agora-token 2.0.4 → 2.0.6

package/test/AccessToken2Test.js

@@ -3,7 +3,26 @@
  * nodeunit AccessTokenTest.js
  * see https://github.com/caolan/nodeunit
  */
-const { AccessToken2, ServiceRtc, ServiceRtm, ServiceChat } = require('../src/AccessToken2')
+const {
+    AccessToken2,
+    Rtm2Permissions,
+    Service,
+    ServiceRtc,
+    ServiceRtm,
+    ServiceStreaming,
+    ServiceFCdn,
+    ServiceRtm2,
+    ServiceChat,
+    kRtcServiceType,
+    kRtmServiceType,
+    kStreamingServiceType,
+    kFCdnServiceType,
+    kRtm2ServiceType,
+    kChatServiceType
+} = require('../src/AccessToken2')
+const fs = require('fs')
+const path = require('path')
+const Module = require('module')
 
 var appID = '970CA35de60c44645bbae8a215061b33'
 var appCertificate = '5CFd2fd1755d40ecb72977518be15d3b'
@@ -15,6 +34,15 @@ var expire = 600
 var salt = 1
 var user_id = 'test_user'
 
+// Represents an unsupported service type for forward compatibility tests.
+class UnknownService extends Service {
+    // Creates a service whose type is not registered by AccessToken2.
+    constructor(serviceType = 999) {
+        super(serviceType)
+    }
+}
+
+// Verifies deterministic RTC token generation with a numeric user ID.
 exports.AccessToken_Test = function (test) {
     var expected =
         '007eJxTYBBbsMMnKq7p9Hf/HcIX5kce9b518kCiQgSr5Zrp4X1Tu6UUGCzNDZwdjU1TUs0Mkk1MzExMk5ISUy0SjQxNDcwMk4yN3b8IMEQwMTAwMoAwBIL4CgzmKeZGxmamqUmWFsYmFqbGluapxqnGaZYpJmYGSSkpiVwMRhYWRsYmhkbmxgDCaiTj'
@@ -30,7 +58,7 @@ exports.AccessToken_Test = function (test) {
     test.done()
 }
 
-// test uid = 0
+// Verifies deterministic RTC token generation with an empty user ID.
 exports.AccessToken_Test2 = function (test) {
     var expected =
         '007eJxTYLhzZP08Lxa1Pg57+TcXb/3cZ3wi4V6kbpbOog0G2dOYk20UGCzNDZwdjU1TUs0Mkk1MzExMk5ISUy0SjQxNDcwMk4yN3b8IMEQwMTAwMoAwBIL4CgzmKeZGxmamqUmWFsYmFqbGluapxqnGaZYpJmYGSSkpiQwMADacImo='
@@ -46,7 +74,7 @@ exports.AccessToken_Test2 = function (test) {
     test.done()
 }
 
-// test service rtc account
+// Verifies deterministic RTC token generation with a string user account.
 exports.AccessToken_Test3 = function (test) {
     var expected =
         '007eJxTYBBbsMMnKq7p9Hf/HcIX5kce9b518kCiQgSr5Zrp4X1Tu6UUGCzNDZwdjU1TUs0Mkk1MzExMk5ISUy0SjQxNDcwMk4yN3b8IMEQwMTAwMoAwBIL4CgzmKeZGxmamqUmWFsYmFqbGluapxqnGaZYpJmYGSSkpiVwMRhYWRsYmhkbmxgDCaiTj'
@@ -62,7 +90,7 @@ exports.AccessToken_Test3 = function (test) {
     test.done()
 }
 
-// test service multi service
+// Verifies deterministic token generation with distinct service types.
 exports.AccessToken_Test4 = function (test) {
     var expected =
         '007eJxTYOAQsrQ5s3TfH+1tvy8zZZ46EpCc0V43JXdGd2jS8porKo4KDJbmBs6OxqYpqWYGySYmZiamSUmJqRaJRoamBmaGScbG7l8EGCKYGBgYGRgYmBgYGVgYGMF8JjDJDCZZwKQCg3mKuZGxmWlqkqWFsYmFqbGleapxqnGaZYqJmUFSSkoiF4ORhYWRsYmhkbkxyCyISZwMJanFJfGlxalFACKnKng='
@@ -85,6 +113,7 @@ exports.AccessToken_Test4 = function (test) {
     test.done()
 }
 
+// Verifies deterministic Chat user token generation.
 exports.AccessToken_Test_buildChatUserToken = function (test) {
     var expected =
         '007eJxTYNAIsnbS3v/A5t2TC6feR15r+6cq8bqAvfaW+tk/Vzz+p6xTYLA0N3B2NDZNSTUzSDYxMTMxTUpKTLVINDI0NTAzTDI2dv8iwBDBxMDAyADCrAyMDIxgPheDkYWFkbGJoZG5MQAfpR64'
@@ -100,6 +129,7 @@ exports.AccessToken_Test_buildChatUserToken = function (test) {
     test.done()
 }
 
+// Verifies deterministic Chat application token generation.
 exports.AccessToken_Test_buildChatAppToken = function (test) {
     var expected =
         '007eJxTYNDNaz3snC8huEfHWdz6s98qltq4zqy9fl99Uh0FDvy6F6DAYGlu4OxobJqSamaQbGJiZmKalJSYapFoZGhqYGaYZGzs/kWAIYKJgYGRAYRZGRgZmMB8BgYArfIYaw=='
@@ -114,3 +144,300 @@ exports.AccessToken_Test_buildChatAppToken = function (test) {
     test.equal(expected, actual)
     test.done()
 }
+
+// Preserves repeated service types and their insertion order after parsing.
+exports.AccessToken_Test_repeatedServiceTypes = function (test) {
+    const token = new AccessToken2(appID, appCertificate, ts, expire)
+    token.salt = salt
+
+    const rtmService = new ServiceRtm(user_id)
+    rtmService.add_privilege(ServiceRtm.kPrivilegeLogin, expire + 50)
+    token.add_service(rtmService)
+
+    const rtcService = new ServiceRtc(channel, uid)
+    rtcService.add_privilege(ServiceRtc.kPrivilegeJoinChannel, expire)
+    token.add_service(rtcService)
+
+    const streamRtcService = new ServiceRtc('stream-channel', 'stream-user')
+    streamRtcService.add_privilege(ServiceRtc.kPrivilegeJoinChannel, expire + 100)
+    streamRtcService.add_privilege(ServiceRtc.kPrivilegePublishDataStream, expire + 100)
+    token.add_service(streamRtcService)
+
+    const encoded = token.build()
+    test.equal(3, token.services.length)
+    test.strictEqual(rtmService, token.services[0])
+    test.equal(2, token.getServices(kRtcServiceType).length)
+
+    const parsed = new AccessToken2('', '', 0, 0)
+    test.equal(true, parsed.from_string(encoded))
+    const rtcServices = parsed.getServices(kRtcServiceType)
+    test.equal(2, rtcServices.length)
+    test.equal(channel, rtcServices[0].__channel_name.toString())
+    test.equal('stream-channel', rtcServices[1].__channel_name.toString())
+    test.equal(expire + 100, rtcServices[1].__privileges[ServiceRtc.kPrivilegePublishDataStream])
+    test.equal(1, parsed.getServices(kRtmServiceType).length)
+    test.equal(0, parsed.getServices(kChatServiceType).length)
+    test.equal(true, parsed.verifySignature(appCertificate))
+    test.equal(false, parsed.verifySignature('aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'))
+    test.done()
+}
+
+// Parses and verifies C++ Streaming, FCDN, and RTM2 services.
+exports.AccessToken_Test_extendedServicesFromCpp = function (test) {
+    const encoded = '007eJxTYPj86Lzdz79M25wNn/lMfvu+TkfmdpiviKvChm8ZV3SWndytwGBpbuDsaGyakmpmkGxiYmZimpSUmGqRaGRoamBmmGRs7P5FgCGCiYGBkYGBgRkImYAsEJ8JTCowmKeYGxmbmaYmWVoYm1iYGluapxqnGqdZppiYGSSlpCRyMRhZWBgZmxgamRuzUaSbA6gXopuToSS1uCS+tDi1iJkB4jQmoGBuanFxYnqqbiKCmcTIAIEcDMUlRamJubqJLGD1jAxsDCD9uokAO/VDvQ=='
+    const parsed = new AccessToken2('', '', 0, 0)
+
+    test.equal(true, parsed.from_string(encoded))
+    test.equal(true, parsed.verifySignature(appCertificate))
+
+    const streaming = parsed.getServices(kStreamingServiceType)[0]
+    test.equal(channel, streaming.__channel_name.toString())
+    test.equal(uidStr, streaming.__account.toString())
+    test.equal(expire, streaming.__privileges[ServiceStreaming.kPrivilegePublishMixStream])
+    test.equal(expire, streaming.__privileges[ServiceStreaming.kPrivilegePublishRawStream])
+
+    const fcdn = parsed.getServices(kFCdnServiceType)[0]
+    test.equal(channel, fcdn.__channel_name.toString())
+    test.equal(uidStr, fcdn.__account.toString())
+    test.equal(expire, fcdn.__privileges[ServiceFCdn.kPrivilegePublish])
+    test.equal(expire, fcdn.__privileges[ServiceFCdn.kPrivilegePlay])
+
+    const rtm2 = parsed.getServices(kRtm2ServiceType)[0]
+    test.equal(user_id, rtm2.__user_id.toString())
+    test.deepEqual({
+        0: { 0: ['message-a', 'message-b'] },
+        1: { 1: ['stream-a'] },
+        4: { 0: ['user-a'] }
+    }, rtm2.__permissions.details)
+    test.equal(expire, rtm2.__privileges[ServiceRtm2.kPrivilegeLogin])
+    test.done()
+}
+
+// Verifies deterministic Streaming and FCDN generation and UID conversion against C++.
+exports.AccessToken_Test_extendedServiceNumericUidConversion = function (test) {
+    const token = new AccessToken2(appID, appCertificate, ts, expire)
+    token.salt = salt
+    const streamingUid = new ServiceStreaming(channel, uid)
+    streamingUid.add_privilege(ServiceStreaming.kPrivilegePublishMixStream, expire)
+    token.add_service(streamingUid)
+    const streamingWildcard = new ServiceStreaming(channel, 0)
+    streamingWildcard.add_privilege(ServiceStreaming.kPrivilegePublishRawStream, expire)
+    token.add_service(streamingWildcard)
+    const streamingAccount = new ServiceStreaming(channel, 'stream-account')
+    streamingAccount.add_privilege(ServiceStreaming.kPrivilegePublishMixStream, expire)
+    streamingAccount.add_privilege(ServiceStreaming.kPrivilegePublishRawStream, expire)
+    token.add_service(streamingAccount)
+    const fcdnUid = new ServiceFCdn(channel, uid)
+    fcdnUid.add_privilege(ServiceFCdn.kPrivilegePublish, expire)
+    token.add_service(fcdnUid)
+    const fcdnWildcard = new ServiceFCdn(channel, 0)
+    fcdnWildcard.add_privilege(ServiceFCdn.kPrivilegePlay, expire)
+    token.add_service(fcdnWildcard)
+    const fcdnAccount = new ServiceFCdn(channel, 'fcdn-account')
+    fcdnAccount.add_privilege(ServiceFCdn.kPrivilegePublish, expire)
+    fcdnAccount.add_privilege(ServiceFCdn.kPrivilegePlay, expire)
+    token.add_service(fcdnAccount)
+
+    const encoded = token.build()
+    test.equal(
+        encoded,
+        '007eJxTYLi93GuuUHrO9Fr71KVJKqfDby8RezlVfGLMO77DIl79U40UGCzNDZwdjU1TUs0Mkk1MzExMk5ISUy0SjQxNDcwMk4yN3b8IMEQwMTAwMjAwsDEwMzAyMIL5CgzmKeZGxmamqUmWFsYmFqbGluapxqnGaZYpJmYGSSkpiVwMRhYWRsYmhkbmxiB9TETqY2BgZmCC2kKsHj6G4pKi1MRc3cTk5PzSvBI2Mt3JRpI72Uh2Jw9DWnJKHsyVAElvX1c='
+    )
+    const parsed = new AccessToken2('', '', 0, 0)
+    test.equal(true, parsed.from_string(encoded))
+    test.deepEqual(
+        parsed.getServices(kStreamingServiceType).map(service => service.__account.toString()),
+        [uidStr, '', 'stream-account']
+    )
+    test.deepEqual(
+        parsed.getServices(kFCdnServiceType).map(service => service.__account.toString()),
+        [uidStr, '', 'fcdn-account']
+    )
+    test.done()
+}
+
+// Generates and parses an RTM2 token whose uncompressed payload exceeds the initial buffer capacity.
+exports.AccessToken_Test_largeRtm2PermissionPayload = function (test) {
+    const resources = Array.from({ length: 160 }, (_, index) => `resource-${index.toString().padStart(4, '0')}`)
+    const permissions = new Rtm2Permissions()
+    permissions.add(Rtm2Permissions.kUsers, Rtm2Permissions.kRead, resources)
+
+    const token = new AccessToken2(appID, appCertificate, ts, expire)
+    token.salt = salt
+    const rtm2Service = new ServiceRtm2(user_id, permissions)
+    rtm2Service.add_privilege(ServiceRtm2.kPrivilegeLogin, expire)
+    token.add_service(rtm2Service)
+
+    const parsed = new AccessToken2('', '', 0, 0)
+    test.equal(true, parsed.from_string(token.build()))
+    test.equal(true, parsed.verifySignature(appCertificate))
+    test.deepEqual(resources, parsed.getServices(kRtm2ServiceType)[0].__permissions.details[Rtm2Permissions.kUsers][Rtm2Permissions.kRead])
+    test.done()
+}
+
+// Keeps known services parsed before an unknown service type.
+exports.AccessToken_Test_unknownServiceAfterKnownService = function (test) {
+    const token = new AccessToken2(appID, appCertificate, ts, expire)
+    token.salt = salt
+
+    const rtcService = new ServiceRtc(channel, uid)
+    rtcService.add_privilege(ServiceRtc.kPrivilegeJoinChannel, expire)
+    token.add_service(rtcService)
+
+    const unknownService = new UnknownService()
+    unknownService.add_privilege(1, expire)
+    token.add_service(unknownService)
+
+    const parsed = new AccessToken2('', '', 0, 0)
+    test.equal(true, parsed.from_string(token.build()))
+    test.equal(1, parsed.getServices(kRtcServiceType).length)
+    test.equal(0, parsed.getServices(999).length)
+    test.equal(true, parsed.verifySignature(appCertificate))
+    test.done()
+}
+
+// Stops before known services that follow an unknown service payload.
+exports.AccessToken_Test_unknownServiceBeforeKnownService = function (test) {
+    const token = new AccessToken2(appID, appCertificate, ts, expire)
+    token.salt = salt
+
+    const rtcService = new ServiceRtc(channel, uid)
+    rtcService.add_privilege(ServiceRtc.kPrivilegeJoinChannel, expire)
+    token.add_service(rtcService)
+
+    const unknownService = new UnknownService(0)
+    unknownService.add_privilege(1, expire)
+    token.add_service(unknownService)
+
+    const parsed = new AccessToken2('', '', 0, 0)
+    test.equal(true, parsed.from_string(token.build()))
+    test.equal(0, parsed.getServices(kRtcServiceType).length)
+    test.equal(true, parsed.verifySignature(appCertificate))
+    test.done()
+}
+
+// Parses an old token and replaces services from an earlier parse.
+exports.AccessToken_Test_parseOldTokenAndClearServices = function (test) {
+    const token = new AccessToken2(appID, appCertificate, ts, expire)
+    token.salt = salt
+    const rtmService = new ServiceRtm(user_id)
+    rtmService.add_privilege(ServiceRtm.kPrivilegeLogin, expire)
+    token.add_service(rtmService)
+
+    const parsed = new AccessToken2('', '', 0, 0)
+    test.equal(true, parsed.from_string(token.build()))
+    test.equal(1, parsed.getServices(kRtmServiceType).length)
+
+    const oldToken =
+        '007eJxTYBBbsMMnKq7p9Hf/HcIX5kce9b518kCiQgSr5Zrp4X1Tu6UUGCzNDZwdjU1TUs0Mkk1MzExMk5ISUy0SjQxNDcwMk4yN3b8IMEQwMTAwMoAwBIL4CgzmKeZGxmamqUmWFsYmFqbGluapxqnGaZYpJmYGSSkpiVwMRhYWRsYmhkbmxgDCaiTj'
+    test.equal(true, parsed.from_string(oldToken))
+    test.equal(1, parsed.services.length)
+    test.equal(1, parsed.getServices(kRtcServiceType).length)
+    test.equal(0, parsed.getServices(kRtmServiceType).length)
+    test.equal(true, parsed.verifySignature(appCertificate))
+    test.done()
+}
+
+// Rejects signature verification before parsing or with invalid certificates.
+exports.AccessToken_Test_verifySignaturePreconditions = function (test) {
+    const parsed = new AccessToken2('', '', 0, 0)
+    test.equal(false, parsed.verifySignature(appCertificate))
+
+    const token = new AccessToken2(appID, appCertificate, ts, expire)
+    token.salt = salt
+    const rtcService = new ServiceRtc(channel, uid)
+    rtcService.add_privilege(ServiceRtc.kPrivilegeJoinChannel, expire)
+    token.add_service(rtcService)
+
+    test.equal(true, parsed.from_string(token.build()))
+    test.equal(false, parsed.verifySignature(null))
+    test.equal(false, parsed.verifySignature('invalid'))
+    test.equal(false, parsed.verifySignature('zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz'))
+    test.equal(true, parsed.verifySignature(appCertificate))
+
+    test.equal(false, parsed.from_string('006invalid'))
+    test.equal(false, parsed.verifySignature(appCertificate))
+    test.equal(0, parsed.services.length)
+    test.done()
+}
+
+// Sorts distinct service types before packing without changing insertion order.
+exports.AccessToken_Test_stableServiceTypeOrdering = function (test) {
+    const token = new AccessToken2(appID, appCertificate, ts, expire)
+    token.salt = salt
+
+    const rtmService = new ServiceRtm(user_id)
+    rtmService.add_privilege(ServiceRtm.kPrivilegeLogin, expire)
+    token.add_service(rtmService)
+
+    const rtcService = new ServiceRtc(channel, uid)
+    rtcService.add_privilege(ServiceRtc.kPrivilegeJoinChannel, expire)
+    rtcService.add_privilege(ServiceRtc.kPrivilegePublishAudioStream, expire)
+    rtcService.add_privilege(ServiceRtc.kPrivilegePublishVideoStream, expire)
+    rtcService.add_privilege(ServiceRtc.kPrivilegePublishDataStream, expire)
+    token.add_service(rtcService)
+
+    const expected =
+        '007eJxTYOAQsrQ5s3TfH+1tvy8zZZ46EpCc0V43JXdGd2jS8porKo4KDJbmBs6OxqYpqWYGySYmZiamSUmJqRaJRoamBmaGScbG7l8EGCKYGBgYGRgYmBgYGVgYGMF8JjDJDCZZwKQCg3mKuZGxmWlqkqWFsYmFqbGleapxqnGaZYqJmUFSSkoiF4ORhYWRsYmhkbkxyCyISZwMJanFJfGlxalFACKnKng='
+    test.equal(expected, token.build())
+    test.strictEqual(rtmService, token.services[0])
+    test.done()
+}
+
+// Rejects invalid build fields, non-string tokens, and malformed Token007 payloads.
+exports.AccessToken_Test_invalidBuildAndParseInputs = function (test) {
+    const empty = new AccessToken2(appID, appCertificate, ts, expire)
+    test.equal('', empty.build())
+
+    const invalid = new AccessToken2('invalid', appCertificate, ts, expire)
+    const service = new ServiceRtc(channel, uid)
+    service.add_privilege(ServiceRtc.kPrivilegeJoinChannel, expire)
+    invalid.add_service(service)
+    test.equal('', invalid.build())
+
+    const parsed = new AccessToken2('', '', 0, 0)
+    test.equal(false, parsed.from_string(null))
+    test.equal(false, parsed.from_string('00'))
+    test.equal(false, parsed.from_string('007invalid'))
+    test.done()
+}
+
+// Rejects verification when the parsed signature length is altered.
+exports.AccessToken_Test_signatureLengthMismatch = function (test) {
+    const token = new AccessToken2(appID, appCertificate, ts, expire)
+    token.salt = salt
+    const service = new ServiceRtc(channel, uid)
+    service.add_privilege(ServiceRtc.kPrivilegeJoinChannel, expire)
+    token.add_service(service)
+
+    const parsed = new AccessToken2('', '', 0, 0)
+    test.equal(true, parsed.from_string(token.build()))
+    parsed.__signature = Buffer.alloc(1)
+    test.equal(false, parsed.verifySignature(appCertificate))
+    test.done()
+}
+
+// Exercises private buffer helpers that are retained for wire-format compatibility.
+exports.AccessToken_Test_bufferHelpers = function (test) {
+    const filename = path.resolve(__dirname, '../src/AccessToken2.js')
+    const source = fs.readFileSync(filename, 'utf8') +
+        '\nmodule.exports.__ByteBuf = ByteBuf; module.exports.__ReadByteBuf = ReadByteBuf;'
+    const internalModule = new Module(filename, module)
+    internalModule.filename = filename
+    internalModule.paths = Module._nodeModulePaths(path.dirname(filename))
+    internalModule._compile(source, filename)
+    const ByteBuf = internalModule.exports.__ByteBuf
+    const ReadByteBuf = internalModule.exports.__ReadByteBuf
+
+    const signed = new ByteBuf().putInt32(-7).putInt16(-2).pack()
+    test.equal(-7, signed.readInt32LE(0))
+    test.equal(-2, signed.readInt16LE(4))
+    test.equal(2, new ByteBuf().putTreeMap(null).pack().length)
+    test.equal(2, new ByteBuf().putTreeMapUInt32(null).pack().length)
+    test.ok(new ByteBuf().putTreeMap({ 1: 'value' }).pack().length > 2)
+
+    const reader = new ReadByteBuf(Buffer.from([1, 0, 2, 0, 0, 0]))
+    test.equal(1, reader.getUint16())
+    test.equal(2, reader.getUint32())
+    test.done()
+}

package/test/AccessTokenTest.js

@@ -5,6 +5,11 @@
  */
 const AccessToken = require("../src/AccessToken").AccessToken;
 const Priviledges = require("../src/AccessToken").priviledges;
+const RtcTokenBuilder = require('../src/RtcTokenBuilder').RtcTokenBuilder;
+const SignalingToken = require('../src/SignalingToken');
+const fs = require('fs');
+const path = require('path');
+const Module = require('module');
 
 const appID = "970CA35de60c44645bbae8a215061b33";
 const appCertificate = "5CFd2fd1755d40ecb72977518be15d3b";
@@ -14,6 +19,7 @@ const salt = 1;
 const ts = 1111111;
 const expireTimestamp = 1446455471;
 
+// Verifies deterministic legacy AccessToken generation.
 exports.AccessToken_Test = function (test) {
     const expected = "006970CA35de60c44645bbae8a215061b33IACV0fZUBw+72cVoL9eyGGh3Q6Poi8bgjwVLnyKSJyOXR7dIfRBXoFHlEAABAAAAR/QQAAEAAQCvKDdW";
 
@@ -27,7 +33,7 @@ exports.AccessToken_Test = function (test) {
     test.done();
 };
 
-// test uid = 0
+// Verifies deterministic legacy AccessToken generation with an empty user ID.
 exports.AccessToken_Test2 = function (test) {
     const expected = "006970CA35de60c44645bbae8a215061b33IACw1o7htY6ISdNRtku3p9tjTPi0jCKf9t49UHJhzCmL6bdIfRAAAAAAEAABAAAAR/QQAAEAAQCvKDdW";
 
@@ -44,6 +50,7 @@ exports.AccessToken_Test2 = function (test) {
 
 const RtcRole = require("../src/RtcTokenBuilder").Role;
 
+// Verifies deterministic legacy RTC token generation.
 exports.RtcTokenBuilder_Test = function (test) {
     const appID = "970CA35de60c44645bbae8a215061b33";
     const certificate = "5CFd2fd1755d40ecb72977518be15d3b";
@@ -75,3 +82,57 @@ exports.RtcTokenBuilder_Test = function (test) {
     test.equal(expected, actual);
     test.done();
 };
+
+// Verifies legacy token parsing and malformed input handling.
+exports.AccessToken_Parse_Test = function (test) {
+    const key = new AccessToken(appID, appCertificate, channel, uid);
+    key.salt = salt;
+    key.ts = ts;
+    key.addPriviledge(Priviledges.kJoinChannel, expireTimestamp);
+
+    const parsed = new AccessToken('', '', '', '');
+    test.equal(true, parsed.fromString(key.build()));
+    test.equal(expireTimestamp, parsed.messages[Priviledges.kJoinChannel]);
+    test.equal(false, parsed.fromString('007invalid'));
+    test.equal(false, parsed.fromString('006' + appID + '!'));
+    test.done();
+};
+
+// Verifies both public legacy RTC builder entry points.
+exports.RtcTokenBuilder_PublicMethods_Test = function (test) {
+    const uidToken = RtcTokenBuilder.buildTokenWithUid(
+        appID, appCertificate, channel, uid, RtcRole.PUBLISHER, expireTimestamp);
+    const accountToken = RtcTokenBuilder.buildTokenWithAccount(
+        appID, appCertificate, channel, String(uid), RtcRole.SUBSCRIBER, expireTimestamp);
+
+    test.equal(true, new AccessToken('', '', '', '').fromString(uidToken));
+    test.equal(true, new AccessToken('', '', '', '').fromString(accountToken));
+    test.done();
+};
+
+// Verifies signaling token generation for explicit and one-day lifetimes.
+exports.SignalingToken_Test = function (test) {
+    const token = SignalingToken.get(appID, appCertificate, String(uid), 60);
+    const oneDayToken = SignalingToken.get1DayToken(appID, appCertificate, String(uid));
+
+    test.equal(4, token.split(':').length);
+    test.equal(appID, token.split(':')[1]);
+    test.equal(4, oneDayToken.split(':').length);
+    test.done();
+};
+
+// Exercises legacy private map writers retained by the Token006 wire format.
+exports.AccessToken_BufferHelpers_Test = function (test) {
+    const filename = path.resolve(__dirname, '../src/AccessToken.js');
+    const source = fs.readFileSync(filename, 'utf8') + '\nmodule.exports.__ByteBuf = ByteBuf;';
+    const internalModule = new Module(filename, module);
+    internalModule.filename = filename;
+    internalModule.paths = Module._nodeModulePaths(path.dirname(filename));
+    internalModule._compile(source, filename);
+    const ByteBuf = internalModule.exports.__ByteBuf;
+
+    test.equal(2, new ByteBuf().putTreeMap(null).pack().length);
+    test.ok(new ByteBuf().putTreeMap({ 1: 'value' }).pack().length > 2);
+    test.equal(2, new ByteBuf().putTreeMapUInt32(null).pack().length);
+    test.done();
+};

package/test/ApaasTokenBuilderTest.js

@@ -12,18 +12,21 @@ const roomUuid = '123'
 const userUuid = '2882341273'
 const role = 1
 
+// Verifies APaaS room-user token generation and parsing.
 exports.BuildRoomUserToken_Test = function (test) {
     let accessToken = new AccessToken2('', '', 0, 0)
     let token = ApaasTokenBuilder.buildRoomUserToken(appId, appCertificate, roomUuid, userUuid, role, expire)
     accessToken.from_string(token)
+    const service = accessToken.getServices(kApaasServiceType)[0]
     test.equal(appId, accessToken.appId)
     test.equal(expire, accessToken.expire)
-    test.equal(roomUuid, accessToken.services[kApaasServiceType].__room_uuid)
-    test.equal(userUuid, accessToken.services[kApaasServiceType].__user_uuid)
-    test.equal(role, accessToken.services[kApaasServiceType].__role)
+    test.equal(roomUuid, service.__room_uuid)
+    test.equal(userUuid, service.__user_uuid)
+    test.equal(role, service.__role)
     test.done()
 }
 
+// Verifies APaaS user token generation and parsing.
 exports.BuildUserToken_Test = function (test) {
     let accessToken = new AccessToken2('', '', 0, 0)
     let token = ApaasTokenBuilder.buildUserToken(appId, appCertificate, userUuid, expire)
@@ -31,10 +34,11 @@ exports.BuildUserToken_Test = function (test) {
 
     test.equal(appId, accessToken.appId)
     test.equal(expire, accessToken.expire)
-    test.equal(userUuid, accessToken.services[kApaasServiceType].__user_uuid)
+    test.equal(userUuid, accessToken.getServices(kApaasServiceType)[0].__user_uuid)
     test.done()
 }
 
+// Verifies APaaS application token generation and parsing.
 exports.BuildAppToken_Test = function (test) {
     let accessToken = new AccessToken2('', '', 0, 0)
     let token = ApaasTokenBuilder.buildAppToken(appId, appCertificate, expire)

package/test/ChatTokenBuilderTest.js

@@ -11,24 +11,26 @@ const appCertificate = "5CFd2fd1755d40ecb72977518be15d3b";
 const userUuid = "2882341273";
 const expire = 600;
 
+// Verifies Chat user token generation and parsing.
 exports.buildUserToken_Test = function (test) {
     let token = ChatTokenBuilder.buildUserToken(appId, appCertificate, userUuid, expire);
     let accessToken = new AccessToken2("", "", 0, 0);
     accessToken.from_string(token);
+    const service = accessToken.getServices(kChatServiceType)[0];
     test.equal(appId, accessToken.appId);
     test.equal(expire, accessToken.expire);
-    test.equal(userUuid, accessToken.services[kChatServiceType].__user_id);
-    test.equal(expire, accessToken.services[kChatServiceType].__privileges[ServiceChat.kPrivilegeUser]);
+    test.equal(userUuid, service.__user_id);
+    test.equal(expire, service.__privileges[ServiceChat.kPrivilegeUser]);
     test.done();
 };
 
+// Verifies Chat application token generation and parsing.
 exports.buildAppToken_Test = function (test) {
 	let token = ChatTokenBuilder.buildAppToken(appId, appCertificate, expire);
     let accessToken = new AccessToken2("", "", 0, 0);
     accessToken.from_string(token);
     test.equal(appId, accessToken.appId);
     test.equal(expire, accessToken.expire);
-    test.equal(expire, accessToken.services[kChatServiceType].__privileges[ServiceChat.kPrivilegeApp]);
+    test.equal(expire, accessToken.getServices(kChatServiceType)[0].__privileges[ServiceChat.kPrivilegeApp]);
     test.done();
 }
-

package/test/ConvoAITokenBuilderTest.js

@@ -0,0 +1,58 @@
+/**
+ * run this test with command:
+ * nodeunit test/ConvoAITokenBuilderTest.js
+ */
+const { ConvoAITokenBuilder } = require('../src/ConvoAITokenBuilder')
+const { AccessToken2, kConvoAIServiceType, kRtcServiceType, kRtmServiceType, ServiceRtc, ServiceRtm } = require('../src/AccessToken2')
+const { Role } = require('../src/RtcTokenBuilder2')
+
+const appId = '970CA35de60c44645bbae8a215061b33'
+const appCertificate = '5CFd2fd1755d40ecb72977518be15d3b'
+const channelName = '7d72365eb983485397e3e3f9d460bdda'
+const rtcAccount = '2882341273'
+const rtmUserId = '2882341273'
+const rtcTokenExpire = 600
+const joinChannelPrivilegeExpire = 600
+const pubAudioPrivilegeExpire = 600
+const pubVideoPrivilegeExpire = 600
+const pubDataStreamPrivilegeExpire = 600
+const rtmTokenExpire = 600
+
+exports.buildToken_PUBLISHER_Test = function (test) {
+    const token = ConvoAITokenBuilder.buildToken(
+        appId, appCertificate, channelName, rtcAccount, Role.PUBLISHER, rtcTokenExpire,
+        joinChannelPrivilegeExpire, pubAudioPrivilegeExpire, pubVideoPrivilegeExpire,
+        pubDataStreamPrivilegeExpire, rtmUserId, rtmTokenExpire)
+    const parsed = new AccessToken2('', '', 0, 0)
+    parsed.from_string(token)
+
+    const rtc = parsed.getServices(kRtcServiceType)[0]
+    const rtm = parsed.getServices(kRtmServiceType)[0]
+    const convoai = parsed.getServices(kConvoAIServiceType)[0]
+
+    test.equal(appId, parsed.appId)
+    test.equal(rtcTokenExpire, parsed.expire)
+    test.equal(channelName, rtc.__channel_name)
+    test.equal(rtcAccount, rtc.__uid)
+    test.equal(joinChannelPrivilegeExpire, rtc.__privileges[ServiceRtc.kPrivilegeJoinChannel])
+    test.equal(pubAudioPrivilegeExpire, rtc.__privileges[ServiceRtc.kPrivilegePublishAudioStream])
+    test.equal(pubVideoPrivilegeExpire, rtc.__privileges[ServiceRtc.kPrivilegePublishVideoStream])
+    test.equal(pubDataStreamPrivilegeExpire, rtc.__privileges[ServiceRtc.kPrivilegePublishDataStream])
+    test.equal(rtmUserId, rtm.__user_id)
+    test.equal(rtmTokenExpire, rtm.__privileges[ServiceRtm.kPrivilegeLogin])
+    test.deepEqual({}, convoai.__privileges)
+    test.done()
+}
+
+exports.buildToken_SUBSCRIBER_Test = function (test) {
+    const token = ConvoAITokenBuilder.buildToken(
+        appId, appCertificate, channelName, rtcAccount, Role.SUBSCRIBER, rtcTokenExpire,
+        joinChannelPrivilegeExpire, pubAudioPrivilegeExpire, pubVideoPrivilegeExpire,
+        pubDataStreamPrivilegeExpire, rtmUserId, rtmTokenExpire)
+    const parsed = new AccessToken2('', '', 0, 0)
+    parsed.from_string(token)
+
+    const rtc = parsed.getServices(kRtcServiceType)[0]
+    test.deepEqual({ [ServiceRtc.kPrivilegeJoinChannel]: joinChannelPrivilegeExpire }, rtc.__privileges)
+    test.done()
+}

package/test/DynamicKeyTest.js

@@ -14,6 +14,7 @@ var r = 58964981;
 var uid=2882341273;
 var expiredTs=1446455471;
 
+// Verifies deterministic public sharing key generation.
 exports.PublicSharingKey5_Test = function(test) {
   var expected = "005AwAoADc0QTk5RTVEQjI4MDk0NUI0NzUwNTk0MUFDMjM4MDU2NzIwREY3QjAQAJcMo13mDERkW7roohUGGzOwKDdW9buDA68oN1YAAA==";
   var actual = DynamicKey5.generatePublicSharingKey(appID, appCertificate, channel, ts, r, uid, expiredTs);
@@ -21,6 +22,7 @@ exports.PublicSharingKey5_Test = function(test) {
   test.done();
 };
 
+// Verifies deterministic recording key generation.
 exports.RecordingKey5_Test = function(test) {
   var expected = "005AgAoADkyOUM5RTQ2MTg3QTAyMkJBQUIyNkI3QkYwMTg0MzhDNjc1Q0ZFMUEQAJcMo13mDERkW7roohUGGzOwKDdW9buDA68oN1YAAA==";
   var result = DynamicKey5.generateRecordingKey(appID, appCertificate, channel, ts, r, uid, expiredTs);
@@ -28,6 +30,7 @@ exports.RecordingKey5_Test = function(test) {
   test.done();
 };
 
+// Verifies deterministic media channel key generation.
 exports.MediaChannelKey5_Test = function(test) {
   var expected = "005AQAoAEJERTJDRDdFNkZDNkU0ODYxNkYxQTYwOUVFNTM1M0U5ODNCQjFDNDQQAJcMo13mDERkW7roohUGGzOwKDdW9buDA68oN1YAAA==";
   var result = DynamicKey5.generateMediaChannelKey(appID, appCertificate, channel, ts, r, uid, expiredTs);
@@ -35,6 +38,7 @@ exports.MediaChannelKey5_Test = function(test) {
   test.done();
 };
 
+// Verifies deterministic in-channel permission key generation.
 exports.InChannelPermission5_Test = function(test) {
   var noUpload = "005BAAoADgyNEQxNDE4M0FGRDkyOEQ4REFFMUU1OTg5NTg2MzA3MTEyNjRGNzQQAJcMo13mDERkW7roohUGGzOwKDdW9buDA68oN1YBAAEAAQAw";
   var generatedNoUpload = DynamicKey5.generateInChannelPermissionKey(appID, appCertificate, channel, ts, r, uid, expiredTs, DynamicKey5.noUpload);

package/test/EducationTokenBuilderTest.js

@@ -12,18 +12,21 @@ const roomUuid = '123'
 const userUuid = '2882341273'
 const role = 1
 
+// Verifies Education room-user token generation and parsing.
 exports.BuildRoomUserToken_Test = function (test) {
     let accessToken = new AccessToken2('', '', 0, 0)
     let token = EducationTokenBuilder.buildRoomUserToken(appId, appCertificate, roomUuid, userUuid, role, expire)
     accessToken.from_string(token)
+    const service = accessToken.getServices(kApaasServiceType)[0]
     test.equal(appId, accessToken.appId)
     test.equal(expire, accessToken.expire)
-    test.equal(roomUuid, accessToken.services[kApaasServiceType].__room_uuid)
-    test.equal(userUuid, accessToken.services[kApaasServiceType].__user_uuid)
-    test.equal(role, accessToken.services[kApaasServiceType].__role)
+    test.equal(roomUuid, service.__room_uuid)
+    test.equal(userUuid, service.__user_uuid)
+    test.equal(role, service.__role)
     test.done()
 }
 
+// Verifies Education user token generation and parsing.
 exports.BuildUserToken_Test = function (test) {
     let accessToken = new AccessToken2('', '', 0, 0)
     let token = EducationTokenBuilder.buildUserToken(appId, appCertificate, userUuid, expire)
@@ -31,10 +34,11 @@ exports.BuildUserToken_Test = function (test) {
 
     test.equal(appId, accessToken.appId)
     test.equal(expire, accessToken.expire)
-    test.equal(userUuid, accessToken.services[kApaasServiceType].__user_uuid)
+    test.equal(userUuid, accessToken.getServices(kApaasServiceType)[0].__user_uuid)
     test.done()
 }
 
+// Verifies Education application token generation and parsing.
 exports.BuildAppToken_Test = function (test) {
     let accessToken = new AccessToken2('', '', 0, 0)
     let token = EducationTokenBuilder.buildAppToken(appId, appCertificate, expire)