harness

securex test harness

Helpers for exercising the generated API's RBAC/ABAC authorization from tests. The harness mints standard RFC 7519 HS256 JWTs, so any test framework — Go or not — can verify them with no apic-specific code.

Go usage

secret := []byte("shared-secret")
tok, _ := harness.BuildHS256Token(secret, harness.JWTClaims{
    Subject: "alice@example.com",
    Roles:   []string{"admin"},
    Scopes:  []string{"admin:actions:write"},
})
req.Header.Set("Authorization", harness.BearerHeader(tok)) // "Bearer <tok>"

Cross-language recipe (verified non-Go path)

The token is a plain HS256 JWT ({"alg":"HS256","typ":"JWT"} header) with the claim shape below — verifiable by any RFC 7519 / RFC 7515 library.

Claim shape (JWTClaims)

1. Mint a token (any stack can shell out to this)

GOEXPERIMENT=jsonv2 go run ./pkg/securex/harness/cmd/mint \
  -secret "shared-secret" \
  -sub "alice@example.com" \
  -roles "admin,user" \
  -scopes "admin:actions:write" \
  -exp 5m

The minted JWT is printed to stdout.

2. Verify it in pytest / PyJWT

testdata/verify_token.py reads the token and secret from the environment (HARNESS_JWT, HARNESS_SECRET) and verifies with PyJWT:

HARNESS_JWT="$(GOEXPERIMENT=jsonv2 go run ./pkg/securex/harness/cmd/mint \
  -secret shared-secret -sub alice@example.com -roles admin)" \
HARNESS_SECRET="shared-secret" \
  python3 pkg/securex/harness/testdata/verify_token.py --expect-sub alice@example.com

In pytest:

import os
import subprocess

def test_harness_token_verifies():
    tok = subprocess.check_output([
        "go", "run", "./pkg/securex/harness/cmd/mint",
        "-secret", "shared-secret", "-sub", "alice@example.com",
        "-roles", "admin",
    ], text=True, env={**os.environ, "GOEXPERIMENT": "jsonv2"}).strip()

    import jwt  # PyJWT
    claims = jwt.decode(tok, "shared-secret", algorithms=["HS256"])
    assert claims["sub"] == "alice@example.com"

3. Present it to a securex-protected endpoint with curl

TOK="$(GOEXPERIMENT=jsonv2 go run ./pkg/securex/harness/cmd/mint \
  -secret shared-secret -sub alice@example.com -roles admin)"
curl -H "Authorization: Bearer ${TOK}" https://localhost:8443/protected

Contract

• Algorithm: HMAC-SHA-256 (HS256).
• Standard: RFC 7519 (JWT) over RFC 7515 (JWS compact serialization).
• Claims: the JWTClaims shape above.

The external_integration_test.go test pins this contract: it asserts the structural JWT shape and a securex.VerifyJWT round-trip on every run, and — when PyJWT is installed — has PyJWT independently verify the same token.