File: verifier_jwt_profile_test.go

package info (click to toggle)
golang-github-zitadel-oidc 3.37.0-1
  • links: PTS, VCS
  • area: main
  • in suites: experimental, sid, trixie
  • size: 1,484 kB
  • sloc: makefile: 5
file content (117 lines) | stat: -rw-r--r-- 3,072 bytes parent folder | download | duplicates (2)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
package op_test

import (
	"context"
	"testing"
	"time"

	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"
	tu "github.com/zitadel/oidc/v3/internal/testutil"
	"github.com/zitadel/oidc/v3/pkg/oidc"
	"github.com/zitadel/oidc/v3/pkg/op"
)

func TestNewJWTProfileVerifier(t *testing.T) {
	want := &op.JWTProfileVerifier{
		Verifier: oidc.Verifier{
			Issuer:    tu.ValidIssuer,
			MaxAgeIAT: time.Minute,
			Offset:    time.Second,
		},
		Storage: tu.JWTProfileKeyStorage{},
	}
	got := op.NewJWTProfileVerifier(tu.JWTProfileKeyStorage{}, tu.ValidIssuer, time.Minute, time.Second, op.SubjectCheck(func(request *oidc.JWTTokenRequest) error {
		return oidc.ErrSubjectMissing
	}))
	assert.Equal(t, want.Verifier, got.Verifier)
	assert.Equal(t, want.Storage, got.Storage)
	assert.ErrorIs(t, got.CheckSubject(nil), oidc.ErrSubjectMissing)
}

func TestVerifyJWTAssertion(t *testing.T) {
	errCtx, cancel := context.WithCancel(context.Background())
	cancel()

	verifier := op.NewJWTProfileVerifier(tu.JWTProfileKeyStorage{}, tu.ValidIssuer, time.Minute, 0)
	tests := []struct {
		name     string
		ctx      context.Context
		newToken func() (string, *oidc.JWTTokenRequest)
		wantErr  bool
	}{
		{
			name:     "parse error",
			ctx:      context.Background(),
			newToken: func() (string, *oidc.JWTTokenRequest) { return "!", nil },
			wantErr:  true,
		},
		{
			name: "wrong audience",
			ctx:  context.Background(),
			newToken: func() (string, *oidc.JWTTokenRequest) {
				return tu.NewJWTProfileAssertion(
					tu.ValidClientID, tu.ValidClientID, []string{"wrong"},
					time.Now(), tu.ValidExpiration,
				)
			},
			wantErr: true,
		},
		{
			name: "expired",
			ctx:  context.Background(),
			newToken: func() (string, *oidc.JWTTokenRequest) {
				return tu.NewJWTProfileAssertion(
					tu.ValidClientID, tu.ValidClientID, []string{tu.ValidIssuer},
					time.Now(), time.Now().Add(-time.Hour),
				)
			},
			wantErr: true,
		},
		{
			name: "invalid iat",
			ctx:  context.Background(),
			newToken: func() (string, *oidc.JWTTokenRequest) {
				return tu.NewJWTProfileAssertion(
					tu.ValidClientID, tu.ValidClientID, []string{tu.ValidIssuer},
					time.Now().Add(time.Hour), tu.ValidExpiration,
				)
			},
			wantErr: true,
		},
		{
			name: "invalid subject",
			ctx:  context.Background(),
			newToken: func() (string, *oidc.JWTTokenRequest) {
				return tu.NewJWTProfileAssertion(
					tu.ValidClientID, "wrong", []string{tu.ValidIssuer},
					time.Now(), tu.ValidExpiration,
				)
			},
			wantErr: true,
		},
		{
			name:     "check signature fail",
			ctx:      errCtx,
			newToken: tu.ValidJWTProfileAssertion,
			wantErr:  true,
		},
		{
			name:     "ok",
			ctx:      context.Background(),
			newToken: tu.ValidJWTProfileAssertion,
		},
	}
	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			assertion, want := tt.newToken()
			got, err := op.VerifyJWTAssertion(tt.ctx, assertion, verifier)
			if tt.wantErr {
				assert.Error(t, err)
				return
			}
			require.NoError(t, err)
			assert.Equal(t, want, got)
		})
	}
}