feat: add TurnToken HMAC for match-action anti-cheat

2026-07-25 22:39:29 -05:00
parent a0dcff2c2a
commit 3d8c1cfdb2
2 changed files with 167 additions and 0 deletions
@@ -0,0 +1,88 @@
+<?php
+
+declare(strict_types=1);
+
+namespace BattleForge\Tests\Unit\Application;
+
+use BattleForge\Application\TurnToken;
+use InvalidArgumentException;
+use PHPUnit\Framework\TestCase;
+
+final class TurnTokenTest extends TestCase
+{
+    private const SECRET = 'turn-token-test-secret';
+
+    public function testIssueIsDeterministicForTheSameInputs(): void
+    {
+        $a = TurnToken::issue(self::SECRET, '0123456789abcdef', 'alpha', 1, 0);
+        $b = TurnToken::issue(self::SECRET, '0123456789abcdef', 'alpha', 1, 0);
+
+        self::assertSame($a, $b);
+        self::assertSame(32, strlen($a));
+        self::assertMatchesRegularExpression('/^[a-f0-9]{32}$/', $a);
+    }
+
+    public function testVerifyAcceptsAFreshlyIssuedToken(): void
+    {
+        $token = TurnToken::issue(self::SECRET, '0123456789abcdef', 'alpha', 1, 0);
+
+        self::assertTrue(TurnToken::verify(self::SECRET, '0123456789abcdef', 'alpha', 1, 0, $token));
+    }
+
+    public function testVerifyRejectsAMutatedToken(): void
+    {
+        $token = TurnToken::issue(self::SECRET, '0123456789abcdef', 'alpha', 1, 0);
+        $tampered = substr($token, 0, -1) . '0';
+
+        self::assertFalse(TurnToken::verify(self::SECRET, '0123456789abcdef', 'alpha', 1, 0, $tampered));
+    }
+
+    public function testVerifyRejectsATokenFromADifferentMatch(): void
+    {
+        $token = TurnToken::issue(self::SECRET, '0123456789abcdef', 'alpha', 1, 0);
+
+        self::assertFalse(TurnToken::verify(self::SECRET, 'fedcba9876543210', 'alpha', 1, 0, $token));
+    }
+
+    public function testVerifyRejectsATokenFromADifferentTeam(): void
+    {
+        $token = TurnToken::issue(self::SECRET, '0123456789abcdef', 'alpha', 1, 0);
+
+        self::assertFalse(TurnToken::verify(self::SECRET, '0123456789abcdef', 'bravo', 1, 0, $token));
+    }
+
+    public function testVerifyRejectsATokenFromADifferentRound(): void
+    {
+        $token = TurnToken::issue(self::SECRET, '0123456789abcdef', 'alpha', 1, 0);
+
+        self::assertFalse(TurnToken::verify(self::SECRET, '0123456789abcdef', 'alpha', 2, 0, $token));
+    }
+
+    public function testVerifyRejectsATokenFromADifferentLastActionIndex(): void
+    {
+        $token = TurnToken::issue(self::SECRET, '0123456789abcdef', 'alpha', 1, 0);
+
+        self::assertFalse(TurnToken::verify(self::SECRET, '0123456789abcdef', 'alpha', 1, 1, $token));
+    }
+
+    public function testIssueRejectsAMalformedMatchId(): void
+    {
+        $this->expectException(InvalidArgumentException::class);
+
+        TurnToken::issue(self::SECRET, 'not-hex!', 'alpha', 1, 0);
+    }
+
+    public function testIssueRejectsAnEmptyActiveTeamId(): void
+    {
+        $this->expectException(InvalidArgumentException::class);
+
+        TurnToken::issue(self::SECRET, '0123456789abcdef', '', 1, 0);
+    }
+
+    public function testIssueRejectsANegativeRound(): void
+    {
+        $this->expectException(InvalidArgumentException::class);
+
+        TurnToken::issue(self::SECRET, '0123456789abcdef', 'alpha', 0, 0);
+    }
+}