create_test.go

package dpop_test

import (
	"crypto"
	"crypto/ecdsa"
	"crypto/ed25519"
	"crypto/elliptic"
	"crypto/rand"
	"crypto/rsa"
	"errors"
	"io"
	"net/url"
	"testing"
	"time"

	"github.com/AxisCommunications/go-dpop"
	"github.com/golang-jwt/jwt/v5"
)

// Test that an unsupported key type returns an error
func TestCreate_UnsupportedKeyType(t *testing.T) {
	res, err := dpop.Create(jwt.SigningMethodES256, dpop.ProofTokenClaims{}, &testKey{})
	if err == nil {
		t.Error("expected error")
	}
	if !errors.Is(err, dpop.ErrUnsupportedKeyAlgorithm) {
		t.Errorf("expected %v, got %v", dpop.ErrUnsupportedKeyAlgorithm, err)
	}
	if res != "" {
		t.Error("expected empty result")
	}
}

// Test that a proof generated by 'Create' with a ES256 key can be parsed without error
func TestCreate_UnboundES256(t *testing.T) {
	claims := &dpop.ProofTokenClaims{
		RegisteredClaims: &jwt.RegisteredClaims{
			Issuer:    "test",
			Subject:   "sub",
			IssuedAt:  jwt.NewNumericDate(time.Now()),
			ExpiresAt: jwt.NewNumericDate(time.Now().Add(time.Minute)),
			ID:        "id",
		},
		Method: dpop.POST,
		URL:    "https://server.example.com/token",
	}

	privateKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
		t.Error(err)
	}

	res, err := dpop.Create(jwt.SigningMethodES256, claims, privateKey)
	if err != nil {
		t.Error(err)
	}
	if res == "" {
		t.Error("empty proof")
	}

	parsedProof, err := dpop.Parse(res, dpop.POST, &url.URL{Scheme: "https", Host: "server.example.com", Path: "/token"}, dpop.ParseOptions{})
	if err != nil {
		t.Error(err)
	}

	if !parsedProof.Valid {
		t.Error("invalid proof")
	}
}

// Test that a proof generated by 'Create' with a ES384 key can be parsed without error
func TestCreate_UnboundES384(t *testing.T) {
	claims := &dpop.ProofTokenClaims{
		RegisteredClaims: &jwt.RegisteredClaims{
			Issuer:    "test",
			Subject:   "sub",
			IssuedAt:  jwt.NewNumericDate(time.Now()),
			ExpiresAt: jwt.NewNumericDate(time.Now().Add(time.Minute)),
			ID:        "id",
		},
		Method: dpop.POST,
		URL:    "https://server.example.com/token",
	}

	privateKey, err := ecdsa.GenerateKey(elliptic.P384(), rand.Reader)
	if err != nil {
		t.Error(err)
	}

	res, err := dpop.Create(jwt.SigningMethodES384, claims, privateKey)
	if err != nil {
		t.Error(err)
	}
	if res == "" {
		t.Error("empty proof")
	}

	parsedProof, err := dpop.Parse(res, dpop.POST, &url.URL{Scheme: "https", Host: "server.example.com", Path: "/token"}, dpop.ParseOptions{})
	if err != nil {
		t.Error(err)
	}

	if !parsedProof.Valid {
		t.Error("invalid proof")
	}
}

// Test that a proof generated by 'Create' with a ES512 key can be parsed without error
func TestCreate_UnboundES512(t *testing.T) {
	claims := &dpop.ProofTokenClaims{
		RegisteredClaims: &jwt.RegisteredClaims{
			Issuer:    "test",
			Subject:   "sub",
			IssuedAt:  jwt.NewNumericDate(time.Now()),
			ExpiresAt: jwt.NewNumericDate(time.Now().Add(time.Minute)),
			ID:        "id",
		},
		Method: dpop.POST,
		URL:    "https://server.example.com/token",
	}

	privateKey, err := ecdsa.GenerateKey(elliptic.P521(), rand.Reader)
	if err != nil {
		t.Error(err)
	}

	res, err := dpop.Create(jwt.SigningMethodES512, claims, privateKey)
	if err != nil {
		t.Error(err)
	}
	if res == "" {
		t.Error("empty proof")
	}

	parsedProof, err := dpop.Parse(res, dpop.POST, &url.URL{Scheme: "https", Host: "server.example.com", Path: "/token"}, dpop.ParseOptions{})
	if err != nil {
		t.Error(err)
	}

	if !parsedProof.Valid {
		t.Error("invalid proof")
	}
}

// Test that a proof generated by 'Create' with a RS256 key can be parsed without error
func TestCreate_UnboundRS256(t *testing.T) {
	claims := &dpop.ProofTokenClaims{
		RegisteredClaims: &jwt.RegisteredClaims{
			Issuer:    "test",
			Subject:   "sub",
			IssuedAt:  jwt.NewNumericDate(time.Now()),
			ExpiresAt: jwt.NewNumericDate(time.Now().Add(time.Minute)),
			ID:        "id",
		},
		Method: dpop.POST,
		URL:    "https://server.example.com/token",
	}

	privateKey, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		t.Error(err)
	}

	res, err := dpop.Create(jwt.SigningMethodRS256, claims, privateKey)
	if err != nil {
		t.Error(err)
	}
	if res == "" {
		t.Error("empty proof")
	}

	parsedProof, err := dpop.Parse(res, dpop.POST, &url.URL{Scheme: "https", Host: "server.example.com", Path: "/token"}, dpop.ParseOptions{})
	if err != nil {
		t.Error(err)
	}

	if !parsedProof.Valid {
		t.Error("invalid proof")
	}
}

// Test that a proof generated by 'Create' with a PS256 key can be parsed without error
func TestCreate_UnboundPS256(t *testing.T) {
	claims := &dpop.ProofTokenClaims{
		RegisteredClaims: &jwt.RegisteredClaims{
			Issuer:    "test",
			Subject:   "sub",
			IssuedAt:  jwt.NewNumericDate(time.Now()),
			ExpiresAt: jwt.NewNumericDate(time.Now().Add(time.Minute)),
			ID:        "id",
		},
		Method: dpop.POST,
		URL:    "https://server.example.com/token",
	}

	privateKey, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		t.Error(err)
	}

	res, err := dpop.Create(jwt.SigningMethodPS256, claims, privateKey)
	if err != nil {
		t.Error(err)
	}
	if res == "" {
		t.Error("empty proof")
	}

	parsedProof, err := dpop.Parse(res, dpop.POST, &url.URL{Scheme: "https", Host: "server.example.com", Path: "/token"}, dpop.ParseOptions{})
	if err != nil {
		t.Error(err)
	}

	if !parsedProof.Valid {
		t.Error("invalid proof")
	}
}

// Test that a proof generated by 'Create' with a Ed25519 key can be parsed without error
func TestCreate_UnboundEd25519(t *testing.T) {
	claims := &dpop.ProofTokenClaims{
		RegisteredClaims: &jwt.RegisteredClaims{
			Issuer:    "test",
			Subject:   "sub",
			IssuedAt:  jwt.NewNumericDate(time.Now()),
			ExpiresAt: jwt.NewNumericDate(time.Now().Add(time.Minute)),
			ID:        "id",
		},
		Method: dpop.POST,
		URL:    "https://server.example.com/token",
	}

	_, privateKey, err := ed25519.GenerateKey(rand.Reader)
	if err != nil {
		t.Error(err)
	}

	res, err := dpop.Create(jwt.SigningMethodEdDSA, claims, privateKey)
	if err != nil {
		t.Error(err)
	}
	if res == "" {
		t.Error("empty proof")
	}

	parsedProof, err := dpop.Parse(res, dpop.POST, &url.URL{Scheme: "https", Host: "server.example.com", Path: "/token"}, dpop.ParseOptions{})
	if err != nil {
		t.Error(err)
	}

	if !parsedProof.Valid {
		t.Error("invalid proof")
	}
}

// Test that a bound proof generated by 'Create' can be used to validate a bound token
func TestCreate_BoundProof(t *testing.T) {
	accessTokenHash := "testToken"
	claims := &dpop.ProofTokenClaims{
		RegisteredClaims: &jwt.RegisteredClaims{
			Issuer:    "test",
			Subject:   "sub",
			IssuedAt:  jwt.NewNumericDate(time.Now()),
			ExpiresAt: jwt.NewNumericDate(time.Now().Add(time.Minute)),
			ID:        "id",
		},
		Method:          dpop.POST,
		URL:             "https://server.example.com/token",
		AccessTokenHash: accessTokenHash,
	}

	privateKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
		t.Error(err)
	}

	res, err := dpop.Create(jwt.SigningMethodES256, claims, privateKey)
	if err != nil {
		t.Error(err)
	}
	if res == "" {
		t.Error("empty proof")
	}

	parsedProof, err := dpop.Parse(res, dpop.POST, &url.URL{Scheme: "https", Host: "server.example.com", Path: "/token"}, dpop.ParseOptions{})
	if err != nil {
		t.Error(err)
	}
	if !parsedProof.Valid {
		t.Error("invalid proof")
	}

	err = parsedProof.Validate([]byte(accessTokenHash), &jwt.Token{
		Claims: &dpop.BoundAccessTokenClaims{
			Confirmation: dpop.Confirmation{
				JWKThumbprint: parsedProof.PublicKey(),
			},
		},
	})
	if err != nil {
		t.Error(err)
	}
}

type testKey struct{}

func (testKey) Public() crypto.PublicKey {
	return nil
}
func (testKey) Sign(rand io.Reader, digest []byte, opts crypto.SignerOpts) (signature []byte, err error) {
	return []byte(""), nil
}