Repository navigation
test(client): cover unprotected client, resource and JOSE checks - #810
Merged
Merged
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
Add tests for verification checks that no existing test failed without: - ID token whose aud names only trusted audiences, never the client, with and without azp, is refused (ErrAudienceMismatch) - JARM responses signed with the wrong key, or with the wrong iss or aud, expired, or exp beyond MaxJARMResponseLifetime, are refused - JARM and request-object nbf more than MaxClockSkew in the future is refused; nbf within the skew is accepted - request-object jti, sub and nbf of the wrong type or empty are ErrMalformedClaims - resource: a pairwise lookup returning no subject and no error is a 500 - resource: a code_grant_id-only token's revoked code grant is refused with a RevocationBatchChecker as without one - client CIBA poll refuses token_type Bearer under DPoP - client AssuranceProduction refuses non-Durable custody for Keys and Decryption - client config: invalid ID token / UserInfo encryption algorithms, missing JARM algorithm, zero or over-60-minute request object lifetime (60 minutes accepted), zero MaxJARMResponseLifetime each refused with its own error - fapihttp: a host resolving to no addresses is ErrSSRFBlocked before any round trip - jwe: A256CBC-HS512 with a wrong-length IV and a matching tag is ErrDecryptionFailed, not a panic Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
osanderson
force-pushed
the
test/client-resource-crypto-coverage-gaps
branch
from
November 8, 2026 23:14
888072a to
100663d
Compare
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Test-only. Each test below guards a verification check that the existing suite didn't protect: removing, inverting or forcing the check left
go test ./...green. Every new test fails against that mutant and passes on the unmodified code.internal/token
TestIDTokenValidateRejectsOnlyTrustedAudiences: an ID token whoseaudlists onlyTrustedAudiencesand never the client isErrAudienceMismatch, with and withoutazp(validate.go!sawExpectedAudience)client
TestHandleAuthorizationResponseRejectsUnverifiableJARM: a JARM response with the wrong signing key, wrong iss, wrong aud, an exp in the past, or an exp beyondMaxJARMResponseLifetimeis refused asinvalid_response, wrapping the matching sentinel errorTestPollBackchannelAuthenticationRejectsBearerUnderDPoP: a CIBA poll response withtoken_type: Beareris refused for a DPoP clientTestNewProductionRequires{Client,Decryption}KeyCustody: production refuses declared but non-Durable custody forKeysandDecryptionTestNewNamesEachEncryptionAndMessageSigningRefusal: each of these is refused with its own error: invalid ID token / UserInfo key-management and content-encryption algorithms, a missing JARM algorithm, a zero or over-60-minute request object lifetime, and a zeroMaxJARMResponseLifetime. Exactly 60 minutes is accepted.resource
TestVerifyResolvesPairwiseSubjects: a new case where the pairwise lookup returns("", nil), which gives a 500TestVerifyChecksTheCodeGrantRevocation: each case now also runs with aRevocationBatchChecker, so a token carrying onlycode_grant_idmust still have its revoked code grant refused on the batch pathfapihttp
TestFetchRejectsHostResolvingToNoAddresses: a resolver that returns zero IPs givesErrSSRFBlockedbefore any round tripinternal/requestobject, internal/jarm
TestVerifyBoundsFutureNotBefore(both packages): annbfmore thanMaxClockSkewahead isErrNotYetValid; one within the skew is acceptedTestParseClaimsRejectsMalformedOptionalClaims: a wrongly typed or emptyjtiorsub, and a non-numericnbf, areErrMalformedClaimsinternal/jwe
TestOpenCBCHMACRejectsWrongIVSizeWithValidTag: a wrong-length IV with a tag that matches it isErrDecryptionFailed, not a panic incipher.NewCBCDecrypter🤖 Generated with Claude Code