feat: sync Telegram Login OIDC provider

internal/app/telegramlogin/jose_es256k_enabled_test.go

@@ -0,0 +1,57 @@
+//go:build jwx_es256k
+
+package telegramlogin
+
+import (
+	"testing"
+	"time"
+
+	"github.com/decred/dcrd/dcrec/secp256k1/v4"
+	"github.com/lestrrat-go/jwx/v3/jwk"
+	"github.com/lestrrat-go/jwx/v3/jwt"
+
+	"telesrv/internal/domain"
+)
+
+func TestES256KIDTokenRoundTripWithBuildTag(t *testing.T) {
+	raw, err := secp256k1.GeneratePrivateKey()
+	if err != nil {
+		t.Fatal(err)
+	}
+	now := time.Date(2026, 7, 20, 10, 0, 0, 0, time.UTC)
+	ring, err := NewSigningKeyRing([]SigningKeyMaterial{{
+		Algorithm:  domain.TelegramLoginSigningES256K,
+		KeyID:      "secp256k1-active",
+		PrivateKey: raw.ToECDSA(),
+		Active:     true,
+	}}, func() time.Time { return now })
+	if err != nil {
+		t.Fatal(err)
+	}
+	issuer, err := NewIDTokenIssuer(ring, IDTokenIssuerConfig{
+		Issuer: "https://oauth.telesrv.test", Now: func() time.Time { return now },
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	signed, err := issuer.Issue(domain.TelegramLoginRequest{
+		ClientID: "9001", SigningAlgorithm: domain.TelegramLoginSigningES256K,
+		Scopes: []domain.TelegramLoginScope{domain.TelegramLoginScopeOpenID},
+		Status: domain.TelegramLoginRequestApproved, AuthorizedUserID: 42,
+		ApprovedAt: now.Add(-time.Minute),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	body, _, err := ring.JWKS()
+	if err != nil {
+		t.Fatal(err)
+	}
+	set, err := jwk.Parse(body)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := jwt.Parse([]byte(signed), jwt.WithKeySet(set), jwt.WithValidate(false)); err != nil {
+		t.Fatalf("verify ES256K token: %v", err)
+	}
+}