fix(security): make JwtRoundTripTest 'tampered token' deterministic

The original test flipped the LAST character of the JWT signature segment from 'a' to 'b' (or vice versa). This was flaky in CI: with a random UUID subject, the issued token's signature segment can end on a base64url character whose flipped value, when decoded, lenient- parses to bits that the JWT decoder accepts as valid — leaving the signature still verifiable. The flake was reproducible locally with `./gradlew test --rerun-tasks` and was the cause of CI failures on the P5.5 and P4.3 docs-pin commits (and would have caught the underlying chunks too if the docs commit hadn't pushed first). Fix: tamper with the PAYLOAD (middle JWT segment) instead. Any change to the payload changes the bytes the signature is computed over, which ALWAYS fails HMAC verification — no edge cases. The test now flips the first character of the payload to a definitely- different valid base64url character, leaving the format intact so the failure mode is "signature does not verify" rather than "malformed token". Verified 10 consecutive `--rerun-tasks` runs all green locally.

fix(security): make JwtRoundTripTest 'tampered token' deterministic
The original test flipped the LAST character of the JWT signature segment from 'a' to 'b' (or vice versa). This was flaky in CI: with a random UUID subject, the issued token's signature segment can end on a base64url character whose flipped value, when decoded, lenient- parses to bits that the JWT decoder accepts as valid — leaving the signature still verifiable. The flake was reproducible locally with `./gradlew test --rerun-tasks` and was the cause of CI failures on the P5.5 and P4.3 docs-pin commits (and would have caught the underlying chunks too if the docs commit hadn't pushed first). Fix: tamper with the PAYLOAD (middle JWT segment) instead. Any change to the payload changes the bytes the signature is computed over, which ALWAYS fails HMAC verification — no edge cases. The test now flips the first character of the payload to a definitely- different valid base64url character, leaving the format intact so the failure mode is "signature does not verify" rather than "malformed token". Verified 10 consecutive `--rerun-tasks` runs all green locally.
zichun
1 parent a9d4726e
Showing 1 changed file with 23 additions and 2 deletions
platform/platform-security/src/test/kotlin/org/vibeerp/platform/security/JwtRoundTripTest.kt
@@ -84,8 +84,29 @@ class JwtRoundTripTest {
     @Test
     fun `tampered token is rejected`() {
         val issued = issuer.issueAccessToken(UUID.randomUUID(), "carol")
-        // Flip the last character of the signature segment.
-        val tampered = issued.value.dropLast(1) + if (issued.value.last() == 'a') 'b' else 'a'
+        // Tamper with the PAYLOAD (middle JWT segment) by flipping one
+        // character to a definitely-different valid base64url character.
+        // Flipping the signature was flaky: the JWT spec uses unpadded
+        // base64url, and the last character of the signature can encode
+        // partial bits — flipping it sometimes produces a byte the
+        // decoder lenient-parses to the same value, leaving the
+        // signature still valid. Mutating the payload sidesteps the
+        // edge case entirely: any change to the payload changes the
+        // bytes the signature is computed over, which always fails
+        // verification.
+        val parts = issued.value.split(".")
+        require(parts.size == 3) { "expected a 3-part JWT, got ${parts.size}" }
+        val payload = parts[1]
+        // Flip the first character of the payload to a different
+        // base64url character that is guaranteed to be different from
+        // whatever was there. We pick 'A' if the first char isn't 'A',
+        // else 'B'. Both are valid base64url so the format stays
+        // intact and the failure mode is "signature does not verify",
+        // not "malformed token" — exactly what the test should assert.
+        val firstChar = payload[0]
+        val replacement = if (firstChar == 'A') 'B' else 'A'
+        val tamperedPayload = replacement + payload.substring(1)
+        val tampered = "${parts[0]}.$tamperedPayload.${parts[2]}"
         assertFailure { verifier.verify(tampered) }
             .isInstanceOf(AuthenticationFailedException::class)