oidc: modernize with new Go APIs

Run `go fix` then do a few more fixes by hand.

Author: ericchiang

oidc/jwks_test.go

@@ -37,8 +37,8 @@ func (k *keyServer) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 
 type signingKey struct {
 	keyID string // optional
-	priv  interface{}
-	pub   interface{}
+	priv  any
+	pub   any
 	alg   jose.SignatureAlgorithm
 }
 
@@ -173,8 +173,7 @@ func TestKeyVerifyContextCanceled(t *testing.T) {
 }
 
 func testKeyVerify(t *testing.T, good, bad *signingKey, verification ...*signingKey) {
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
+	ctx := t.Context()
 
 	keySet := jose.JSONWebKeySet{}
 	for _, v := range verification {
@@ -222,8 +221,7 @@ func testKeyVerify(t *testing.T, good, bad *signingKey, verification ...*signing
 }
 
 func TestRotation(t *testing.T) {
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
+	ctx := t.Context()
 
 	key1 := newRSAKey(t)
 	key2 := newRSAKey(t)
@@ -287,8 +285,7 @@ func TestRotation(t *testing.T) {
 }
 
 func TestUpdateKeysSendsCacheControlNoCache(t *testing.T) {
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
+	ctx := t.Context()
 
 	key := newRSAKey(t)
 	var requestHeaders []http.Header
@@ -325,21 +322,19 @@ func TestUpdateKeysSendsCacheControlNoCache(t *testing.T) {
 	}
 }
 
-
 func BenchmarkVerify(b *testing.B) {
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
+	ctx := b.Context()
 
 	key := newRSAKey(b)
 
 	now := time.Date(2022, 1, 29, 0, 0, 0, 0, time.UTC)
 	exp := now.Add(time.Hour)
-	payload := []byte(fmt.Sprintf(`{
+	payload := fmt.Appendf(nil, `{
 		"iss": "https://example.com",
 		"sub": "test_user",
 		"aud": "test_client_id",
 		"exp": %d
-	}`, exp.Unix()))
+	}`, exp.Unix())
 
 	idToken := key.sign(b, payload)
 	server := &keyServer{
@@ -361,8 +356,7 @@ func BenchmarkVerify(b *testing.B) {
 		b.Fatalf("verifying id token: %v", err)
 	}
 
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
+	for b.Loop() {
 		if _, err := verifier.Verify(ctx, idToken); err != nil {
 			b.Fatalf("verifying id token: %v", err)
 		}

oidc/logout.go

@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"slices"
 	"time"
 )
 
@@ -163,7 +164,7 @@ func (v *IDTokenVerifier) VerifyLogout(ctx context.Context, rawLogoutToken strin
 
 	if !v.config.SkipClientIDCheck {
 		if v.config.ClientID != "" {
-			if !contains(t.Audience, v.config.ClientID) {
+			if !slices.Contains(t.Audience, v.config.ClientID) {
 				return nil, fmt.Errorf("oidc: expected logout token audience %q got %q", v.config.ClientID, t.Audience)
 			}
 		} else {

oidc/oidc.go

@@ -301,7 +301,7 @@ func NewProvider(ctx context.Context, issuer string) (*Provider, error) {
 //
 // For a list of fields defined by the OpenID Connect spec see:
 // https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata
-func (p *Provider) Claims(v interface{}) error {
+func (p *Provider) Claims(v any) error {
 	if p.rawClaims == nil {
 		return errors.New("oidc: claims not set")
 	}
@@ -340,7 +340,7 @@ type userInfoRaw struct {
 }
 
 // Claims unmarshals the raw JSON object claims into the provided object.
-func (u *UserInfo) Claims(v interface{}) error {
+func (u *UserInfo) Claims(v any) error {
 	if u.claims == nil {
 		return errors.New("oidc: claims not set")
 	}
@@ -465,7 +465,7 @@ type IDToken struct {
 //	if err := idToken.Claims(&claims); err != nil {
 //		// handle error
 //	}
-func (i *IDToken) Claims(v interface{}) error {
+func (i *IDToken) Claims(v any) error {
 	if i.claims == nil {
 		return errors.New("oidc: claims not set")
 	}
@@ -570,7 +570,7 @@ func (j *jsonTime) UnmarshalJSON(b []byte) error {
 	return nil
 }
 
-func unmarshalResp(r *http.Response, body []byte, v interface{}) error {
+func unmarshalResp(r *http.Response, body []byte, v any) error {
 	err := json.Unmarshal(body, &v)
 	if err == nil {
 		return nil

oidc/oidc_test.go

@@ -280,8 +280,7 @@ func TestNewProvider(t *testing.T) {
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			ctx, cancel := context.WithCancel(context.Background())
-			defer cancel()
+			ctx := t.Context()
 
 			var issuer string
 			hf := func(w http.ResponseWriter, r *http.Request) {

oidc/oidctest/oidctest.go

@@ -91,7 +91,7 @@ func newToken(priv crypto.PrivateKey, keyID, alg, claims string) (string, error)
 		Key:       priv,
 	}
 	opts := &jose.SignerOptions{
-		ExtraHeaders: map[jose.HeaderKey]interface{}{
+		ExtraHeaders: map[jose.HeaderKey]any{
 			jose.HeaderKey("kid"): keyID,
 		},
 	}

oidc/verify.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+	"slices"
 	"time"
 
 	jose "github.com/go-jose/go-jose/v4"
@@ -142,15 +143,6 @@ func (p *Provider) newVerifier(keySet KeySet, config *Config) *IDTokenVerifier {
 	return NewVerifier(p.issuer, keySet, config)
 }
 
-func contains(sli []string, ele string) bool {
-	for _, s := range sli {
-		if s == ele {
-			return true
-		}
-	}
-	return false
-}
-
 // Returns the Claims from the distributed JWT token
 func resolveDistributedClaim(ctx context.Context, verifier *IDTokenVerifier, src claimSource) ([]byte, error) {
 	req, err := http.NewRequest("GET", src.Endpoint, nil)
@@ -257,7 +249,7 @@ func (v *IDTokenVerifier) Verify(ctx context.Context, rawIDToken string) (*IDTok
 	// This check DOES NOT ensure that the ClientID is the party to which the ID Token was issued (i.e. Authorized party).
 	if !v.config.SkipClientIDCheck {
 		if v.config.ClientID != "" {
-			if !contains(t.Audience, v.config.ClientID) {
+			if !slices.Contains(t.Audience, v.config.ClientID) {
 				return nil, fmt.Errorf("oidc: expected audience %q got %q", v.config.ClientID, t.Audience)
 			}
 		} else {

oidc/verify_test.go

@@ -1,7 +1,6 @@
 package oidc
 
 import (
-	"context"
 	"crypto"
 	"encoding/base64"
 	"errors"
@@ -523,8 +522,7 @@ type resolverTest struct {
 func (v resolverTest) testEndpoint(t *testing.T) ([]byte, error) {
 	token := v.signKey.sign(t, []byte(v.payload))
 
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
+	ctx := t.Context()
 
 	s := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		got := r.Header.Get("Authorization")
@@ -590,8 +588,7 @@ func (v verificationTest) runGetToken(t *testing.T) (*IDToken, error) {
 		token += "."
 	}
 
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
+	ctx := t.Context()
 
 	issuer := "https://foo"
 	if v.issuer != "" {