chuanqi/cq2_sdk/tests/unit/test_box_auth.py

"""Tests for the SAZ-verified X-BOX-AUTHORIZATION signer (box_auth.py).

The signature algorithm was verified EXACT against 4 live captures
(see scripts/verify_signature_replay.py — 4/4 MATCH).
"""
import hashlib
import hmac
import json

from cq2_sdk.login.box_auth import (
    build_auth_header,
    sign_body,
    prepare_request,
    gen_random_32,
    RENDER_SIGN_KEY,
    BRIDGE_SIGN_KEY,
    APP_VERSION,
)


def test_gen_random_32():
    n = gen_random_32()
    assert len(n) == 32
    assert all(c in "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ" for c in n)
    assert gen_random_32() != gen_random_32()


# ---- Layer 2: X-BOX-AUTHORIZATION ----


def test_auth_header_format():
    auth = build_auth_header(
        method="POST",
        url="https://api.jiyuhz.cn/auth/v3/login/safe/byPwd",
        body_json="{}",
        nonce="FIXEDNONCE123",
        timestamp_ms=1789459934000,
    )
    assert auth.startswith("BOXAPP-SHA256 NONCE=FIXEDNONCE123;")
    assert "TIMESTAMP=1789459934000;" in auth
    sig = auth.split("SIGNATURE=")[1]
    assert len(sig) == 64
    assert all(c in "0123456789abcdef" for c in sig)


def test_auth_uses_path_not_full_url():
    """KEY FINDING (brute-force verified): signature uses URL path(+query),
    NOT the absolute URL."""
    a = build_auth_header(
        method="POST",
        url="https://user-api.996hezi.com/v1/WyAnticheat/riskCheck?x=1",
        body_json=None, nonce="N", timestamp_ms=1,
    )
    b = build_auth_header(
        method="POST",
        url="/v1/WyAnticheat/riskCheck?x=1",
        body_json=None, nonce="N", timestamp_ms=1,
    )
    assert a == b


def test_auth_deterministic():
    kwargs = dict(method="GET", url="/api", body_json=None, nonce="N", timestamp_ms=1)
    assert build_auth_header(**kwargs) == build_auth_header(**kwargs)


def test_auth_hmac_manual():
    """Verify against a hand-computed HMAC."""
    value = "GET\n/api\n1000\nNONCE\npc\ndevice\n5.1.1.9007\n\nUA\n\n"
    expected = hmac.new(BRIDGE_SIGN_KEY.encode(), value.encode(), hashlib.sha256).hexdigest()
    auth = build_auth_header(
        method="GET", url="/api", body_json=None, token="", device_id="device",
        user_agent="UA", nonce="NONCE", timestamp_ms=1000,
    )
    assert auth.endswith(expected)


# ---- Layer 1: body sign ----


def test_sign_body_adds_fields():
    body = {"a": "1", "b": "2"}
    signed = sign_body(body, rqtime=1000, rqrandom="RND")
    assert signed["rqtime"] == 1000
    assert signed["rqrandom"] == "RND"
    assert "sign" in signed
    assert len(signed["sign"]) == 32  # md5 hex


def test_sign_body_manual_md5():
    body = {"username": "u", "password": "p"}
    signed = sign_body(body, rqtime=777, rqrandom="ABC")
    # sorted keys: password, username -> concat "pu"
    concat = "pu" + RENDER_SIGN_KEY + "777" + "ABC"
    expected = hashlib.md5(concat.encode()).hexdigest()
    assert signed["sign"] == expected


def test_sign_body_object_values_json_stringified():
    body = {"x": {"k": 1}}
    signed = sign_body(body, rqtime=1, rqrandom="Z")
    # object value -> JSON string (compact)
    concat = '{"k":1}' + RENDER_SIGN_KEY + "1Z"
    expected = hashlib.md5(concat.encode()).hexdigest()
    assert signed["sign"] == expected


# ---- prepare_request ----


def test_prepare_request_no_layer1_by_default():
    body = {"loginInfo": "abc", "needConfirmLogin": True}
    wire, auth = prepare_request(
        method="POST",
        url="https://api.jiyuhz.cn/auth/v3/login/safe/byPwd",
        body=body,
        nonce="N",
        timestamp_ms=1,
    )
    parsed = json.loads(wire.decode())
    assert "rqtime" not in parsed  # Layer1 OFF by default (SAZ-verified behavior)
    assert "sign" not in parsed
    assert auth.startswith("BOXAPP-SHA256")


def test_prepare_request_logininfo_urlsafe():
    body = {"loginInfo": "ab+cd/ef", "needConfirmLogin": True}
    wire, _ = prepare_request(
        method="POST",
        url="https://x.com/login",
        body=body,
        encode_login_info_urlsafe=True,
        nonce="N",
        timestamp_ms=1,
    )
    parsed = json.loads(wire.decode())
    assert parsed["loginInfo"] == "ab%2Bcd%2Fef"  # + -> %2B, / -> %2F


def test_prepare_request_get_no_body():
    wire, auth = prepare_request(
        method="GET",
        url="https://pc-api.996hezi.com/box/v1/getTodayOpen?gameId=206923",
        nonce="N",
        timestamp_ms=1,
    )
    assert wire is None
    assert auth.startswith("BOXAPP-SHA256 NONCE=N;")