From 23e9a0349ebc7c7e2c76882cc7d9a38a8cdc503e Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Tue, 23 Jun 2026 14:23:32 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=A7=AA=20Add=20tests=20for=20invalid=20ba?=
 =?UTF-8?q?se64=20JWT=20handling=20in=20echoHandler?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add `handler_test.go` and use `httptest` to cover testing for valid and invalid base64 JWT handling.
Adds explicit test cases for invalid base64 strings and invalid JSON content in the JWT payload.

Co-authored-by: ryodocx <4597213+ryodocx@users.noreply.github.com>
---
 handler_test.go | 100 ++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 100 insertions(+)
 create mode 100644 handler_test.go

diff --git a/handler_test.go b/handler_test.go
new file mode 100644
index 0000000..ee1bd2d
--- /dev/null
+++ b/handler_test.go
@@ -0,0 +1,100 @@
+package main
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+func TestEchoHandler(t *testing.T) {
+	// A helper to perform requests and parse the response map
+	performRequest := func(authHeader string) map[string]interface{} {
+		req := httptest.NewRequest(http.MethodGet, "/echo", nil)
+		if authHeader != "" {
+			req.Header.Set("Authorization", authHeader)
+		}
+		w := httptest.NewRecorder()
+		echoHandler(w, req)
+
+		res := w.Result()
+		defer res.Body.Close()
+
+		var respMap map[string]interface{}
+		if err := json.NewDecoder(res.Body).Decode(&respMap); err != nil {
+			t.Fatalf("failed to decode response: %v", err)
+		}
+		return respMap
+	}
+
+	t.Run("Valid JWT", func(t *testing.T) {
+		// Valid base64 encoding of {"alg": "none"} and {"user": "test"}
+		// eyJhbGciOiAibm9uZSJ9 = {"alg": "none"}
+		// eyJ1c2VyIjogInRlc3QifQ == {"user": "test"}
+		validHeader := "eyJhbGciOiAibm9uZSJ9"
+		validPayload := "eyJ1c2VyIjogInRlc3QifQ"
+		authHeader := "Bearer " + validHeader + "." + validPayload + ".signature"
+
+		respMap := performRequest(authHeader)
+
+		authzInfo, ok := respMap["Authorization"].(map[string]interface{})
+		if !ok {
+			t.Fatalf("Authorization missing or invalid type")
+		}
+
+		jwtInfo, ok := authzInfo["jwt"].(map[string]interface{})
+		if !ok {
+			t.Fatalf("jwt missing or invalid type")
+		}
+
+		header, ok := jwtInfo["header"].(map[string]interface{})
+		if !ok {
+			t.Fatalf("jwt header missing or invalid type")
+		}
+		if header["alg"] != "none" {
+			t.Errorf("expected alg 'none', got %v", header["alg"])
+		}
+
+		payload, ok := jwtInfo["payload"].(map[string]interface{})
+		if !ok {
+			t.Fatalf("jwt payload missing or invalid type")
+		}
+		if payload["user"] != "test" {
+			t.Errorf("expected user 'test', got %v", payload["user"])
+		}
+	})
+
+	t.Run("Invalid Base64 JWT", func(t *testing.T) {
+		// Invalid base64 characters (e.g. !@#$)
+		authHeader := "Bearer !@#$.!@#$.!@#$"
+
+		respMap := performRequest(authHeader)
+
+		authzInfo, ok := respMap["Authorization"].(map[string]interface{})
+		if !ok {
+			t.Fatalf("Authorization missing or invalid type")
+		}
+
+		// Should not contain "jwt" key because parsing failed
+		if _, exists := authzInfo["jwt"]; exists {
+			t.Errorf("expected jwt to not be present due to parsing error, but got %v", authzInfo["jwt"])
+		}
+	})
+
+	t.Run("Invalid JSON JWT", func(t *testing.T) {
+		// Valid base64 encoding of "not json" -> bm90IGpzb24
+		authHeader := "Bearer bm90IGpzb24.bm90IGpzb24.signature"
+
+		respMap := performRequest(authHeader)
+
+		authzInfo, ok := respMap["Authorization"].(map[string]interface{})
+		if !ok {
+			t.Fatalf("Authorization missing or invalid type")
+		}
+
+		// Should not contain "jwt" key because JSON parsing failed
+		if _, exists := authzInfo["jwt"]; exists {
+			t.Errorf("expected jwt to not be present due to json parsing error, but got %v", authzInfo["jwt"])
+		}
+	})
+}