mirror of
https://github.com/int128/kubelogin.git
synced 2026-05-18 05:46:42 +00:00
88 lines
2.1 KiB
Go
88 lines
2.1 KiB
Go
package jwtdecoder
|
|
|
|
import (
|
|
"crypto/rsa"
|
|
"crypto/x509"
|
|
"encoding/pem"
|
|
"io/ioutil"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/dgrijalva/jwt-go"
|
|
)
|
|
|
|
func TestDecoder_Decode(t *testing.T) {
|
|
var decoder Decoder
|
|
|
|
t.Run("ValidToken", func(t *testing.T) {
|
|
expiry := time.Now().Round(time.Second)
|
|
idToken := newIDToken(t, "https://issuer.example.com", expiry)
|
|
decodedToken, err := decoder.Decode(idToken)
|
|
if err != nil {
|
|
t.Fatalf("Decode error: %s", err)
|
|
}
|
|
if decodedToken.Expiry != expiry {
|
|
t.Errorf("Expiry wants %s but %s", expiry, decodedToken.Expiry)
|
|
}
|
|
t.Logf("Pretty=%+v", decodedToken.Pretty)
|
|
})
|
|
t.Run("InvalidToken", func(t *testing.T) {
|
|
decodedToken, err := decoder.Decode("HEADER.INVALID_TOKEN.SIGNATURE")
|
|
if err == nil {
|
|
t.Errorf("error wants non-nil but nil")
|
|
} else {
|
|
t.Logf("expected error: %+v", err)
|
|
}
|
|
if decodedToken != nil {
|
|
t.Errorf("decodedToken wants nil but %+v", decodedToken)
|
|
}
|
|
})
|
|
}
|
|
|
|
func newIDToken(t *testing.T, issuer string, expiry time.Time) string {
|
|
t.Helper()
|
|
claims := struct {
|
|
jwt.StandardClaims
|
|
Nonce string `json:"nonce"`
|
|
Groups []string `json:"groups"`
|
|
EmailVerified bool `json:"email_verified"`
|
|
}{
|
|
StandardClaims: jwt.StandardClaims{
|
|
Issuer: issuer,
|
|
Audience: "kubernetes",
|
|
Subject: "SUBJECT",
|
|
IssuedAt: time.Now().Unix(),
|
|
ExpiresAt: expiry.Unix(),
|
|
},
|
|
Nonce: "NONCE",
|
|
Groups: []string{"admin", "users"},
|
|
EmailVerified: false,
|
|
}
|
|
token := jwt.NewWithClaims(jwt.SigningMethodRS256, claims)
|
|
s, err := token.SignedString(readPrivateKey(t, "testdata/jws.key"))
|
|
if err != nil {
|
|
t.Fatalf("Could not sign the claims: %s", err)
|
|
}
|
|
return s
|
|
}
|
|
|
|
func readPrivateKey(t *testing.T, name string) *rsa.PrivateKey {
|
|
t.Helper()
|
|
b, err := ioutil.ReadFile(name)
|
|
if err != nil {
|
|
t.Fatalf("could not read the file: %s", err)
|
|
}
|
|
block, rest := pem.Decode(b)
|
|
if block == nil {
|
|
t.Fatalf("could not decode PEM")
|
|
}
|
|
if len(rest) > 0 {
|
|
t.Fatalf("PEM should contain single key but multiple keys")
|
|
}
|
|
k, err := x509.ParsePKCS1PrivateKey(block.Bytes)
|
|
if err != nil {
|
|
t.Fatalf("could not parse the key: %s", err)
|
|
}
|
|
return k
|
|
}
|