Initial commit: GitHub-GCC WeCom bot for Gitea

tests/signature.test.ts

@@ -0,0 +1,25 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { signBody, verifyGitHubSignature } from "../src/signature.js";
+
+test("verifies a valid GitHub sha256 signature", async () => {
+  const body = Buffer.from(JSON.stringify({ zen: "Keep it logically awesome." }));
+  const signature = await signBody("secret", body);
+
+  assert.equal(await verifyGitHubSignature("secret", body, signature), true);
+});
+
+test("rejects an invalid GitHub sha256 signature", async () => {
+  const body = Buffer.from(JSON.stringify({ ok: true }));
+
+  assert.equal(await verifyGitHubSignature("secret", body, "sha256=bad"), false);
+  assert.equal(await verifyGitHubSignature("secret", body, undefined), false);
+  assert.equal(await verifyGitHubSignature("secret", body, "sha1=bad"), false);
+});
+
+test("verifies a raw Gitea hex signature", async () => {
+  const body = Buffer.from(JSON.stringify({ zen: "Keep it logically awesome." }));
+  const signature = await signBody("secret", body);
+
+  assert.equal(await verifyGitHubSignature("secret", body, signature.slice("sha256=".length)), true);
+});