Fix padding

pkg/api/api.go

@@ -61,7 +61,7 @@ const (
 	// ErrMissingDate indicates the realm requires a date, but none was supplied.
 	ErrMissingDate = "missing_date"
 	// ErrInvalidDate indicates the realm requires a date, but the supplied date
-	// was older or newer than the allowed date ramge.
+	// was older or newer than the allowed date range.
 	ErrInvalidDate = "invalid_date"
 	// ErrUUIDAlreadyExists indicates that the UUID has already been used for an issued code.
 	ErrUUIDAlreadyExists = "uuid_already_exists"
@@ -126,7 +126,7 @@ type Padding []byte
 // MarshalJSON is a custom JSON marshaler for padding. It generates and returns
 // 1-2kb (random) of base64-encoded bytes.
 func (p Padding) MarshalJSON() ([]byte, error) {
-	if p != nil {
+	if p == nil {
 		bi, err := rand.Int(rand.Reader, big.NewInt(1024))
 		if err != nil {
 			return nil, fmt.Errorf("padding: failed to generate random number: %w", err)
@@ -149,6 +149,15 @@ func (p Padding) MarshalJSON() ([]byte, error) {
 	return []byte(s), nil
 }
 
+// UnmarshalJSON is a custom JSON unmarshaler for padding.
+// The field is meaningless bytes, so this is just a passthrough.
+func (p *Padding) UnmarshalJSON(b []byte) error {
+	if l := len(b); l > 2 {
+		*p = b[1 : l-2] // remove outer quotes
+	}
+	return nil
+}
+
 // CSRFResponse is the return type when requesting an AJAX CSRF token.
 type CSRFResponse struct {
 	Padding Padding `json:"padding"`
@@ -184,7 +193,7 @@ type UserBatchResponse struct {
 // code. This is called by the Web frontend.
 // API is served at /api/issue
 type IssueCodeRequest struct {
-	Padding Padding `json:"padding,omitempty"`
+	Padding Padding `json:"padding"`
 
 	SymptomDate string `json:"symptomDate"` // ISO 8601 formatted date, YYYY-MM-DD
 	TestDate    string `json:"testDate"`
@@ -215,7 +224,7 @@ type IssueCodeRequest struct {
 
 // IssueCodeResponse defines the response type for IssueCodeRequest.
 type IssueCodeResponse struct {
-	Padding Padding `json:"padding,omitempty"`
+	Padding Padding `json:"padding"`
 
 	// UUID is a handle which allows the issuer to track status of the issued verification code.
 	UUID string `json:"uuid"`
@@ -242,13 +251,13 @@ type IssueCodeResponse struct {
 
 // BatchIssueCodeRequest defines the request for issuing many codes at once.
 type BatchIssueCodeRequest struct {
-	Padding Padding             `json:"padding,omitempty"`
+	Padding Padding             `json:"padding"`
 	Codes   []*IssueCodeRequest `json:"codes"`
 }
 
 // BatchIssueCodeResponse defines the response for BatchIssueCodeRequest.
 type BatchIssueCodeResponse struct {
-	Padding Padding              `json:"padding,omitempty"`
+	Padding Padding              `json:"padding"`
 	Codes   []*IssueCodeResponse `json:"codes,omitempty"`
 
 	Error     string `json:"error,omitempty"`

pkg/integration/integration_test.go

@@ -82,6 +82,9 @@ func TestIntegration(t *testing.T) {
 		if err != nil {
 			t.Fatalf("failed to issue code: %#v\n  req: %#v\n  resp: %#v", err, issueReq, issueResp)
 		}
+		if len(issueResp.Padding) == 0 {
+			t.Error("expected response padding")
+		}
 
 		// Invalid code should fail to verify
 		{
@@ -171,9 +174,12 @@ func TestIntegration(t *testing.T) {
 				},
 			},
 		}
-		issueResp, err := adminAPIClient.BatchIssueCode(ctx, issueReq)
+		outerIssueResp, err := adminAPIClient.BatchIssueCode(ctx, issueReq)
 		if err != nil {
-			t.Fatalf("failed to issue code: %#v\n  req: %#v\n  resp: %#v", err, issueReq, issueResp)
+			t.Fatalf("failed to issue code: %#v\n  req: %#v\n  resp: %#v", err, issueReq, outerIssueResp)
+		}
+		if len(outerIssueResp.Padding) == 0 {
+			t.Error("expected response padding")
 		}
 
 		// Invalid code should fail to verify
@@ -189,7 +195,11 @@ func TestIntegration(t *testing.T) {
 		}
 
 		// Verify all codes in batch.
-		for _, issueResp := range issueResp.Codes {
+		for _, issueResp := range outerIssueResp.Codes {
+			if len(issueResp.Padding) != 0 {
+				t.Errorf("batch does not expect inner response padding, got %s", string(issueResp.Padding))
+			}
+
 			verifyReq := &api.VerifyCodeRequest{
 				VerificationCode: issueResp.VerificationCode,
 				AcceptTestTypes:  []string{testType},