identitytest

Documentation

Overview

Package identitytest is a fake OpenID Provider for the identity verifier's tests and for the API layer's real-token tests (api/identitylane_test.go).

It deliberately does not import internal/identity: with no cycle, that package's own in-package test files may use it, and so may any consumer. For the same reason there is no fake verifier here — a consumer that wants one declares the interface it needs in its own test files, where a Go consumer's interface belongs.

Index

• type Clock
  • func NewClock(t time.Time) *Clock
  • func (c *Clock) Advance(d time.Duration)
  • func (c *Clock) Now() time.Time
• type IdP
  • func NewIdP(t *testing.T) *IdP
  • func (p *IdP) ActiveKID() string
  • func (p *IdP) AddECKey(t *testing.T) string
  • func (p *IdP) AddKey(t *testing.T, alg string) string
  • func (p *IdP) BlockJWKS(release <-chan struct{})
  • func (p *IdP) Claims(aud string, now time.Time) map[string]any
  • func (p *IdP) Client() *http.Client
  • func (p *IdP) Discoveries() int
  • func (p *IdP) DiscoveryURL() string
  • func (p *IdP) FailJWKS(status int)
  • func (p *IdP) Fetches() int
  • func (p *IdP) Issuer() string
  • func (p *IdP) JWKSURL() string
  • func (p *IdP) Mint(t *testing.T, claims map[string]any) string
  • func (p *IdP) MintRaw(t *testing.T, header, claims map[string]any, ...) string
  • func (p *IdP) MintWith(t *testing.T, kid string, claims map[string]any) string
  • func (p *IdP) PublicKeyDER(t *testing.T, kid string) []byte
  • func (p *IdP) RedirectJWKS(status int, to string)
  • func (p *IdP) Restore()
  • func (p *IdP) Retire(t *testing.T, kid string)
  • func (p *IdP) Rotate(t *testing.T) string
  • func (p *IdP) SetDiscovery(doc map[string]any)
  • func (p *IdP) SetJWKSBody(body []byte)

Types

type Clock

type Clock struct {
	// contains filtered or unexported fields
}

Clock is a race-safe test clock for a verifier's Now, over atomic nanoseconds, so a -race test may advance it while verifications run.

func NewClock

func NewClock(t time.Time) *Clock

NewClock starts a clock at t.

func (*Clock) Advance

func (c *Clock) Advance(d time.Duration)

Advance moves the clock forward.

func (*Clock) Now

func (c *Clock) Now() time.Time

Now reads the clock.

type IdP

type IdP struct {
	// contains filtered or unexported fields
}

IdP is a fake OpenID Provider on httptest: a discovery document, a JWK Set, and token minting, with per-test overrides for the failure shapes a verifier must survive.

func NewIdP

func NewIdP(t *testing.T) *IdP

NewIdP starts a provider holding one RS256 key. The server is closed by t.Cleanup.

func (*IdP) ActiveKID

func (p *IdP) ActiveKID() string

ActiveKID is the key Mint signs with.

func (*IdP) AddECKey

func (p *IdP) AddECKey(t *testing.T) string

AddECKey publishes an ES256 key alongside the RS256 default.

func (*IdP) AddKey

func (p *IdP) AddKey(t *testing.T, alg string) string

AddKey publishes an additional key for one of the five allowed algorithms and returns its kid. The active key is unchanged.

func (*IdP) BlockJWKS

func (p *IdP) BlockJWKS(release <-chan struct{})

BlockJWKS holds the key-set handler open until release is closed, so a test can drive the single-flight and deadline paths without sleeping.

func (*IdP) Claims

func (p *IdP) Claims(aud string, now time.Time) map[string]any

Claims returns a minimally valid claim set: iss, aud, sub, iat, nbf and an exp one hour out, and nothing else. A test mutates or deletes fields to build its case; Mint fills in nothing, so no later reader has to reverse-engineer a hidden default.

func (*IdP) Client

func (p *IdP) Client() *http.Client

Client reaches the provider on loopback. Supply it as the verifier's HTTP client: the production client's dial guard refuses loopback by design.

func (*IdP) Discoveries

func (p *IdP) Discoveries() int

Discoveries counts well-known requests served.

func (*IdP) DiscoveryURL

func (p *IdP) DiscoveryURL() string

DiscoveryURL is the well-known metadata URL.

func (*IdP) FailJWKS

func (p *IdP) FailJWKS(status int)

FailJWKS makes the key-set endpoint answer with a status.

func (*IdP) Fetches

func (p *IdP) Fetches() int

Fetches counts key-set requests served.

func (*IdP) Issuer

func (p *IdP) Issuer() string

Issuer is the provider's base URL, equal to the discovery document's issuer.

func (*IdP) JWKSURL

func (p *IdP) JWKSURL() string

JWKSURL is where the key set is published.

func (*IdP) Mint

func (p *IdP) Mint(t *testing.T, claims map[string]any) string

Mint signs claims with the active key.

func (*IdP) MintRaw

func (p *IdP) MintRaw(t *testing.T, header, claims map[string]any, sign func(signingInput []byte) []byte) string

MintRaw assembles b64(header).b64(claims).b64(sign(signingInput)) by hand.

It exists because go-jose will not sign alg:none and will not HMAC with an RSA public key — and those two tokens, the none forgery and the classic key-confusion token MACed with the published public key, are exactly the ones a verifier must refuse. Neither can be built through any signing library.

func (*IdP) MintWith

func (p *IdP) MintWith(t *testing.T, kid string, claims map[string]any) string

MintWith signs claims with a named key, using that key's algorithm.

func (*IdP) PublicKeyDER

func (p *IdP) PublicKeyDER(t *testing.T, kid string) []byte

PublicKeyDER returns a key's public half in DER — the "secret" a key-confusion token is MACed with.

func (*IdP) RedirectJWKS

func (p *IdP) RedirectJWKS(status int, to string)

RedirectJWKS makes the key-set endpoint redirect.

func (*IdP) Restore

func (p *IdP) Restore()

Restore clears every override.

func (*IdP) Retire

func (p *IdP) Retire(t *testing.T, kid string)

Retire removes a key from the published set. Tokens it signed stay valid until the verifier's key set expires, which is the property under test.

func (*IdP) Rotate

func (p *IdP) Rotate(t *testing.T) string

Rotate publishes a new RS256 key, makes it active, and keeps the old one published — the shape a real rotation takes.

func (*IdP) SetDiscovery

func (p *IdP) SetDiscovery(doc map[string]any)

SetDiscovery replaces the metadata document: a wrong issuer, a missing or non-https jwks_uri.

func (*IdP) SetJWKSBody

func (p *IdP) SetJWKSBody(body []byte)

SetJWKSBody replaces the key-set response with arbitrary bytes: malformed, oversize, or holding entries no library can build.