org.simantics.maps.server/node/node-v4.8.0-win-x64/node_modules/npm/node_modules/request/node_modules/hawk/test/uri.js

   1 // Load modules
   2
   3 var Http = require('http');
   4 var Url = require('url');
   5 var Code = require('code');
   6 var Hawk = require('../lib');
   7 var Hoek = require('hoek');
   8 var Lab = require('lab');
   9
  10
  11 // Declare internals
  12
  13 var internals = {};
  14
  15
  16 // Test shortcuts
  17
  18 var lab = exports.lab = Lab.script();
  19 var describe = lab.experiment;
  20 var it = lab.test;
  21 var expect = Code.expect;
  22
  23
  24 describe('Uri', function () {
  25
  26     var credentialsFunc = function (id, callback) {
  27
  28         var credentials = {
  29             id: id,
  30             key: 'werxhqb98rpaxn39848xrunpaw3489ruxnpa98w4rxn',
  31             algorithm: (id === '1' ? 'sha1' : 'sha256'),
  32             user: 'steve'
  33         };
  34
  35         return callback(null, credentials);
  36     };
  37
  38     it('should generate a bewit then successfully authenticate it', function (done) {
  39
  40         var req = {
  41             method: 'GET',
  42             url: '/resource/4?a=1&b=2',
  43             host: 'example.com',
  44             port: 80
  45         };
  46
  47         credentialsFunc('123456', function (err, credentials1) {
  48
  49             var bewit = Hawk.uri.getBewit('http://example.com/resource/4?a=1&b=2', { credentials: credentials1, ttlSec: 60 * 60 * 24 * 365 * 100, ext: 'some-app-data' });
  50             req.url += '&bewit=' + bewit;
  51
  52             Hawk.uri.authenticate(req, credentialsFunc, {}, function (err, credentials2, attributes) {
  53
  54                 expect(err).to.not.exist();
  55                 expect(credentials2.user).to.equal('steve');
  56                 expect(attributes.ext).to.equal('some-app-data');
  57                 done();
  58             });
  59         });
  60     });
  61
  62     it('should generate a bewit then successfully authenticate it (no ext)', function (done) {
  63
  64         var req = {
  65             method: 'GET',
  66             url: '/resource/4?a=1&b=2',
  67             host: 'example.com',
  68             port: 80
  69         };
  70
  71         credentialsFunc('123456', function (err, credentials1) {
  72
  73             var bewit = Hawk.uri.getBewit('http://example.com/resource/4?a=1&b=2', { credentials: credentials1, ttlSec: 60 * 60 * 24 * 365 * 100 });
  74             req.url += '&bewit=' + bewit;
  75
  76             Hawk.uri.authenticate(req, credentialsFunc, {}, function (err, credentials2, attributes) {
  77
  78                 expect(err).to.not.exist();
  79                 expect(credentials2.user).to.equal('steve');
  80                 done();
  81             });
  82         });
  83     });
  84
  85     it('should successfully authenticate a request (last param)', function (done) {
  86
  87         var req = {
  88             method: 'GET',
  89             url: '/resource/4?a=1&b=2&bewit=MTIzNDU2XDQ1MTE0ODQ2MjFcMzFjMmNkbUJFd1NJRVZDOVkva1NFb2c3d3YrdEVNWjZ3RXNmOGNHU2FXQT1cc29tZS1hcHAtZGF0YQ',
  90             host: 'example.com',
  91             port: 8080
  92         };
  93
  94         Hawk.uri.authenticate(req, credentialsFunc, {}, function (err, credentials, attributes) {
  95
  96             expect(err).to.not.exist();
  97             expect(credentials.user).to.equal('steve');
  98             expect(attributes.ext).to.equal('some-app-data');
  99             done();
 100         });
 101     });
 102
 103     it('should successfully authenticate a request (first param)', function (done) {
 104
 105         var req = {
 106             method: 'GET',
 107             url: '/resource/4?bewit=MTIzNDU2XDQ1MTE0ODQ2MjFcMzFjMmNkbUJFd1NJRVZDOVkva1NFb2c3d3YrdEVNWjZ3RXNmOGNHU2FXQT1cc29tZS1hcHAtZGF0YQ&a=1&b=2',
 108             host: 'example.com',
 109             port: 8080
 110         };
 111
 112         Hawk.uri.authenticate(req, credentialsFunc, {}, function (err, credentials, attributes) {
 113
 114             expect(err).to.not.exist();
 115             expect(credentials.user).to.equal('steve');
 116             expect(attributes.ext).to.equal('some-app-data');
 117             done();
 118         });
 119     });
 120
 121     it('should successfully authenticate a request (only param)', function (done) {
 122
 123         var req = {
 124             method: 'GET',
 125             url: '/resource/4?bewit=MTIzNDU2XDQ1MTE0ODQ2NDFcZm1CdkNWT3MvcElOTUUxSTIwbWhrejQ3UnBwTmo4Y1VrSHpQd3Q5OXJ1cz1cc29tZS1hcHAtZGF0YQ',
 126             host: 'example.com',
 127             port: 8080
 128         };
 129
 130         Hawk.uri.authenticate(req, credentialsFunc, {}, function (err, credentials, attributes) {
 131
 132             expect(err).to.not.exist();
 133             expect(credentials.user).to.equal('steve');
 134             expect(attributes.ext).to.equal('some-app-data');
 135             done();
 136         });
 137     });
 138
 139     it('should fail on multiple authentication', function (done) {
 140
 141         var req = {
 142             method: 'GET',
 143             url: '/resource/4?bewit=MTIzNDU2XDQ1MTE0ODQ2NDFcZm1CdkNWT3MvcElOTUUxSTIwbWhrejQ3UnBwTmo4Y1VrSHpQd3Q5OXJ1cz1cc29tZS1hcHAtZGF0YQ',
 144             host: 'example.com',
 145             port: 8080,
 146             authorization: 'Basic asdasdasdasd'
 147         };
 148
 149         Hawk.uri.authenticate(req, credentialsFunc, {}, function (err, credentials, attributes) {
 150
 151             expect(err).to.exist();
 152             expect(err.output.payload.message).to.equal('Multiple authentications');
 153             done();
 154         });
 155     });
 156
 157     it('should fail on method other than GET', function (done) {
 158
 159         credentialsFunc('123456', function (err, credentials1) {
 160
 161             var req = {
 162                 method: 'POST',
 163                 url: '/resource/4?filter=a',
 164                 host: 'example.com',
 165                 port: 8080
 166             };
 167
 168             var exp = Math.floor(Hawk.utils.now() / 1000) + 60;
 169             var ext = 'some-app-data';
 170             var mac = Hawk.crypto.calculateMac('bewit', credentials1, {
 171                 timestamp: exp,
 172                 nonce: '',
 173                 method: req.method,
 174                 resource: req.url,
 175                 host: req.host,
 176                 port: req.port,
 177                 ext: ext
 178             });
 179
 180             var bewit = credentials1.id + '\\' + exp + '\\' + mac + '\\' + ext;
 181
 182             req.url += '&bewit=' + Hoek.base64urlEncode(bewit);
 183
 184             Hawk.uri.authenticate(req, credentialsFunc, {}, function (err, credentials2, attributes) {
 185
 186                 expect(err).to.exist();
 187                 expect(err.output.payload.message).to.equal('Invalid method');
 188                 done();
 189             });
 190         });
 191     });
 192
 193     it('should fail on invalid host header', function (done) {
 194
 195         var req = {
 196             method: 'GET',
 197             url: '/resource/4?bewit=MTIzNDU2XDQ1MDk5OTE3MTlcTUE2eWkwRWRwR0pEcWRwb0JkYVdvVDJrL0hDSzA1T0Y3MkhuZlVmVy96Zz1cc29tZS1hcHAtZGF0YQ',
 198             headers: {
 199                 host: 'example.com:something'
 200             }
 201         };
 202
 203         Hawk.uri.authenticate(req, credentialsFunc, {}, function (err, credentials, attributes) {
 204
 205             expect(err).to.exist();
 206             expect(err.output.payload.message).to.equal('Invalid Host header');
 207             done();
 208         });
 209     });
 210
 211     it('should fail on empty bewit', function (done) {
 212
 213         var req = {
 214             method: 'GET',
 215             url: '/resource/4?bewit=',
 216             host: 'example.com',
 217             port: 8080
 218         };
 219
 220         Hawk.uri.authenticate(req, credentialsFunc, {}, function (err, credentials, attributes) {
 221
 222             expect(err).to.exist();
 223             expect(err.output.payload.message).to.equal('Empty bewit');
 224             expect(err.isMissing).to.not.exist();
 225             done();
 226         });
 227     });
 228
 229     it('should fail on invalid bewit', function (done) {
 230
 231         var req = {
 232             method: 'GET',
 233             url: '/resource/4?bewit=*',
 234             host: 'example.com',
 235             port: 8080
 236         };
 237
 238         Hawk.uri.authenticate(req, credentialsFunc, {}, function (err, credentials, attributes) {
 239
 240             expect(err).to.exist();
 241             expect(err.output.payload.message).to.equal('Invalid bewit encoding');
 242             expect(err.isMissing).to.not.exist();
 243             done();
 244         });
 245     });
 246
 247     it('should fail on missing bewit', function (done) {
 248
 249         var req = {
 250             method: 'GET',
 251             url: '/resource/4',
 252             host: 'example.com',
 253             port: 8080
 254         };
 255
 256         Hawk.uri.authenticate(req, credentialsFunc, {}, function (err, credentials, attributes) {
 257
 258             expect(err).to.exist();
 259             expect(err.output.payload.message).to.not.exist();
 260             expect(err.isMissing).to.equal(true);
 261             done();
 262         });
 263     });
 264
 265     it('should fail on invalid bewit structure', function (done) {
 266
 267         var req = {
 268             method: 'GET',
 269             url: '/resource/4?bewit=abc',
 270             host: 'example.com',
 271             port: 8080
 272         };
 273
 274         Hawk.uri.authenticate(req, credentialsFunc, {}, function (err, credentials, attributes) {
 275
 276             expect(err).to.exist();
 277             expect(err.output.payload.message).to.equal('Invalid bewit structure');
 278             done();
 279         });
 280     });
 281
 282     it('should fail on empty bewit attribute', function (done) {
 283
 284         var req = {
 285             method: 'GET',
 286             url: '/resource/4?bewit=YVxcY1xk',
 287             host: 'example.com',
 288             port: 8080
 289         };
 290
 291         Hawk.uri.authenticate(req, credentialsFunc, {}, function (err, credentials, attributes) {
 292
 293             expect(err).to.exist();
 294             expect(err.output.payload.message).to.equal('Missing bewit attributes');
 295             done();
 296         });
 297     });
 298
 299     it('should fail on missing bewit id attribute', function (done) {
 300
 301         var req = {
 302             method: 'GET',
 303             url: '/resource/4?bewit=XDQ1NTIxNDc2MjJcK0JFbFhQMXhuWjcvd1Nrbm1ldGhlZm5vUTNHVjZNSlFVRHk4NWpTZVJ4VT1cc29tZS1hcHAtZGF0YQ',
 304             host: 'example.com',
 305             port: 8080
 306         };
 307
 308         Hawk.uri.authenticate(req, credentialsFunc, {}, function (err, credentials, attributes) {
 309
 310             expect(err).to.exist();
 311             expect(err.output.payload.message).to.equal('Missing bewit attributes');
 312             done();
 313         });
 314     });
 315
 316     it('should fail on expired access', function (done) {
 317
 318         var req = {
 319             method: 'GET',
 320             url: '/resource/4?a=1&b=2&bewit=MTIzNDU2XDEzNTY0MTg1ODNcWk1wZlMwWU5KNHV0WHpOMmRucTRydEk3NXNXTjFjeWVITTcrL0tNZFdVQT1cc29tZS1hcHAtZGF0YQ',
 321             host: 'example.com',
 322             port: 8080
 323         };
 324
 325         Hawk.uri.authenticate(req, credentialsFunc, {}, function (err, credentials, attributes) {
 326
 327             expect(err).to.exist();
 328             expect(err.output.payload.message).to.equal('Access expired');
 329             done();
 330         });
 331     });
 332
 333     it('should fail on credentials function error', function (done) {
 334
 335         var req = {
 336             method: 'GET',
 337             url: '/resource/4?bewit=MTIzNDU2XDQ1MDk5OTE3MTlcTUE2eWkwRWRwR0pEcWRwb0JkYVdvVDJrL0hDSzA1T0Y3MkhuZlVmVy96Zz1cc29tZS1hcHAtZGF0YQ',
 338             host: 'example.com',
 339             port: 8080
 340         };
 341
 342         Hawk.uri.authenticate(req, function (id, callback) {
 343
 344             callback(Hawk.error.badRequest('Boom'));
 345         }, {}, function (err, credentials, attributes) {
 346
 347             expect(err).to.exist();
 348             expect(err.output.payload.message).to.equal('Boom');
 349             done();
 350         });
 351     });
 352
 353     it('should fail on credentials function error with credentials', function (done) {
 354
 355         var req = {
 356             method: 'GET',
 357             url: '/resource/4?bewit=MTIzNDU2XDQ1MDk5OTE3MTlcTUE2eWkwRWRwR0pEcWRwb0JkYVdvVDJrL0hDSzA1T0Y3MkhuZlVmVy96Zz1cc29tZS1hcHAtZGF0YQ',
 358             host: 'example.com',
 359             port: 8080
 360         };
 361
 362         Hawk.uri.authenticate(req, function (id, callback) {
 363
 364             callback(Hawk.error.badRequest('Boom'), { some: 'value' });
 365         }, {}, function (err, credentials, attributes) {
 366
 367             expect(err).to.exist();
 368             expect(err.output.payload.message).to.equal('Boom');
 369             expect(credentials.some).to.equal('value');
 370             done();
 371         });
 372     });
 373
 374     it('should fail on null credentials function response', function (done) {
 375
 376         var req = {
 377             method: 'GET',
 378             url: '/resource/4?bewit=MTIzNDU2XDQ1MDk5OTE3MTlcTUE2eWkwRWRwR0pEcWRwb0JkYVdvVDJrL0hDSzA1T0Y3MkhuZlVmVy96Zz1cc29tZS1hcHAtZGF0YQ',
 379             host: 'example.com',
 380             port: 8080
 381         };
 382
 383         Hawk.uri.authenticate(req, function (id, callback) {
 384
 385             callback(null, null);
 386         }, {}, function (err, credentials, attributes) {
 387
 388             expect(err).to.exist();
 389             expect(err.output.payload.message).to.equal('Unknown credentials');
 390             done();
 391         });
 392     });
 393
 394     it('should fail on invalid credentials function response', function (done) {
 395
 396         var req = {
 397             method: 'GET',
 398             url: '/resource/4?bewit=MTIzNDU2XDQ1MDk5OTE3MTlcTUE2eWkwRWRwR0pEcWRwb0JkYVdvVDJrL0hDSzA1T0Y3MkhuZlVmVy96Zz1cc29tZS1hcHAtZGF0YQ',
 399             host: 'example.com',
 400             port: 8080
 401         };
 402
 403         Hawk.uri.authenticate(req, function (id, callback) {
 404
 405             callback(null, {});
 406         }, {}, function (err, credentials, attributes) {
 407
 408             expect(err).to.exist();
 409             expect(err.message).to.equal('Invalid credentials');
 410             done();
 411         });
 412     });
 413
 414     it('should fail on invalid credentials function response (unknown algorithm)', function (done) {
 415
 416         var req = {
 417             method: 'GET',
 418             url: '/resource/4?bewit=MTIzNDU2XDQ1MDk5OTE3MTlcTUE2eWkwRWRwR0pEcWRwb0JkYVdvVDJrL0hDSzA1T0Y3MkhuZlVmVy96Zz1cc29tZS1hcHAtZGF0YQ',
 419             host: 'example.com',
 420             port: 8080
 421         };
 422
 423         Hawk.uri.authenticate(req, function (id, callback) {
 424
 425             callback(null, { key: 'xxx', algorithm: 'xxx' });
 426         }, {}, function (err, credentials, attributes) {
 427
 428             expect(err).to.exist();
 429             expect(err.message).to.equal('Unknown algorithm');
 430             done();
 431         });
 432     });
 433
 434     it('should fail on expired access', function (done) {
 435
 436         var req = {
 437             method: 'GET',
 438             url: '/resource/4?bewit=MTIzNDU2XDQ1MDk5OTE3MTlcTUE2eWkwRWRwR0pEcWRwb0JkYVdvVDJrL0hDSzA1T0Y3MkhuZlVmVy96Zz1cc29tZS1hcHAtZGF0YQ',
 439             host: 'example.com',
 440             port: 8080
 441         };
 442
 443         Hawk.uri.authenticate(req, function (id, callback) {
 444
 445             callback(null, { key: 'xxx', algorithm: 'sha256' });
 446         }, {}, function (err, credentials, attributes) {
 447
 448             expect(err).to.exist();
 449             expect(err.output.payload.message).to.equal('Bad mac');
 450             done();
 451         });
 452     });
 453
 454     describe('getBewit()', function () {
 455
 456         it('returns a valid bewit value', function (done) {
 457
 458             var credentials = {
 459                 id: '123456',
 460                 key: '2983d45yun89q',
 461                 algorithm: 'sha256'
 462             };
 463
 464             var bewit = Hawk.uri.getBewit('https://example.com/somewhere/over/the/rainbow', { credentials: credentials, ttlSec: 300, localtimeOffsetMsec: 1356420407232 - Hawk.utils.now(), ext: 'xandyandz' });
 465             expect(bewit).to.equal('MTIzNDU2XDEzNTY0MjA3MDdca3NjeHdOUjJ0SnBQMVQxekRMTlBiQjVVaUtJVTl0T1NKWFRVZEc3WDloOD1ceGFuZHlhbmR6');
 466             done();
 467         });
 468
 469         it('returns a valid bewit value (explicit port)', function (done) {
 470
 471             var credentials = {
 472                 id: '123456',
 473                 key: '2983d45yun89q',
 474                 algorithm: 'sha256'
 475             };
 476
 477             var bewit = Hawk.uri.getBewit('https://example.com:8080/somewhere/over/the/rainbow', { credentials: credentials, ttlSec: 300, localtimeOffsetMsec: 1356420407232 - Hawk.utils.now(), ext: 'xandyandz' });
 478             expect(bewit).to.equal('MTIzNDU2XDEzNTY0MjA3MDdcaFpiSjNQMmNLRW80a3kwQzhqa1pBa1J5Q1p1ZWc0V1NOYnhWN3ZxM3hIVT1ceGFuZHlhbmR6');
 479             done();
 480         });
 481
 482         it('returns a valid bewit value (null ext)', function (done) {
 483
 484             var credentials = {
 485                 id: '123456',
 486                 key: '2983d45yun89q',
 487                 algorithm: 'sha256'
 488             };
 489
 490             var bewit = Hawk.uri.getBewit('https://example.com/somewhere/over/the/rainbow', { credentials: credentials, ttlSec: 300, localtimeOffsetMsec: 1356420407232 - Hawk.utils.now(), ext: null });
 491             expect(bewit).to.equal('MTIzNDU2XDEzNTY0MjA3MDdcSUdZbUxnSXFMckNlOEN4dktQczRKbFdJQStValdKSm91d2dBUmlWaENBZz1c');
 492             done();
 493         });
 494
 495         it('returns a valid bewit value (parsed uri)', function (done) {
 496
 497             var credentials = {
 498                 id: '123456',
 499                 key: '2983d45yun89q',
 500                 algorithm: 'sha256'
 501             };
 502
 503             var bewit = Hawk.uri.getBewit(Url.parse('https://example.com/somewhere/over/the/rainbow'), { credentials: credentials, ttlSec: 300, localtimeOffsetMsec: 1356420407232 - Hawk.utils.now(), ext: 'xandyandz' });
 504             expect(bewit).to.equal('MTIzNDU2XDEzNTY0MjA3MDdca3NjeHdOUjJ0SnBQMVQxekRMTlBiQjVVaUtJVTl0T1NKWFRVZEc3WDloOD1ceGFuZHlhbmR6');
 505             done();
 506         });
 507
 508         it('errors on invalid options', function (done) {
 509
 510             var credentials = {
 511                 id: '123456',
 512                 key: '2983d45yun89q',
 513                 algorithm: 'sha256'
 514             };
 515
 516             var bewit = Hawk.uri.getBewit('https://example.com/somewhere/over/the/rainbow', 4);
 517             expect(bewit).to.equal('');
 518             done();
 519         });
 520
 521         it('errors on missing uri', function (done) {
 522
 523             var credentials = {
 524                 id: '123456',
 525                 key: '2983d45yun89q',
 526                 algorithm: 'sha256'
 527             };
 528
 529             var bewit = Hawk.uri.getBewit('', { credentials: credentials, ttlSec: 300, localtimeOffsetMsec: 1356420407232 - Hawk.utils.now(), ext: 'xandyandz' });
 530             expect(bewit).to.equal('');
 531             done();
 532         });
 533
 534         it('errors on invalid uri', function (done) {
 535
 536             var credentials = {
 537                 id: '123456',
 538                 key: '2983d45yun89q',
 539                 algorithm: 'sha256'
 540             };
 541
 542             var bewit = Hawk.uri.getBewit(5, { credentials: credentials, ttlSec: 300, localtimeOffsetMsec: 1356420407232 - Hawk.utils.now(), ext: 'xandyandz' });
 543             expect(bewit).to.equal('');
 544             done();
 545         });
 546
 547         it('errors on invalid credentials (id)', function (done) {
 548
 549             var credentials = {
 550                 key: '2983d45yun89q',
 551                 algorithm: 'sha256'
 552             };
 553
 554             var bewit = Hawk.uri.getBewit('https://example.com/somewhere/over/the/rainbow', { credentials: credentials, ttlSec: 3000, ext: 'xandyandz' });
 555             expect(bewit).to.equal('');
 556             done();
 557         });
 558
 559         it('errors on missing credentials', function (done) {
 560
 561             var bewit = Hawk.uri.getBewit('https://example.com/somewhere/over/the/rainbow', { ttlSec: 3000, ext: 'xandyandz' });
 562             expect(bewit).to.equal('');
 563             done();
 564         });
 565
 566         it('errors on invalid credentials (key)', function (done) {
 567
 568             var credentials = {
 569                 id: '123456',
 570                 algorithm: 'sha256'
 571             };
 572
 573             var bewit = Hawk.uri.getBewit('https://example.com/somewhere/over/the/rainbow', { credentials: credentials, ttlSec: 3000, ext: 'xandyandz' });
 574             expect(bewit).to.equal('');
 575             done();
 576         });
 577
 578         it('errors on invalid algorithm', function (done) {
 579
 580             var credentials = {
 581                 id: '123456',
 582                 key: '2983d45yun89q',
 583                 algorithm: 'hmac-sha-0'
 584             };
 585
 586             var bewit = Hawk.uri.getBewit('https://example.com/somewhere/over/the/rainbow', { credentials: credentials, ttlSec: 300, ext: 'xandyandz' });
 587             expect(bewit).to.equal('');
 588             done();
 589         });
 590
 591         it('errors on missing options', function (done) {
 592
 593             var credentials = {
 594                 id: '123456',
 595                 key: '2983d45yun89q',
 596                 algorithm: 'hmac-sha-0'
 597             };
 598
 599             var bewit = Hawk.uri.getBewit('https://example.com/somewhere/over/the/rainbow');
 600             expect(bewit).to.equal('');
 601             done();
 602         });
 603     });
 604
 605     describe('authenticateMessage()', function () {
 606
 607         it('should generate an authorization then successfully parse it', function (done) {
 608
 609             credentialsFunc('123456', function (err, credentials1) {
 610
 611                 var auth = Hawk.client.message('example.com', 8080, 'some message', { credentials: credentials1 });
 612                 expect(auth).to.exist();
 613
 614                 Hawk.server.authenticateMessage('example.com', 8080, 'some message', auth, credentialsFunc, {}, function (err, credentials2) {
 615
 616                     expect(err).to.not.exist();
 617                     expect(credentials2.user).to.equal('steve');
 618                     done();
 619                 });
 620             });
 621         });
 622
 623         it('should fail authorization on mismatching host', function (done) {
 624
 625             credentialsFunc('123456', function (err, credentials1) {
 626
 627                 var auth = Hawk.client.message('example.com', 8080, 'some message', { credentials: credentials1 });
 628                 expect(auth).to.exist();
 629
 630                 Hawk.server.authenticateMessage('example1.com', 8080, 'some message', auth, credentialsFunc, {}, function (err, credentials2) {
 631
 632                     expect(err).to.exist();
 633                     expect(err.message).to.equal('Bad mac');
 634                     done();
 635                 });
 636             });
 637         });
 638
 639         it('should fail authorization on stale timestamp', function (done) {
 640
 641             credentialsFunc('123456', function (err, credentials1) {
 642
 643                 var auth = Hawk.client.message('example.com', 8080, 'some message', { credentials: credentials1 });
 644                 expect(auth).to.exist();
 645
 646                 Hawk.server.authenticateMessage('example.com', 8080, 'some message', auth, credentialsFunc, { localtimeOffsetMsec: 100000 }, function (err, credentials2) {
 647
 648                     expect(err).to.exist();
 649                     expect(err.message).to.equal('Stale timestamp');
 650                     done();
 651                 });
 652             });
 653         });
 654
 655         it('overrides timestampSkewSec', function (done) {
 656
 657             credentialsFunc('123456', function (err, credentials1) {
 658
 659                 var auth = Hawk.client.message('example.com', 8080, 'some message', { credentials: credentials1, localtimeOffsetMsec: 100000 });
 660                 expect(auth).to.exist();
 661
 662                 Hawk.server.authenticateMessage('example.com', 8080, 'some message', auth, credentialsFunc, { timestampSkewSec: 500 }, function (err, credentials2) {
 663
 664                     expect(err).to.not.exist();
 665                     done();
 666                 });
 667             });
 668         });
 669
 670         it('should fail authorization on invalid authorization', function (done) {
 671
 672             credentialsFunc('123456', function (err, credentials1) {
 673
 674                 var auth = Hawk.client.message('example.com', 8080, 'some message', { credentials: credentials1 });
 675                 expect(auth).to.exist();
 676                 delete auth.id;
 677
 678                 Hawk.server.authenticateMessage('example.com', 8080, 'some message', auth, credentialsFunc, {}, function (err, credentials2) {
 679
 680                     expect(err).to.exist();
 681                     expect(err.message).to.equal('Invalid authorization');
 682                     done();
 683                 });
 684             });
 685         });
 686
 687         it('should fail authorization on bad hash', function (done) {
 688
 689             credentialsFunc('123456', function (err, credentials1) {
 690
 691                 var auth = Hawk.client.message('example.com', 8080, 'some message', { credentials: credentials1 });
 692                 expect(auth).to.exist();
 693
 694                 Hawk.server.authenticateMessage('example.com', 8080, 'some message1', auth, credentialsFunc, {}, function (err, credentials2) {
 695
 696                     expect(err).to.exist();
 697                     expect(err.message).to.equal('Bad message hash');
 698                     done();
 699                 });
 700             });
 701         });
 702
 703         it('should fail authorization on nonce error', function (done) {
 704
 705             credentialsFunc('123456', function (err, credentials1) {
 706
 707                 var auth = Hawk.client.message('example.com', 8080, 'some message', { credentials: credentials1 });
 708                 expect(auth).to.exist();
 709
 710                 Hawk.server.authenticateMessage('example.com', 8080, 'some message', auth, credentialsFunc, {
 711                     nonceFunc: function (key, nonce, ts, callback) {
 712
 713                         callback(new Error('kaboom'));
 714                     }
 715                 }, function (err, credentials2) {
 716
 717                     expect(err).to.exist();
 718                     expect(err.message).to.equal('Invalid nonce');
 719                     done();
 720                 });
 721             });
 722         });
 723
 724         it('should fail authorization on credentials error', function (done) {
 725
 726             credentialsFunc('123456', function (err, credentials1) {
 727
 728                 var auth = Hawk.client.message('example.com', 8080, 'some message', { credentials: credentials1 });
 729                 expect(auth).to.exist();
 730
 731                 var errFunc = function (id, callback) {
 732
 733                     callback(new Error('kablooey'));
 734                 };
 735
 736                 Hawk.server.authenticateMessage('example.com', 8080, 'some message', auth, errFunc, {}, function (err, credentials2) {
 737
 738                     expect(err).to.exist();
 739                     expect(err.message).to.equal('kablooey');
 740                     done();
 741                 });
 742             });
 743         });
 744
 745         it('should fail authorization on missing credentials', function (done) {
 746
 747             credentialsFunc('123456', function (err, credentials1) {
 748
 749                 var auth = Hawk.client.message('example.com', 8080, 'some message', { credentials: credentials1 });
 750                 expect(auth).to.exist();
 751
 752                 var errFunc = function (id, callback) {
 753
 754                     callback();
 755                 };
 756
 757                 Hawk.server.authenticateMessage('example.com', 8080, 'some message', auth, errFunc, {}, function (err, credentials2) {
 758
 759                     expect(err).to.exist();
 760                     expect(err.message).to.equal('Unknown credentials');
 761                     done();
 762                 });
 763             });
 764         });
 765
 766         it('should fail authorization on invalid credentials', function (done) {
 767
 768             credentialsFunc('123456', function (err, credentials1) {
 769
 770                 var auth = Hawk.client.message('example.com', 8080, 'some message', { credentials: credentials1 });
 771                 expect(auth).to.exist();
 772
 773                 var errFunc = function (id, callback) {
 774
 775                     callback(null, {});
 776                 };
 777
 778                 Hawk.server.authenticateMessage('example.com', 8080, 'some message', auth, errFunc, {}, function (err, credentials2) {
 779
 780                     expect(err).to.exist();
 781                     expect(err.message).to.equal('Invalid credentials');
 782                     done();
 783                 });
 784             });
 785         });
 786
 787         it('should fail authorization on invalid credentials algorithm', function (done) {
 788
 789             credentialsFunc('123456', function (err, credentials1) {
 790
 791                 var auth = Hawk.client.message('example.com', 8080, 'some message', { credentials: credentials1 });
 792                 expect(auth).to.exist();
 793
 794                 var errFunc = function (id, callback) {
 795
 796                     callback(null, { key: '123', algorithm: '456' });
 797                 };
 798
 799                 Hawk.server.authenticateMessage('example.com', 8080, 'some message', auth, errFunc, {}, function (err, credentials2) {
 800
 801                     expect(err).to.exist();
 802                     expect(err.message).to.equal('Unknown algorithm');
 803                     done();
 804                 });
 805             });
 806         });
 807
 808         it('should fail on missing host', function (done) {
 809
 810             credentialsFunc('123456', function (err, credentials1) {
 811
 812                 var auth = Hawk.client.message(null, 8080, 'some message', { credentials: credentials1 });
 813                 expect(auth).to.not.exist();
 814                 done();
 815             });
 816         });
 817
 818         it('should fail on missing credentials', function (done) {
 819
 820             var auth = Hawk.client.message('example.com', 8080, 'some message', {});
 821             expect(auth).to.not.exist();
 822             done();
 823         });
 824
 825         it('should fail on invalid algorithm', function (done) {
 826
 827             credentialsFunc('123456', function (err, credentials1) {
 828
 829                 var creds = Hoek.clone(credentials1);
 830                 creds.algorithm = 'blah';
 831                 var auth = Hawk.client.message('example.com', 8080, 'some message', { credentials: creds });
 832                 expect(auth).to.not.exist();
 833                 done();
 834             });
 835         });
 836     });
 837 });