98 lines
3.3 KiB
TypeScript
98 lines
3.3 KiB
TypeScript
import { expect, test } from "bun:test";
|
|
import { createRemoteJwks, verifyJwtWithJwks } from "../src/index.ts";
|
|
|
|
function base64url(value: Uint8Array): string {
|
|
let binary = "";
|
|
for (const byte of value) binary += String.fromCharCode(byte);
|
|
return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
|
|
}
|
|
|
|
async function rsaKey(kid: string) {
|
|
const pair = (await crypto.subtle.generateKey(
|
|
{
|
|
name: "RSASSA-PKCS1-v1_5",
|
|
modulusLength: 2048,
|
|
publicExponent: new Uint8Array([1, 0, 1]),
|
|
hash: "SHA-256",
|
|
},
|
|
true,
|
|
["sign", "verify"],
|
|
)) as CryptoKeyPair;
|
|
const jwk = await crypto.subtle.exportKey("jwk", pair.publicKey);
|
|
return { pair, jwk: { ...jwk, kid, alg: "RS256", use: "sig" } };
|
|
}
|
|
|
|
async function sign(privateKey: CryptoKey, kid: string, claims: Record<string, unknown>) {
|
|
const encoder = new TextEncoder();
|
|
const header = base64url(encoder.encode(JSON.stringify({ alg: "RS256", typ: "JWT", kid })));
|
|
const payload = base64url(encoder.encode(JSON.stringify(claims)));
|
|
const input = `${header}.${payload}`;
|
|
const signature = await crypto.subtle.sign(
|
|
"RSASSA-PKCS1-v1_5",
|
|
privateKey,
|
|
encoder.encode(input),
|
|
);
|
|
return `${input}.${base64url(new Uint8Array(signature))}`;
|
|
}
|
|
|
|
test("remote JWKS verifies RS256 claims and refreshes immediately for key rotation", async () => {
|
|
const first = await rsaKey("key-1");
|
|
const second = await rsaKey("key-2");
|
|
const documents = [{ keys: [first.jwk] }, { keys: [second.jwk] }];
|
|
let fetches = 0;
|
|
const jwks = createRemoteJwks("https://issuer.example/jwks", {
|
|
now: () => 0,
|
|
cacheTtlMs: 60_000,
|
|
fetch: (async () =>
|
|
Response.json(
|
|
documents[Math.min(fetches++, documents.length - 1)],
|
|
)) as unknown as typeof fetch,
|
|
});
|
|
const tokenOne = await sign(first.pair.privateKey, "key-1", {
|
|
sub: "user-1",
|
|
iss: "https://issuer.example",
|
|
aud: "client-1",
|
|
iat: 100,
|
|
exp: 200,
|
|
});
|
|
expect(
|
|
(
|
|
await verifyJwtWithJwks(tokenOne, jwks, {
|
|
issuer: "https://issuer.example",
|
|
audience: "client-1",
|
|
now: 150,
|
|
})
|
|
).sub,
|
|
).toBe("user-1");
|
|
expect(fetches).toBe(1);
|
|
|
|
const tokenTwo = await sign(second.pair.privateKey, "key-2", {
|
|
sub: "user-2",
|
|
iss: "https://issuer.example",
|
|
aud: "client-1",
|
|
exp: 200,
|
|
});
|
|
expect((await verifyJwtWithJwks(tokenTwo, jwks, { now: 150 })).sub).toBe("user-2");
|
|
expect(fetches).toBe(2);
|
|
expect(jwks.stats()).toMatchObject({ fetches: 2, hits: 2, keys: 1 });
|
|
await expect(verifyJwtWithJwks(tokenOne, jwks, { now: 150 })).rejects.toThrow("Unknown key");
|
|
});
|
|
|
|
test("remote JWKS rejects insecure, oversized, and incompatible key sets", async () => {
|
|
expect(() => createRemoteJwks("http://issuer.example/jwks")).toThrow("HTTPS");
|
|
const oversized = createRemoteJwks("https://issuer.example/jwks", {
|
|
maxBytes: 10,
|
|
fetch: (async () => Response.json({ keys: [] })) as unknown as typeof fetch,
|
|
});
|
|
await expect(oversized.refresh()).rejects.toThrow("too large");
|
|
|
|
const incompatible = createRemoteJwks("https://issuer.example/jwks", {
|
|
fetch: (async () =>
|
|
Response.json({
|
|
keys: [{ kid: "ec", kty: "EC", alg: "ES256" }],
|
|
})) as unknown as typeof fetch,
|
|
});
|
|
await incompatible.refresh();
|
|
await expect(incompatible.resolve("ec", "RS256")).rejects.toThrow("Unknown key");
|
|
});
|