/4?filter=a',
 118                 host: 'example.com',
 119                 port: 8080,
 120                 authorization: 'Hawk id="123456", ts="1357926341", nonce="1AwuJD", hash="qAiXIVv+yjDATneWxZP2YCTa9aHRgQdnH9b3Wc+o3dg=", ext="some-app-data", mac="UeYcj5UoTVaAWXNvJfLVia7kU3VabxCqrccXP8sUGC4="'
 121             };
 122
 123             Hawk.server.authenticate(req, credentialsFunc, { localtimeOffsetMsec: 1357926341000 - Hawk.utils.now() }, function (err, credentials, artifacts) {
 124
 125                 expect(err).to.not.exist();
 126                 expect(credentials.user).to.equal('steve');
 127                 done();
 128             });
 129         });
 130
 131         it('errors on missing hash', function (done) {
 132
 133             var req = {
 134                 method: 'GET',
 135                 url: '/resource/1?b=1&a=2',
 136                 host: 'example.com',
 137                 port: 8000,
 138                 authorization: 'Hawk id="dh37fgj492je", ts="1353832234", nonce="j4h3g2", mac="m8r1rHbXN6NgO+KIIhjO7sFRyd78RNGVUwehe8Cp2dU=", ext="some-app-data"'
 139             };
 140
 141             Hawk.server.authenticate(req, credentialsFunc, { payload: 'body', localtimeOffsetMsec: 1353832234000 - Hawk.utils.now() }, function (err, credentials, artifacts) {
 142
 143                 expect(err).to.exist();
 144                 expect(err.output.payload.message).to.equal('Missing required payload hash');
 145                 done();
 146             });
 147         });
 148
 149         it('errors on a stale timestamp', function (done) {
 150
 151             var req = {
 152                 method: 'GET',
 153                 url: '/resource/4?filter=a',
 154                 host: 'example.com',
 155                 port: 8080,
 156                 authorization: 'Hawk id="123456", ts="1362337299", nonce="UzmxSs", ext="some-app-data", mac="wnNUxchvvryMH2RxckTdZ/gY3ijzvccx4keVvELC61w="'
 157             };
 158
 159             Hawk.server.authenticate(req, credentialsFunc, {}, function (err, credentials, artifacts) {
 160
 161                 expect(err).to.exist();
 162                 expect(err.output.payload.message).to.equal('Stale timestamp');
 163                 var header = err.output.headers['WWW-Authenticate'];
 164                 var ts = header.match(/^Hawk ts\=\"(\d+)\"\, tsm\=\"([^\"]+)\"\, error=\"Stale timestamp\"$/);
 165                 var now = Hawk.utils.now();
 166                 expect(parseInt(ts[1], 10) * 1000).to.be.within(now - 1000, now + 1000);
 167
 168                 var res = {
 169                     headers: {
 170                         'www-authenticate': header
 171                     }
 172                 };
 173
 174                 expect(Hawk.client.authenticate(res, credentials, artifacts)).to.equal(true);
 175                 done();
 176             });
 177         });
 178
 179         it('errors on a replay', function (done) {
 180
 181             var req = {
 182                 method: 'GET',
 183                 url: '/resource/4?filter=a',
 184                 host: 'example.com',
 185                 port: 8080,
 186                 authorization: 'Hawk id="123", ts="1353788437", nonce="k3j4h2", mac="bXx7a7p1h9QYQNZ8x7QhvDQym8ACgab4m3lVSFn4DBw=", ext="hello"'
 187             };
 188
 189             var memoryCache = {};
 190             var options = {
 191                 localtimeOffsetMsec: 1353788437000 - Hawk.utils.now(),
 192                 nonceFunc: function (key, nonce, ts, callback) {
 193
 194                     if (memoryCache[key + nonce]) {
 195                         return callback(new Error());
 196                     }
 197
 198                     memoryCache[key + nonce] = true;
 199                     return callback();
 200                 }
 201             };
 202
 203             Hawk.server.authenticate(req, credentialsFunc, options, function (err, credentials1, artifacts1) {
 204
 205                 expect(err).to.not.exist();
 206                 expect(credentials1.user).to.equal('steve');
 207
 208                 Hawk.server.authenticate(req, credentialsFunc, options, function (err, credentials2, artifacts2) {
 209
 210                     expect(err).to.exist();
 211                     expect(err.output.payload.message).to.equal('Invalid nonce');
 212                     done();
 213                 });
 214             });
 215         });
 216
 217         it('does not error on nonce collision if keys differ', function (done) {
 218
 219             var reqSteve = {
 220                 method: 'GET',
 221                 url: '/resource/4?filter=a',
 222                 host: 'example.com',
 223                 port: 8080,
 224                 authorization: 'Hawk id="123", ts="1353788437", nonce="k3j4h2", mac="bXx7a7p1h9QYQNZ8x7QhvDQym8ACgab4m3lVSFn4DBw=", ext="hello"'
 225             };
 226
 227             var reqBob = {
 228                 method: 'GET',
 229                 url: '/resource/4?filter=a',
 230                 host: 'example.com',
 231                 port: 8080,
 232                 authorization: 'Hawk id="456", ts="1353788437", nonce="k3j4h2", mac="LXfmTnRzrLd9TD7yfH+4se46Bx6AHyhpM94hLCiNia4=", ext="hello"'
 233             };
 234
 235             var credentialsFuncion = function (id, callback) {
 236
 237                 var credentials = {
 238                     '123': {
 239                         id: id,
 240                         key: 'werxhqb98rpaxn39848xrunpaw3489ruxnpa98w4rxn',
 241                         algorithm: (id === '1' ? 'sha1' : 'sha256'),
 242                         user: 'steve'
 243                     },
 244                     '456': {
 245                         id: id,
 246                         key: 'xrunpaw3489ruxnpa98w4rxnwerxhqb98rpaxn39848',
 247                         algorithm: (id === '1' ? 'sha1' : 'sha256'),
 248                         user: 'bob'
 249                     }
 250                 };
 251
 252                 return callback(null, credentials[id]);
 253             };
 254
 255             var memoryCache = {};
 256             var options = {
 257                 localtimeOffsetMsec: 1353788437000 - Hawk.utils.now(),
 258                 nonceFunc: function (key, nonce, ts, callback) {
 259
 260                     if (memoryCache[key + nonce]) {
 261                         return callback(new Error());
 262                     }
 263
 264                     memoryCache[key + nonce] = true;
 265                     return callback();
 266                 }
 267             };
 268
 269             Hawk.server.authenticate(reqSteve, credentialsFuncion, options, function (err, credentials1, artifacts1) {
 270
 271                 expect(err).to.not.exist();
 272                 expect(credentials1.user).to.equal('steve');
 273
 274                 Hawk.server.authenticate(reqBob, credentialsFuncion, options, function (err, credentials2, artifacts2) {
 275
 276                     expect(err).to.not.exist();
 277                     expect(credentials2.user).to.equal('bob');
 278                     done();
 279                 });
 280             });
 281         });
 282
 283         it('errors on an invalid authentication header: wrong scheme', function (done) {
 284
 285             var req = {
 286                 method: 'GET',
 287                 url: '/resource/4?filter=a',
 288                 host: 'example.com',
 289                 port: 8080,
 290                 authorization: 'Basic asdasdasdasd'
 291             };
 292
 293             Hawk.server.authenticate(req, credentialsFunc, { localtimeOffsetMsec: 1353788437000 - Hawk.utils.now() }, function (err, credentials, artifacts) {
 294
 295                 expect(err).to.exist();
 296                 expect(err.output.payload.message).to.not.exist();
 297                 done();
 298             });
 299         });
 300
 301         it('errors on an invalid authentication header: no scheme', function (done) {
 302
 303             var req = {
 304                 method: 'GET',
 305                 url: '/resource/4?filter=a',
 306                 host: 'example.com',
 307                 port: 8080,
 308                 authorization: '!@#'
 309             };
 310
 311             Hawk.server.authenticate(req, credentialsFunc, { localtimeOffsetMsec: 1353788437000 - Hawk.utils.now() }, function (err, credentials, artifacts) {
 312
 313                 expect(err).to.exist();
 314                 expect(err.output.payload.message).to.equal('Invalid header syntax');
 315                 done();
 316             });
 317         });
 318
 319         it('errors on an missing authorization header', function (done) {
 320
 321             var req = {
 322                 method: 'GET',
 323                 url: '/resource/4?filter=a',
 324                 host: 'example.com',
 325                 port: 8080
 326             };
 327
 328             Hawk.server.authenticate(req, credentialsFunc, {}, function (err, credentials, artifacts) {
 329
 330                 expect(err).to.exist();
 331                 expect(err.isMissing).to.equal(true);
 332                 done();
 333             });
 334         });
 335
 336         it('errors on an missing host header', function (done) {
 337
 338             var req = {
 339                 method: 'GET',
 340                 url: '/resource/4?filter=a',
 341                 headers: {
 342                     authorization: 'Hawk id="123", ts="1353788437", nonce="k3j4h2", mac="/qwS4UjfVWMcUyW6EEgUH4jlr7T/wuKe3dKijvTvSos=", ext="hello"'
 343                 }
 344             };
 345
 346             Hawk.server.authenticate(req, credentialsFunc, { localtimeOffsetMsec: 1353788437000 - Hawk.utils.now() }, function (err, credentials, artifacts) {
 347
 348                 expect(err).to.exist();
 349                 expect(err.output.payload.message).to.equal('Invalid Host header');
 350                 done();
 351             });
 352         });
 353
 354         it('errors on an missing authorization attribute (id)', function (done) {
 355
 356             var req = {
 357                 method: 'GET',
 358                 url: '/resource/4?filter=a',
 359                 host: 'example.com',
 360                 port: 8080,
 361                 authorization: 'Hawk ts="1353788437", nonce="k3j4h2", mac="/qwS4UjfVWMcUyW6EEgUH4jlr7T/wuKe3dKijvTvSos=", ext="hello"'
 362             };
 363
 364             Hawk.server.authenticate(req, credentialsFunc, { localtimeOffsetMsec: 1353788437000 - Hawk.utils.now() }, function (err, credentials, artifacts) {
 365
 366                 expect(err).to.exist();
 367                 expect(err.output.payload.message).to.equal('Missing attributes');
 368                 done();
 369             });
 370         });
 371
 372         it('errors on an missing authorization attribute (ts)', function (done) {
 373
 374             var req = {
 375                 method: 'GET',
 376                 url: '/resource/4?filter=a',
 377                 host: 'example.com',
 378                 port: 8080,
 379                 authorization: 'Hawk id="123", nonce="k3j4h2", mac="/qwS4UjfVWMcUyW6EEgUH4jlr7T/wuKe3dKijvTvSos=", ext="hello"'
 380             };
 381
 382             Hawk.server.authenticate(req, credentialsFunc, { localtimeOffsetMsec: 1353788437000 - Hawk.utils.now() }, function (err, credentials, artifacts) {
 383
 384                 expect(err).to.exist();
 385                 expect(err.output.payload.message).to.equal('Missing attributes');
 386                 done();
 387             });
 388         });
 389
 390         it('errors on an missing authorization attribute (nonce)', function (done) {
 391
 392             var req = {
 393                 method: 'GET',
 394                 url: '/resource/4?filter=a',
 395                 host: 'example.com',
 396                 port: 8080,
 397                 authorization: 'Hawk id="123", ts="1353788437", mac="/qwS4UjfVWMcUyW6EEgUH4jlr7T/wuKe3dKijvTvSos=", ext="hello"'
 398             };
 399
 400             Hawk.server.authenticate(req, credentialsFunc, { localtimeOffsetMsec: 1353788437000 - Hawk.utils.now() }, function (err, credentials, artifacts) {
 401
 402                 expect(err).to.exist();
 403                 expect(err.output.payload.message).to.equal('Missing attributes');
 404                 done();
 405             });
 406         });
 407
 408         it('errors on an missing authorization attribute (mac)', function (done) {
 409
 410             var req = {
 411                 method: 'GET',
 412                 url: '/resource/4?filter=a',
 413                 host: 'example.com',
 414                 port: 8080,
 415                 authorization: 'Hawk id="123", ts="1353788437", nonce="k3j4h2", ext="hello"'
 416             };
 417
 418             Hawk.server.authenticate(req, credentialsFunc, { localtimeOffsetMsec: 1353788437000 - Hawk.utils.now() }, function (err, credentials, artifacts) {
 419
 420                 expect(err).to.exist();
 421                 expect(err.output.payload.message).to.equal('Missing attributes');
 422                 done();
 423             });
 424         });
 425
 426         it('errors on an unknown authorization attribute', function (done) {
 427
 428             var req = {
 429                 method: 'GET',
 430                 url: '/resource/4?filter=a',
 431                 host: 'example.com',
 432                 port: 8080,
 433                 authorization: 'Hawk id="123", ts="1353788437", nonce="k3j4h2", x="3", mac="/qwS4UjfVWMcUyW6EEgUH4jlr7T/wuKe3dKijvTvSos=", ext="hello"'
 434             };
 435
 436             Hawk.server.authenticate(req, credentialsFunc, { localtimeOffsetMsec: 1353788437000 - Hawk.utils.now() }, function (err, credentials, artifacts) {
 437
 438                 expect(err).to.exist();
 439                 expect(err.output.payload.message).to.equal('Unknown attribute: x');
 440                 done();
 441             });
 442         });
 443
 444         it('errors on an bad authorization header format', function (done) {
 445
 446             var req = {
 447                 method: 'GET',
 448                 url: '/resource/4?filter=a',
 449                 host: 'example.com',
 450                 port: 8080,
 451                 authorization: 'Hawk id="123\\", ts="1353788437", nonce="k3j4h2", mac="/qwS4UjfVWMcUyW6EEgUH4jlr7T/wuKe3dKijvTvSos=", ext="hello"'
 452             };
 453
 454             Hawk.server.authenticate(req, credentialsFunc, { localtimeOffsetMsec: 1353788437000 - Hawk.utils.now() }, function (err, credentials, artifacts) {
 455
 456                 expect(err).to.exist();
 457                 expect(err.output.payload.message).to.equal('Bad header format');
 458                 done();
 459             });
 460         });
 461
 462         it('errors on an bad authorization attribute value', function (done) {
 463
 464             var req = {
 465                 method: 'GET',
 466                 url: '/resource/4?filter=a',
 467                 host: 'example.com',
 468                 port: 8080,
 469                 authorization: 'Hawk id="\t", ts="1353788437", nonce="k3j4h2", mac="/qwS4UjfVWMcUyW6EEgUH4jlr7T/wuKe3dKijvTvSos=", ext="hello"'
 470             };
 471
 472             Hawk.server.authenticate(req, credentialsFunc, { localtimeOffsetMsec: 1353788437000 - Hawk.utils.now() }, function (err, credentials, artifacts) {
 473
 474                 expect(err).to.exist();
 475                 expect(err.output.payload.message).to.equal('Bad attribute value: id');
 476                 done();
 477             });
 478         });
 479
 480         it('errors on an empty authorization attribute value', function (done) {
 481
 482             var req = {
 483                 method: 'GET',
 484                 url: '/resource/4?filter=a',
 485                 host: 'example.com',
 486                 port: 8080,
 487                 authorization: 'Hawk id="", ts="1353788437", nonce="k3j4h2", mac="/qwS4UjfVWMcUyW6EEgUH4jlr7T/wuKe3dKijvTvSos=", ext="hello"'
 488             };
 489
 490             Hawk.server.authenticate(req, credentialsFunc, { localtimeOffsetMsec: 1353788437000 - Hawk.utils.now() }, function (err, credentials, artifacts) {
 491
 492                 expect(err).to.exist();
 493                 expect(err.output.payload.message).to.equal('Bad attribute value: id');
 494                 done();
 495             });
 496         });
 497
 498         it('errors on duplicated authorization attribute key', function (done) {
 499
 500             var req = {
 501                 method: 'GET',
 502                 url: '/resource/4?filter=a',
 503                 host: 'example.com',
 504                 port: 8080,
 505                 authorization: 'Hawk id="123", id="456", ts="1353788437", nonce="k3j4h2", mac="/qwS4UjfVWMcUyW6EEgUH4jlr7T/wuKe3dKijvTvSos=", ext="hello"'
 506             };
 507
 508             Hawk.server.authenticate(req, credentialsFunc, { localtimeOffsetMsec: 1353788437000 - Hawk.utils.now() }, function (err, credentials, artifacts) {
 509
 510                 expect(err).to.exist();
 511                 expect(err.output.payload.message).to.equal('Duplicate attribute: id');
 512                 done();
 513             });
 514         });
 515
 516         it('errors on an invalid authorization header format', function (done) {
 517
 518             var req = {
 519                 method: 'GET',
 520                 url: '/resource/4?filter=a',
 521                 host: 'example.com',
 522                 port: 8080,
 523                 authorization: 'Hawk'
 524             };
 525
 526             Hawk.server.authenticate(req, credentialsFunc, { localtimeOffsetMsec: 1353788437000 - Hawk.utils.now() }, function (err, credentials, artifacts) {
 527
 528                 expect(err).to.exist();
 529                 expect(err.output.payload.message).to.equal('Invalid header syntax');
 530                 done();
 531             });
 532         });
 533
 534         it('errors on an bad host header (missing host)', function (done) {
 535
 536             var req = {
 537                 method: 'GET',
 538                 url: '/resource/4?filter=a',
 539                 headers: {
 540                     host: ':8080',
 541                     authorization: 'Hawk id="123", ts="1353788437", nonce="k3j4h2", mac="/qwS4UjfVWMcUyW6EEgUH4jlr7T/wuKe3dKijvTvSos=", ext="hello"'
 542                 }
 543             };
 544
 545             Hawk.server.authenticate(req, credentialsFunc, { localtimeOffsetMsec: 1353788437000 - Hawk.utils.now() }, function (err, credentials, artifacts) {
 546
 547                 expect(err).to.exist();
 548                 expect(err.output.payload.message).to.equal('Invalid Host header');
 549                 done();
 550             });
 551         });
 552
 553         it('errors on an bad host header (pad port)', function (done) {
 554
 555             var req = {
 556                 method: 'GET',
 557                 url: '/resource/4?filter=a',
 558                 headers: {
 559                     host: 'example.com:something',
 560                     authorization: 'Hawk id="123", ts="1353788437", nonce="k3j4h2", mac="/qwS4UjfVWMcUyW6EEgUH4jlr7T/wuKe3dKijvTvSos=", ext="hello"'
 561                 }
 562             };
 563
 564             Hawk.server.authenticate(req, credentialsFunc, { localtimeOffsetMsec: 1353788437000 - Hawk.utils.now() }, function (err, credentials, artifacts) {
 565
 566                 expect(err).to.exist();
 567                 expect(err.output.payload.message).to.equal('Invalid Host header');
 568                 done();
 569             });
 570         });
 571
 572         it('errors on credentialsFunc error', function (done) {
 573
 574             var req = {
 575                 method: 'GET',
 576                 url: '/resource/4?filter=a',
 577                 host: 'example.com',
 578                 port: 8080,
 579                 authorization: 'Hawk id="123", ts="1353788437", nonce="k3j4h2", mac="/qwS4UjfVWMcUyW6EEgUH4jlr7T/wuKe3dKijvTvSos=", ext="hello"'
 580             };
 581
 582             var credentialsFuncion = function (id, callback) {
 583
 584                 return callback(new Error('Unknown user'));
 585             };
 586
 587             Hawk.server.authenticate(req, credentialsFuncion, { localtimeOffsetMsec: 1353788437000 - Hawk.utils.now() }, function (err, credentials, artifacts) {
 588
 589                 expect(err).to.exist();
 590                 expect(err.message).to.equal('Unknown user');
 591                 done();
 592             });
 593         });
 594
 595         it('errors on credentialsFunc error (with credentials)', function (done) {
 596
 597             var req = {
 598                 method: 'GET',
 599                 url: '/resource/4?filter=a',
 600                 host: 'example.com',
 601                 port: 8080,
 602                 authorization: 'Hawk id="123", ts="1353788437", nonce="k3j4h2", mac="/qwS4UjfVWMcUyW6EEgUH4jlr7T/wuKe3dKijvTvSos=", ext="hello"'
 603             };
 604
 605             var credentialsFuncion = function (id, callback) {
 606
 607                 return callback(new Error('Unknown user'), { some: 'value' });
 608             };
 609
 610             Hawk.server.authenticate(req, credentialsFuncion, { localtimeOffsetMsec: 1353788437000 - Hawk.utils.now() }, function (err, credentials, artifacts) {
 611
 612                 expect(err).to.exist();
 613                 expect(err.message).to.equal('Unknown user');
 614                 expect(credentials.some).to.equal('value');
 615                 done();
 616             });
 617         });
 618
 619         it('errors on missing credentials', function (done) {
 620
 621             var req = {
 622                 method: 'GET',
 623                 url: '/resource/4?filter=a',
 624                 host: 'example.com',
 625                 port: 8080,
 626                 authorization: 'Hawk id="123", ts="1353788437", nonce="k3j4h2", mac="/qwS4UjfVWMcUyW6EEgUH4jlr7T/wuKe3dKijvTvSos=", ext="hello"'
 627             };
 628
 629             var credentialsFuncion = function (id, callback) {
 630
 631                 return callback(null, null);
 632             };
 633
 634             Hawk.server.authenticate(req, credentialsFuncion, { localtimeOffsetMsec: 1353788437000 - Hawk.utils.now() }, function (err, credentials, artifacts) {
 635
 636                 expect(err).to.exist();
 637                 expect(err.output.payload.message).to.equal('Unknown credentials');
 638                 done();
 639             });
 640         });
 641
 642         it('errors on invalid credentials (id)', function (done) {
 643
 644             var req = {
 645                 method: 'GET',
 646                 url: '/resource/4?filter=a',
 647                 host: 'example.com',
 648                 port: 8080,
 649                 authorization: 'Hawk id="123", ts="1353788437", nonce="k3j4h2", mac="/qwS4UjfVWMcUyW6EEgUH4jlr7T/wuKe3dKijvTvSos=", ext="hello"'
 650             };
 651
 652             var credentialsFuncion = function (id, callback) {
 653
 654                 var credentials = {
 655                     key: 'werxhqb98rpaxn39848xrunpaw3489ruxnpa98w4rxn',
 656                     user: 'steve'
 657                 };
 658
 659                 return callback(null, credentials);
 660             };
 661
 662             Hawk.server.authenticate(req, credentialsFuncion, { localtimeOffsetMsec: 1353788437000 - Hawk.utils.now() }, function (err, credentials, artifacts) {
 663
 664                 expect(err).to.exist();
 665                 expect(err.message).to.equal('Invalid credentials');
 666                 expect(err.output.payload.message).to.equal('An internal server error occurred');
 667                 done();
 668             });
 669         });
 670
 671         it('errors on invalid credentials (key)', function (done) {
 672
 673             var req = {
 674                 method: 'GET',
 675                 url: '/resource/4?filter=a',
 676                 host: 'example.com',
 677                 port: 8080,
 678                 authorization: 'Hawk id="123", ts="1353788437", nonce="k3j4h2", mac="/qwS4UjfVWMcUyW6EEgUH4jlr7T/wuKe3dKijvTvSos=", ext="hello"'
 679             };
 680
 681             var credentialsFuncion = function (id, callback) {
 682
 683                 var credentials = {
 684                     id: '23434d3q4d5345d',
 685                     user: 'steve'
 686                 };
 687
 688                 return callback(null, credentials);
 689             };
 690
 691             Hawk.server.authenticate(req, credentialsFuncion, { localtimeOffsetMsec: 1353788437000 - Hawk.utils.now() }, function (err, credentials, artifacts) {
 692
 693                 expect(err).to.exist();
 694                 expect(err.message).to.equal('Invalid credentials');
 695                 expect(err.output.payload.message).to.equal('An internal server error occurred');
 696                 done();
 697             });
 698         });
 699
 700         it('errors on unknown credentials algorithm', function (done) {
 701
 702             var req = {
 703                 method: 'GET',
 704                 url: '/resource/4?filter=a',
 705                 host: 'example.com',
 706                 port: 8080,
 707                 authorization: 'Hawk id="123", ts="1353788437", nonce="k3j4h2", mac="/qwS4UjfVWMcUyW6EEgUH4jlr7T/wuKe3dKijvTvSos=", ext="hello"'
 708             };
 709
 710             var credentialsFuncion = function (id, callback) {
 711
 712                 var credentials = {
 713                     key: 'werxhqb98rpaxn39848xrunpaw3489ruxnpa98w4rxn',
 714                     algorithm: 'hmac-sha-0',
 715                     user: 'steve'
 716                 };
 717
 718                 return callback(null, credentials);
 719             };
 720
 721             Hawk.server.authenticate(req, credentialsFuncion, { localtimeOffsetMsec: 1353788437000 - Hawk.utils.now() }, function (err, credentials, artifacts) {
 722
 723                 expect(err).to.exist();
 724                 expect(err.message).to.equal('Unknown algorithm');
 725                 expect(err.output.payload.message).to.equal('An internal server error occurred');
 726                 done();
 727             });
 728         });
 729
 730         it('errors on unknown bad mac', function (done) {
 731
 732             var req = {
 733                 method: 'GET',
 734                 url: '/resource/4?filter=a',
 735                 host: 'example.com',
 736                 port: 8080,
 737                 authorization: 'Hawk id="123", ts="1353788437", nonce="k3j4h2", mac="/qwS4UjfVWMcU4jlr7T/wuKe3dKijvTvSos=", ext="hello"'
 738             };
 739
 740             var credentialsFuncion = function (id, callback) {
 741
 742                 var credentials = {
 743                     key: 'werxhqb98rpaxn39848xrunpaw3489ruxnpa98w4rxn',
 744                     algorithm: 'sha256',
 745                     user: 'steve'
 746                 };
 747
 748                 return callback(null, credentials);
 749             };
 750
 751             Hawk.server.authenticate(req, credentialsFuncion, { localtimeOffsetMsec: 1353788437000 - Hawk.utils.now() }, function (err, credentials, artifacts) {
 752
 753                 expect(err).to.exist();
 754                 expect(err.output.payload.message).to.equal('Bad mac');
 755                 done();
 756             });
 757         });
 758     });
 759
 760     describe('header()', function () {
 761
 762         it('generates header', function (done) {
 763
 764             var credentials = {
 765                 id: '123456',
 766                 key: 'werxhqb98rpaxn39848xrunpaw3489ruxnpa98w4rxn',
 767                 algorithm: 'sha256',
 768                 user: 'steve'
 769             };
 770
 771             var artifacts = {
 772                 method: 'POST',
 773                 host: 'example.com',
 774                 port: '8080',
 775                 resource: '/resource/4?filter=a',
 776                 ts: '1398546787',
 777                 nonce: 'xUwusx',
 778                 hash: 'nJjkVtBE5Y/Bk38Aiokwn0jiJxt/0S2WRSUwWLCf5xk=',
 779                 ext: 'some-app-data',
 780                 mac: 'dvIvMThwi28J61Jc3P0ryAhuKpanU63GXdx6hkmQkJA=',
 781                 id: '123456'
 782             };
 783
 784             var header = Hawk.server.header(credentials, artifacts, { payload: 'some reply', contentType: 'text/plain', ext: 'response-specific' });
 785             expect(header).to.equal('Hawk mac=\"n14wVJK4cOxAytPUMc5bPezQzuJGl5n7MYXhFQgEKsE=\", hash=\"f9cDF/TDm7TkYRLnGwRMfeDzT6LixQVLvrIKhh0vgmM=\", ext=\"response-specific\"');
 786             done();
 787         });
 788
 789         it('generates header (empty payload)', function (done) {
 790
 791             var credentials = {
 792                 id: '123456',
 793                 key: 'werxhqb98rpaxn39848xrunpaw3489ruxnpa98w4rxn',
 794                 algorithm: 'sha256',
 795                 user: 'steve'
 796             };
 797
 798             var artifacts = {
 799                 method: 'POST',
 800                 host: 'example.com',
 801                 port: '8080',
 802                 resource: '/resource/4?filter=a',
 803                 ts: '1398546787',
 804                 nonce: 'xUwusx',
 805                 hash: 'nJjkVtBE5Y/Bk38Aiokwn0jiJxt/0S2WRSUwWLCf5xk=',
 806                 ext: 'some-app-data',
 807                 mac: 'dvIvMThwi28J61Jc3P0ryAhuKpanU63GXdx6hkmQkJA=',
 808                 id: '123456'
 809             };
 810
 811             var header = Hawk.server.header(credentials, artifacts, { payload: '', contentType: 'text/plain', ext: 'response-specific' });
 812             expect(header).to.equal('Hawk mac=\"i8/kUBDx0QF+PpCtW860kkV/fa9dbwEoe/FpGUXowf0=\", hash=\"q/t+NNAkQZNlq/aAD6PlexImwQTxwgT2MahfTa9XRLA=\", ext=\"response-specific\"');
 813             done();
 814         });
 815
 816         it('generates header (pre calculated hash)', function (done) {
 817
 818             var credentials = {
 819                 id: '123456',
 820                 key: 'werxhqb98rpaxn39848xrunpaw3489ruxnpa98w4rxn',
 821                 algorithm: 'sha256',
 822                 user: 'steve'
 823             };
 824
 825             var artifacts = {
 826                 method: 'POST',
 827                 host: 'example.com',
 828                 port: '8080',
 829                 resource: '/resource/4?filter=a',
 830                 ts: '1398546787',
 831                 nonce: 'xUwusx',
 832                 hash: 'nJjkVtBE5Y/Bk38Aiokwn0jiJxt/0S2WRSUwWLCf5xk=',
 833                 ext: 'some-app-data',
 834                 mac: 'dvIvMThwi28J61Jc3P0ryAhuKpanU63GXdx6hkmQkJA=',
 835                 id: '123456'
 836             };
 837
 838             var options = { payload: 'some reply', contentType: 'text/plain', ext: 'response-specific' };
 839             options.hash = Hawk.crypto.calculatePayloadHash(options.payload, credentials.algorithm, options.contentType);
 840             var header = Hawk.server.header(credentials, artifacts, options);
 841             expect(header).to.equal('Hawk mac=\"n14wVJK4cOxAytPUMc5bPezQzuJGl5n7MYXhFQgEKsE=\", hash=\"f9cDF/TDm7TkYRLnGwRMfeDzT6LixQVLvrIKhh0vgmM=\", ext=\"response-specific\"');
 842             done();
 843         });
 844
 845         it('generates header (null ext)', function (done) {
 846
 847             var credentials = {
 848                 id: '123456',
 849                 key: 'werxhqb98rpaxn39848xrunpaw3489ruxnpa98w4rxn',
 850                 algorithm: 'sha256',
 851                 user: 'steve'
 852             };
 853
 854             var artifacts = {
 855                 method: 'POST',
 856                 host: 'example.com',
 857                 port: '8080',
 858                 resource: '/resource/4?filter=a',
 859                 ts: '1398546787',
 860                 nonce: 'xUwusx',
 861                 hash: 'nJjkVtBE5Y/Bk38Aiokwn0jiJxt/0S2WRSUwWLCf5xk=',
 862                 mac: 'dvIvMThwi28J61Jc3P0ryAhuKpanU63GXdx6hkmQkJA=',
 863                 id: '123456'
 864             };
 865
 866             var header = Hawk.server.header(credentials, artifacts, { payload: 'some reply', contentType: 'text/plain', ext: null });
 867             expect(header).to.equal('Hawk mac=\"6PrybJTJs20jsgBw5eilXpcytD8kUbaIKNYXL+6g0ns=\", hash=\"f9cDF/TDm7TkYRLnGwRMfeDzT6LixQVLvrIKhh0vgmM=\"');
 868             done();
 869         });
 870
 871         it('errors on missing artifacts', function (done) {
 872
 873             var credentials = {
 874                 id: '123456',
 875                 key: 'werxhqb98rpaxn39848xrunpaw3489ruxnpa98w4rxn',
 876                 algorithm: 'sha256',
 877                 user: 'steve'
 878             };
 879
 880             var header = Hawk.server.header(credentials, null, { payload: 'some reply', contentType: 'text/plain', ext: 'response-specific' });
 881             expect(header).to.equal('');
 882             done();
 883         });
 884
 885         it('errors on invalid artifacts', function (done) {
 886
 887             var credentials = {
 888                 id: '123456',
 889                 key: 'werxhqb98rpaxn39848xrunpaw3489ruxnpa98w4rxn',
 890                 algorithm: 'sha256',
 891                 user: 'steve'
 892             };
 893
 894             var header = Hawk.server.header(credentials, 5, { payload: 'some reply', contentType: 'text/plain', ext: 'response-specific' });
 895             expect(header).to.equal('');
 896             done();
 897         });
 898
 899         it('errors on missing credentials', function (done) {
 900
 901             var artifacts = {
 902                 method: 'POST',
 903                 host: 'example.com',
 904                 port: '8080',
 905                 resource: '/resource/4?filter=a',
 906                 ts: '1398546787',
 907                 nonce: 'xUwusx',
 908                 hash: 'nJjkVtBE5Y/Bk38Aiokwn0jiJxt/0S2WRSUwWLCf5xk=',
 909                 ext: 'some-app-data',
 910                 mac: 'dvIvMThwi28J61Jc3P0ryAhuKpanU63GXdx6hkmQkJA=',
 911                 id: '123456'
 912             };
 913
 914             var header = Hawk.server.header(null, artifacts, { payload: 'some reply', contentType: 'text/plain', ext: 'response-specific' });
 915             expect(header).to.equal('');
 916             done();
 917         });
 918
 919         it('errors on invalid credentials (key)', function (done) {
 920
 921             var credentials = {
 922                 id: '123456',
 923                 algorithm: 'sha256',
 924                 user: 'steve'
 925             };
 926
 927             var artifacts = {
 928                 method: 'POST',
 929                 host: 'example.com',
 930                 port: '8080',
 931                 resource: '/resource/4?filter=a',
 932                 ts: '1398546787',
 933                 nonce: 'xUwusx',
 934                 hash: 'nJjkVtBE5Y/Bk38Aiokwn0jiJxt/0S2WRSUwWLCf5xk=',
 935                 ext: 'some-app-data',
 936                 mac: 'dvIvMThwi28J61Jc3P0ryAhuKpanU63GXdx6hkmQkJA=',
 937                 id: '123456'
 938             };
 939
 940             var header = Hawk.server.header(credentials, artifacts, { payload: 'some reply', contentType: 'text/plain', ext: 'response-specific' });
 941             expect(header).to.equal('');
 942             done();
 943         });
 944
 945         it('errors on invalid algorithm', function (done) {
 946
 947             var credentials = {
 948                 id: '123456',
 949                 key: 'werxhqb98rpaxn39848xrunpaw3489ruxnpa98w4rxn',
 950                 algorithm: 'x',
 951                 user: 'steve'
 952             };
 953
 954             var artifacts = {
 955                 method: 'POST',
 956                 host: 'example.com',
 957                 port: '8080',
 958                 resource: '/resource/4?filter=a',
 959                 ts: '1398546787',
 960                 nonce: 'xUwusx',
 961                 hash: 'nJjkVtBE5Y/Bk38Aiokwn0jiJxt/0S2WRSUwWLCf5xk=',
 962                 ext: 'some-app-data',
 963                 mac: 'dvIvMThwi28J61Jc3P0ryAhuKpanU63GXdx6hkmQkJA=',
 964                 id: '123456'
 965             };
 966
 967             var header = Hawk.server.header(credentials, artifacts, { payload: 'some reply', contentType: 'text/plain', ext: 'response-specific' });
 968             expect(header).to.equal('');
 969             done();
 970         });
 971     });
 972
 973     describe('authenticateBewit()', function () {
 974
 975         it('errors on uri too long', function (done) {
 976
 977             var long = '/';
 978             for (var i = 0; i < 5000; ++i) {
 979                 long += 'x';
 980             }
 981
 982             var req = {
 983                 method: 'GET',
 984                 url: long,
 985                 host: 'example.com',
 986                 port: 8080,
 987                 authorization: 'Hawk id="1", ts="1353788437", nonce="k3j4h2", mac="zy79QQ5/EYFmQqutVnYb73gAc/U=", ext="hello"'
 988             };
 989
 990             Hawk.server.authenticateBewit(req, credentialsFunc, {}, function (err, credentials, bewit) {
 991
 992                 expect(err).to.exist();
 993                 expect(err.output.statusCode).to.equal(400);
 994                 expect(err.message).to.equal('Resource path exceeds max length');
 995                 done();
 996             });
 997         });
 998     });
 999
1000     describe('authenticateMessage()', function () {
1001
1002         it('errors on invalid authorization (ts)', function (done) {
1003
1004             credentialsFunc('123456', function (err, credentials1) {
1005
1006                 var auth = Hawk.client.message('example.com', 8080, 'some message', { credentials: credentials1 });
1007                 delete auth.ts;
1008
1009                 Hawk.server.authenticateMessage('example.com', 8080, 'some message', auth, credentialsFunc, {}, function (err, credentials2) {
1010
1011                     expect(err).to.exist();
1012                     expect(err.message).to.equal('Invalid authorization');
1013                     done();
1014                 });
1015             });
1016         });
1017
1018         it('errors on invalid authorization (nonce)', function (done) {
1019
1020             credentialsFunc('123456', function (err, credentials1) {
1021
1022                 var auth = Hawk.client.message('example.com', 8080, 'some message', { credentials: credentials1 });
1023                 delete auth.nonce;
1024
1025                 Hawk.server.authenticateMessage('example.com', 8080, 'some message', auth, credentialsFunc, {}, function (err, credentials2) {
1026
1027                     expect(err).to.exist();
1028                     expect(err.message).to.equal('Invalid authorization');
1029                     done();
1030                 });
1031             });
1032         });
1033
1034         it('errors on invalid authorization (hash)', function (done) {
1035
1036             credentialsFunc('123456', function (err, credentials1) {
1037
1038                 var auth = Hawk.client.message('example.com', 8080, 'some message', { credentials: credentials1 });
1039                 delete auth.hash;
1040
1041                 Hawk.server.authenticateMessage('example.com', 8080, 'some message', auth, credentialsFunc, {}, function (err, credentials2) {
1042
1043                     expect(err).to.exist();
1044                     expect(err.message).to.equal('Invalid authorization');
1045                     done();
1046                 });
1047             });
1048         });
1049
1050         it('errors with credentials', function (done) {
1051
1052             credentialsFunc('123456', function (err, credentials1) {
1053
1054                 var auth = Hawk.client.message('example.com', 8080, 'some message', { credentials: credentials1 });
1055
1056                 Hawk.server.authenticateMessage('example.com', 8080, 'some message', auth, function (id, callback) {
1057
1058                     callback(new Error('something'), { some: 'value' });
1059                 }, {}, function (err, credentials2) {
1060
1061                     expect(err).to.exist();
1062                     expect(err.message).to.equal('something');
1063                     expect(credentials2.some).to.equal('value');
1064                     done();
1065                 });
1066             });
1067         });
1068
1069         it('errors on nonce collision', function (done) {
1070
1071             credentialsFunc('123456', function (err, credentials1) {
1072
1073                 var auth = Hawk.client.message('example.com', 8080, 'some message', { credentials: credentials1 });
1074                 Hawk.server.authenticateMessage('example.com', 8080, 'some message', auth, credentialsFunc, {
1075                     nonceFunc: function (key, nonce, ts, nonceCallback) {
1076
1077                         nonceCallback(true);
1078                     }
1079                 }, function (err, credentials2) {
1080
1081                     expect(err).to.exist();
1082                     expect(err.message).to.equal('Invalid nonce');
1083                     done();
1084                 });
1085             });
1086         });
1087
1088         it('should generate an authorization then successfully parse it', function (done) {
1089
1090             credentialsFunc('123456', function (err, credentials1) {
1091
1092                 var auth = Hawk.client.message('example.com', 8080, 'some message', { credentials: credentials1 });
1093                 expect(auth).to.exist();
1094
1095                 Hawk.server.authenticateMessage('example.com', 8080, 'some message', auth, credentialsFunc, {}, function (err, credentials2) {
1096
1097                     expect(err).to.not.exist();
1098                     expect(credentials2.user).to.equal('steve');
1099                     done();
1100                 });
1101             });
1102         });
1103
1104         it('should fail authorization on mismatching host', function (done) {
1105
1106             credentialsFunc('123456', function (err, credentials1) {
1107
1108                 var auth = Hawk.client.message('example.com', 8080, 'some message', { credentials: credentials1 });
1109                 expect(auth).to.exist();
1110
1111                 Hawk.server.authenticateMessage('example1.com', 8080, 'some message', auth, credentialsFunc, {}, function (err, credentials2) {
1112
1113                     expect(err).to.exist();
1114                     expect(err.message).to.equal('Bad mac');
1115                     done();
1116                 });
1117             });
1118         });
1119
1120         it('should fail authorization on stale timestamp', function (done) {
1121
1122             credentialsFunc('123456', function (err, credentials1) {
1123
1124                 var auth = Hawk.client.message('example.com', 8080, 'some message', { credentials: credentials1 });
1125                 expect(auth).to.exist();
1126
1127                 Hawk.server.authenticateMessage('example.com', 8080, 'some message', auth, credentialsFunc, { localtimeOffsetMsec: 100000 }, function (err, credentials2) {
1128
1129                     expect(err).to.exist();
1130                     expect(err.message).to.equal('Stale timestamp');
1131                     done();
1132                 });
1133             });
1134         });
1135
1136         it('overrides timestampSkewSec', function (done) {
1137
1138             credentialsFunc('123456', function (err, credentials1) {
1139
1140                 var auth = Hawk.client.message('example.com', 8080, 'some message', { credentials: credentials1, localtimeOffsetMsec: 100000 });
1141                 expect(auth).to.exist();
1142
1143                 Hawk.server.authenticateMessage('example.com', 8080, 'some message', auth, credentialsFunc, { timestampSkewSec: 500 }, function (err, credentials2) {
1144
1145                     expect(err).to.not.exist();
1146                     done();
1147                 });
1148             });
1149         });
1150
1151         it('should fail authorization on invalid authorization', function (done) {
1152
1153             credentialsFunc('123456', function (err, credentials1) {
1154
1155                 var auth = Hawk.client.message('example.com', 8080, 'some message', { credentials: credentials1 });
1156                 expect(auth).to.exist();
1157                 delete auth.id;
1158
1159                 Hawk.server.authenticateMessage('example.com', 8080, 'some message', auth, credentialsFunc, {}, function (err, credentials2) {
1160
1161                     expect(err).to.exist();
1162                     expect(err.message).to.equal('Invalid authorization');
1163                     done();
1164                 });
1165             });
1166         });
1167
1168         it('should fail authorization on bad hash', function (done) {
1169
1170             credentialsFunc('123456', function (err, credentials1) {
1171
1172                 var auth = Hawk.client.message('example.com', 8080, 'some message', { credentials: credentials1 });
1173                 expect(auth).to.exist();
1174
1175                 Hawk.server.authenticateMessage('example.com', 8080, 'some message1', auth, credentialsFunc, {}, function (err, credentials2) {
1176
1177                     expect(err).to.exist();
1178                     expect(err.message).to.equal('Bad message hash');
1179                     done();
1180                 });
1181             });
1182         });
1183
1184         it('should fail authorization on nonce error', function (done) {
1185
1186             credentialsFunc('123456', function (err, credentials1) {
1187
1188                 var auth = Hawk.client.message('example.com', 8080, 'some message', { credentials: credentials1 });
1189                 expect(auth).to.exist();
1190
1191                 Hawk.server.authenticateMessage('example.com', 8080, 'some message', auth, credentialsFunc, {
1192                     nonceFunc: function (key, nonce, ts, callback) {
1193
1194                         callback(new Error('kaboom'));
1195                     }
1196                 }, function (err, credentials2) {
1197
1198                     expect(err).to.exist();
1199                     expect(err.message).to.equal('Invalid nonce');
1200                     done();
1201                 });
1202             });
1203         });
1204
1205         it('should fail authorization on credentials error', function (done) {
1206
1207             credentialsFunc('123456', function (err, credentials1) {
1208
1209                 var auth = Hawk.client.message('example.com', 8080, 'some message', { credentials: credentials1 });
1210                 expect(auth).to.exist();
1211
1212                 var errFunc = function (id, callback) {
1213
1214                     callback(new Error('kablooey'));
1215                 };
1216
1217                 Hawk.server.authenticateMessage('example.com', 8080, 'some message', auth, errFunc, {}, function (err, credentials2) {
1218
1219                     expect(err).to.exist();
1220                     expect(err.message).to.equal('kablooey');
1221                     done();
1222                 });
1223             });
1224         });
1225
1226         it('should fail authorization on missing credentials', function (done) {
1227
1228             credentialsFunc('123456', function (err, credentials1) {
1229
1230                 var auth = Hawk.client.message('example.com', 8080, 'some message', { credentials: credentials1 });
1231                 expect(auth).to.exist();
1232
1233                 var errFunc = function (id, callback) {
1234
1235                     callback();
1236                 };
1237
1238                 Hawk.server.authenticateMessage('example.com', 8080, 'some message', auth, errFunc, {}, function (err, credentials2) {
1239
1240                     expect(err).to.exist();
1241                     expect(err.message).to.equal('Unknown credentials');
1242                     done();
1243                 });
1244             });
1245         });
1246
1247         it('should fail authorization on invalid credentials', function (done) {
1248
1249             credentialsFunc('123456', function (err, credentials1) {
1250
1251                 var auth = Hawk.client.message('example.com', 8080, 'some message', { credentials: credentials1 });
1252                 expect(auth).to.exist();
1253
1254                 var errFunc = function (id, callback) {
1255
1256                     callback(null, {});
1257                 };
1258
1259                 Hawk.server.authenticateMessage('example.com', 8080, 'some message', auth, errFunc, {}, function (err, credentials2) {
1260
1261                     expect(err).to.exist();
1262                     expect(err.message).to.equal('Invalid credentials');
1263                     done();
1264                 });
1265             });
1266         });
1267
1268         it('should fail authorization on invalid credentials algorithm', function (done) {
1269
1270             credentialsFunc('123456', function (err, credentials1) {
1271
1272                 var auth = Hawk.client.message('example.com', 8080, 'some message', { credentials: credentials1 });
1273                 expect(auth).to.exist();
1274
1275                 var errFunc = function (id, callback) {
1276
1277                     callback(null, { key: '123', algorithm: '456' });
1278                 };
1279
1280                 Hawk.server.authenticateMessage('example.com', 8080, 'some message', auth, errFunc, {}, function (err, credentials2) {
1281
1282                     expect(err).to.exist();
1283                     expect(err.message).to.equal('Unknown algorithm');
1284                     done();
1285                 });
1286             });
1287         });
1288
1289         it('should fail on missing host', function (done) {
1290
1291             credentialsFunc('123456', function (err, credentials) {
1292
1293                 var auth = Hawk.client.message(null, 8080, 'some message', { credentials: credentials });
1294                 expect(auth).to.not.exist();
1295                 done();
1296             });
1297         });
1298
1299         it('should fail on missing credentials', function (done) {
1300
1301             var auth = Hawk.client.message('example.com', 8080, 'some message', {});
1302             expect(auth).to.not.exist();
1303             done();
1304         });
1305
1306         it('should fail on invalid algorithm', function (done) {
1307
1308             credentialsFunc('123456', function (err, credentials) {
1309
1310                 var creds = Hoek.clone(credentials);
1311                 creds.algorithm = 'blah';
1312                 var auth = Hawk.client.message('example.com', 8080, 'some message', { credentials: creds });
1313                 expect(auth).to.not.exist();
1314                 done();
1315             });
1316         });
1317     });
1318
1319     describe('authenticatePayloadHash()', function () {
1320
1321         it('checks payload hash', function (done) {
1322
1323             expect(Hawk.server.authenticatePayloadHash('abcdefg', { hash: 'abcdefg' })).to.equal(true);
1324             expect(Hawk.server.authenticatePayloadHash('1234567', { hash: 'abcdefg' })).to.equal(false);
1325             done();
1326         });
1327     });
1328 });