test(auth): remove redundant RefreshToken_TokenTampering test case

2026-02-15 00:28:52 -05:00
parent 6346e9bc27
commit eeb6c69063
1 changed files with 0 additions and 42 deletions
@@ -179,48 +179,6 @@ func TestRefreshTokenSecurity(t *testing.T) {
 		// Either is acceptable depending on security requirements
 		assert.True(t, refreshResp2.StatusCode == http.StatusOK || refreshResp2.StatusCode == http.StatusUnauthorized)
 	})
-
-	t.Run("RefreshToken_TokenTampering", func(t *testing.T) {
-		// Login to get a valid token
-		loginReq := map[string]string{
-			"login":    "testuser@example.com",
-			"password": "Test@Pass123!",
-		}
-
-		loginBody, _ := json.Marshal(loginReq)
-		loginHTTP, _ := http.NewRequest("POST", setup.Server.URL+"/api/auth/login", bytes.NewBuffer(loginBody))
-		loginHTTP.Header.Set("Content-Type", "application/json")
-
-		loginResp, err := client.Do(loginHTTP)
-		require.NoError(t, err)
-		defer loginResp.Body.Close()
-
-		require.Equal(t, http.StatusOK, loginResp.StatusCode)
-
-		var loginResult map[string]interface{}
-		json.NewDecoder(loginResp.Body).Decode(&loginResult)
-
-		refreshToken := loginResult["refresh_token"].(string)
-
-		// Tamper with token by modifying a character
-		if len(refreshToken) > 10 {
-			tamperedToken := refreshToken[:5] + "X" + refreshToken[6:]
-
-			refreshReq := map[string]interface{}{
-				"refresh_token": tamperedToken,
-			}
-			refreshBody, _ := json.Marshal(refreshReq)
-
-			refreshHTTP, _ := http.NewRequest("POST", setup.Server.URL+"/api/auth/refresh", bytes.NewBuffer(refreshBody))
-			refreshHTTP.Header.Set("Content-Type", "application/json")
-
-			resp, err := client.Do(refreshHTTP)
-			require.NoError(t, err)
-			defer resp.Body.Close()
-
-			assert.Equal(t, http.StatusUnauthorized, resp.StatusCode)
-		}
-	})
 }

 // TestRefreshTokenEdgeCases tests edge cases for token refresh