fixes

Author: hf

internal/api/auth_test.go

@@ -1,6 +1,7 @@
 package api
 
 import (
+	"context"
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
@@ -167,7 +168,7 @@ func (ts *AuthTestSuite) TestParseJWTClaims() {
 			jwk, err := conf.GetSigningJwk(&ts.Config.JWT)
 			require.NoError(ts.T(), err)
 			signingMethod := conf.GetSigningAlg(jwk)
-			signingKey, err := conf.GetSigningKey(jwk)
+			signingKey, err := conf.SigningKey(context.Background())
 			require.NoError(ts.T(), err)
 
 			userJwtToken := jwt.NewWithClaims(signingMethod, userClaims)

internal/conf/awskmsjwk/rs256.go

@@ -46,7 +46,7 @@ func (m *signingMethodKMSRS256) Sign(signingString string, key any) ([]byte, err
 		SigningAlgorithm: kmstypes.SigningAlgorithmSpecRsassaPkcs1V15Sha256,
 	})
 	if err != nil {
-		logrus.WithError(err).Error("Unable to sign RS256 JWT with AWS KMS key %q", k.KeyID)
+		logrus.WithError(err).Errorf("Unable to sign RS256 JWT with AWS KMS key %q", k.KeyID)
 
 		return nil, err
 	}

internal/conf/configuration.go

@@ -1174,6 +1174,16 @@ func (config *GlobalConfiguration) applyDefaultsJWTPrivateKey(privKey jwk.Key) e
 		PublicKey:  pubKey,
 		PrivateKey: privKey,
 	}
+
+	var key any
+	if err := privKey.Raw(&key); err != nil {
+		return err
+	}
+
+	config.JWT.SigningKey = func(ctx context.Context) (any, error) {
+		return key, nil
+	}
+
 	return nil
 }
 

internal/conf/jwk_test.go

@@ -1,6 +1,7 @@
 package conf
 
 import (
+	"context"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -187,39 +188,6 @@ func TestJwtKeys(t *testing.T) {
 		require.Equal(t, "no signing key found", err.Error())
 	}
 
-	// GetSigningKey - valid
-	{
-		m := helpToMap(t, testJwtKey)
-		jwt, err := json.Marshal(m["3"])
-		require.NoError(t, err)
-
-		sigKey1, err := jwk.ParseKey(jwt)
-		require.NoError(t, err)
-
-		got, err := GetSigningKey(sigKey1)
-		require.NoError(t, err)
-		require.NotNil(t, got)
-		require.Equal(t, fmt.Sprintf("%T", got), "*ecdsa.PrivateKey")
-	}
-
-	// GetSigningKey - not found
-	{
-		m := helpToMap(t, testJwtKey)
-		jwt, err := json.Marshal(m["4"])
-		require.NoError(t, err)
-
-		privKey, err := jwk.ParseKey(jwt)
-		require.NoError(t, err)
-
-		sentinel := errors.New("sentinel")
-		key := &mockKey{Key: privKey, err: sentinel, n: 0}
-
-		got, err := GetSigningKey(key)
-		require.Nil(t, got)
-		require.Error(t, err)
-		require.Equal(t, sentinel, err)
-	}
-
 	// FindPublicKeyByKid - valid
 	{
 		dec := make(JwtKeysDecoder)
@@ -228,7 +196,7 @@ func TestJwtKeys(t *testing.T) {
 			KeyID:  "abc",
 			Secret: "sentinel",
 		}
-		got, err := FindPublicKeyByKid("abc", jwtConfig)
+		got, err := FindPublicKeyByKid(context.Background(), "abc", jwtConfig)
 		require.NoError(t, err)
 		require.Equal(t, []byte("sentinel"), got)
 	}
@@ -239,7 +207,7 @@ func TestJwtKeys(t *testing.T) {
 		jwtConfig := &JWTConfiguration{
 			Keys: dec,
 		}
-		got, err := FindPublicKeyByKid("abc", jwtConfig)
+		got, err := FindPublicKeyByKid(context.Background(), "abc", jwtConfig)
 		require.Nil(t, got)
 		require.Nil(t, err)
 	}
@@ -263,7 +231,7 @@ func TestJwtKeys(t *testing.T) {
 			Keys: dec,
 		}
 
-		got, err := FindPublicKeyByKid("abc", jwtConfig)
+		got, err := FindPublicKeyByKid(context.Background(), "abc", jwtConfig)
 		require.NoError(t, err)
 		require.NotNil(t, got)
 		require.Equal(t, fmt.Sprintf("%T", got), "*ecdsa.PrivateKey")
@@ -291,7 +259,7 @@ func TestJwtKeys(t *testing.T) {
 			Keys: dec,
 		}
 
-		got, err := FindPublicKeyByKid("abc", jwtConfig)
+		got, err := FindPublicKeyByKid(context.Background(), "abc", jwtConfig)
 		require.Nil(t, got)
 		require.Error(t, err)
 		require.Equal(t, sentinel, err)

internal/tokens/service_test.go

@@ -780,7 +780,7 @@ func parseIDTokenClaims(idToken string, config *conf.GlobalConfiguration) (jwt.M
 		if kid, ok := token.Header["kid"]; ok {
 			if kidStr, ok := kid.(string); ok {
 				// Find the public key by kid for asymmetric verification
-				key, err := conf.FindPublicKeyByKid(kidStr, &config.JWT)
+				key, err := conf.FindPublicKeyByKid(context.Background(), kidStr, &config.JWT)
 				if err != nil {
 					return nil, err
 				}
@@ -852,7 +852,7 @@ func (ts *IDTokenTestSuite) TestIDTokenWithAllScopes() {
 		Scopes:   []string{models.ScopeOpenID, models.ScopeEmail, models.ScopeProfile, models.ScopePhone},
 	}
 
-	idToken, err := srv.GenerateIDToken(params)
+	idToken, err := srv.GenerateIDToken(context.Background(), params)
 	require.NoError(ts.T(), err)
 	require.NotEmpty(ts.T(), idToken)
 
@@ -883,7 +883,7 @@ func (ts *IDTokenTestSuite) TestIDTokenWithOnlyOpenIDScope() {
 		Scopes:   []string{models.ScopeOpenID},
 	}
 
-	idToken, err := srv.GenerateIDToken(params)
+	idToken, err := srv.GenerateIDToken(context.Background(), params)
 	require.NoError(ts.T(), err)
 	require.NotEmpty(ts.T(), idToken)
 
@@ -916,7 +916,7 @@ func (ts *IDTokenTestSuite) TestIDTokenWithEmailScope() {
 		Scopes:   []string{models.ScopeOpenID, models.ScopeEmail},
 	}
 
-	idToken, err := srv.GenerateIDToken(params)
+	idToken, err := srv.GenerateIDToken(context.Background(), params)
 	require.NoError(ts.T(), err)
 	require.NotEmpty(ts.T(), idToken)
 
@@ -946,7 +946,7 @@ func (ts *IDTokenTestSuite) TestIDTokenWithProfileScope() {
 		Scopes:   []string{models.ScopeOpenID, models.ScopeProfile},
 	}
 
-	idToken, err := srv.GenerateIDToken(params)
+	idToken, err := srv.GenerateIDToken(context.Background(), params)
 	require.NoError(ts.T(), err)
 	require.NotEmpty(ts.T(), idToken)
 
@@ -976,7 +976,7 @@ func (ts *IDTokenTestSuite) TestIDTokenWithPhoneScope() {
 		Scopes:   []string{models.ScopeOpenID, models.ScopePhone},
 	}
 
-	idToken, err := srv.GenerateIDToken(params)
+	idToken, err := srv.GenerateIDToken(context.Background(), params)
 	require.NoError(ts.T(), err)
 	require.NotEmpty(ts.T(), idToken)
 
@@ -1006,7 +1006,7 @@ func (ts *IDTokenTestSuite) TestIDTokenWithMultipleScopes() {
 		Scopes:   []string{models.ScopeOpenID, models.ScopeEmail, models.ScopeProfile},
 	}
 
-	idToken, err := srv.GenerateIDToken(params)
+	idToken, err := srv.GenerateIDToken(context.Background(), params)
 	require.NoError(ts.T(), err)
 	require.NotEmpty(ts.T(), idToken)