owpengram-server/internal/app/telegramlogin/jose_es256k_enabled_test.go

57 lines
1.4 KiB
Go

//go:build jwx_es256k
package telegramlogin
import (
"testing"
"time"
"github.com/decred/dcrd/dcrec/secp256k1/v4"
"github.com/lestrrat-go/jwx/v3/jwk"
"github.com/lestrrat-go/jwx/v3/jwt"
"telesrv/internal/domain"
)
func TestES256KIDTokenRoundTripWithBuildTag(t *testing.T) {
raw, err := secp256k1.GeneratePrivateKey()
if err != nil {
t.Fatal(err)
}
now := time.Date(2026, 7, 20, 10, 0, 0, 0, time.UTC)
ring, err := NewSigningKeyRing([]SigningKeyMaterial{{
Algorithm: domain.TelegramLoginSigningES256K,
KeyID: "secp256k1-active",
PrivateKey: raw.ToECDSA(),
Active: true,
}}, func() time.Time { return now })
if err != nil {
t.Fatal(err)
}
issuer, err := NewIDTokenIssuer(ring, IDTokenIssuerConfig{
Issuer: "https://oauth.telesrv.test", Now: func() time.Time { return now },
})
if err != nil {
t.Fatal(err)
}
signed, err := issuer.Issue(domain.TelegramLoginRequest{
ClientID: "9001", SigningAlgorithm: domain.TelegramLoginSigningES256K,
Scopes: []domain.TelegramLoginScope{domain.TelegramLoginScopeOpenID},
Status: domain.TelegramLoginRequestApproved, AuthorizedUserID: 42,
ApprovedAt: now.Add(-time.Minute),
})
if err != nil {
t.Fatal(err)
}
body, _, err := ring.JWKS()
if err != nil {
t.Fatal(err)
}
set, err := jwk.Parse(body)
if err != nil {
t.Fatal(err)
}
if _, err := jwt.Parse([]byte(signed), jwt.WithKeySet(set), jwt.WithValidate(false)); err != nil {
t.Fatalf("verify ES256K token: %v", err)
}
}