secutil

func AssertAuditEvent ¶

func AssertAuditEvent(t *testing.T, c *BufferedChronicle, action string, inspect func(*bridge.AuditEvent))

AssertAuditEvent fails the test unless EXACTLY ONE event with the given action was recorded. If a single match is found and inspect is non-nil, inspect is invoked with a pointer to the matched event so callers can make additional assertions.

func AssertNoAuditEvent ¶

func AssertNoAuditEvent(t *testing.T, c *BufferedChronicle, action string)

AssertNoAuditEvent fails the test if any event with the given action was recorded.

func AttachChronicle ¶

func AttachChronicle(t *testing.T, eng *authsome.Engine, ch *BufferedChronicle)

AttachChronicle replaces the engine's chronicle with the given buffered chronicle so a test can assert against recorded events. Call sites that emit audit via plugin-cached references should re-resolve from the engine after this call (see organization.Plugin.SetChronicleForTest).

func AttackRequest ¶

func AttackRequest(t *testing.T, method, target string, body []byte) *http.Request

AttackRequest builds an httptest request that DELIBERATELY omits Origin, Referer, and Cookie headers. This guarantees attack-replay tests cannot accidentally pass because of friendly default headers; callers must add any header they actually need to simulate.

func InjectStoreFault ¶

func InjectStoreFault(t *testing.T, eng *authsome.Engine, method string, err error)

InjectStoreFault makes the named store method return err on its next call against the underlying memory store. Test-only.

func NewTestEngine ¶

func NewTestEngine(t *testing.T, opts ...authsome.Option) *authsome.Engine

NewTestEngine spins up an authsome engine backed by an in-memory store with deterministic test secrets. The engine is started and registered for cleanup via t.Cleanup, so tests don't need to call Stop.

Additional options can be supplied to override or extend the defaults.

func OnAfterOrgDelete ¶

func OnAfterOrgDelete(t *testing.T, eng *authsome.Engine, fn func(context.Context, id.OrgID) error)

OnAfterOrgDelete registers an additional AfterOrgDelete hook for the test. The registered plugin leaks for the engine's lifetime (no Unregister API exists yet), which is acceptable because the engine is scoped to the test via NewTestEngine.

func OnBeforeMemberRemove ¶

func OnBeforeMemberRemove(t *testing.T, eng *authsome.Engine, fn func(context.Context, *organization.Member) error)

OnBeforeMemberRemove registers an additional BeforeMemberRemove hook for the test. The registered plugin leaks for the engine's lifetime (no Unregister API exists yet), which is acceptable because the engine is scoped to the test via NewTestEngine.

func RelaxAuthDefaults ¶

func RelaxAuthDefaults(t *testing.T, eng *authsome.Engine)

RelaxAuthDefaults disables the production-secure auth defaults that would otherwise break the bulk of authsome's pre-existing tests:

• SettingRequireEmailVerification (default true since Phase 2A) is overridden to false at the global scope so signed-up users can sign in immediately without going through the verification flow.

Tests that specifically exercise these gates (verification-required, captcha-required, etc.) should write their own per-app overrides on top of this baseline; this helper covers the "I just want a usable engine for a sign-in test" case.

Centralised here so additions to the secure-by-default set don't require touching every test bootstrap individually.

func VerifyEmail ¶

func VerifyEmail(t *testing.T, eng *authsome.Engine, userID id.UserID)

VerifyEmail proves the user's email through the real OTP path: it has the engine issue a code, the same way a resend does, and submits it. The store keeps codes only as hashes, so the code sign-up issued cannot be read back; issuing a fresh one retires it. Use this wherever a test needs a verified user, including the first platform user, whose ownership is only granted on verification.