### Question:
APIAuthentication { public static void validate (APICredential cred, SecretKey secretKey, byte[]... payLoad) throws NoSuchAlgorithmException, InvalidKeyException { if (!VERSION.equals(cred.getVersion())) throw new IllegalArgumentException ("unsupported.version"); assertNotNull(payLoad, "invalid.payLoad"); assertNotNull(secretKey, "invalid.secret"); assertNotNull(cred.getHash(), "invalid.null.hash"); assertTimestamp(cred.getTimestamp()); assertEquals(computeHash(secretKey, cred.getTimestamp(), cred.getNonce(), payLoad), cred.getHash(), "invalid.hash"); } private  APIAuthentication(); static byte[] computeHash(APICredential cred, SecretKey secretKey, byte[]... payLoad); static void validate(APICredential cred, SecretKey secretKey, byte[]... payLoad); static final String VERSION; static final String HASH_ALGORITHM; }### Answer:
@Test public void testInvalidTimestamp () throws AssertionError, NoSuchAlgorithmException, InvalidKeyException { try { APIAuthentication.validate( APICredential.builder() .version(APIAuthentication.VERSION) .timestamp(System.currentTimeMillis() - 10*60*1000L) .nonce(UUID.randomUUID().toString()) .hash("invalidHash".getBytes()).build(), secretKey, "".getBytes() ); } catch (IllegalArgumentException e) { assertTrue ("invalid.timestamp".equals(e.getMessage()), "Returned " + e.getMessage() + " instead of 'invalid.timestamp'"); return; } fail ("Validation failed to catch invalid.timestamp"); }
@Test public void testInvalidValid () throws AssertionError, NoSuchAlgorithmException, InvalidKeyException { try { byte[] payLoad = UUID.randomUUID().toString().getBytes(); KeyGenerator gen = KeyGenerator.getInstance("HmacSHA256"); SecretKey badSecretKey = gen.generateKey(); APIAuthentication.validate( APICredential.builder() .version(APIAuthentication.VERSION) .timestamp(System.currentTimeMillis()) .nonce(UUID.randomUUID().toString()) .hash("invalidHash".getBytes()).build(), badSecretKey, payLoad ); } catch (IllegalArgumentException e) { assertTrue ("invalid.hash".equals(e.getMessage()), "Returned " + e.getMessage() + " instead of 'invalid.hash'"); return; } fail ("Validation failed to catch invalid.hash"); }