Documentation
¶
Overview ¶
Package gauthtest provides a fake Google OIDC issuer for offline tests of the gauth mint/verify paths — no network, no credentials, no test users.
Three pieces mirror the production topology:
- MintIDToken signs RS256 ID tokens with a throwaway key (the fake "Google");
- ClientOption returns an HTTP client option whose transport serves this issuer's JWKS, so gauth.Verifier validates those tokens for real (idtoken checks signature/expiry/audience against the fetched keys and does not pin the issuer);
- TokenEndpoint + WriteServiceAccountKey fake the OAuth2 JWT-bearer grant: a fabricated service-account key whose token_uri points at the local endpoint lets idtoken.NewTokenSource (via GOOGLE_APPLICATION_CREDENTIALS) mint this issuer's tokens through the real client library path.
Index ¶
- type Issuer
- func (i *Issuer) ClientOption() option.ClientOption
- func (i *Issuer) MintIDToken(email, audience string, ttl time.Duration) (string, error)
- func (i *Issuer) MintIDTokenClaims(claims map[string]any) (string, error)
- func (i *Issuer) TokenEndpoint() *httptest.Server
- func (i *Issuer) WriteServiceAccountKey(dir, email, tokenURL string) (string, error)
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Issuer ¶
type Issuer struct {
Key *rsa.PrivateKey
KeyID string
}
Issuer is a fake Google OIDC token issuer backed by a throwaway RSA key.
func (*Issuer) ClientOption ¶
func (i *Issuer) ClientOption() option.ClientOption
ClientOption returns the option to pass to gauth.Verifier so token validation fetches this issuer's JWKS instead of Google's.
func (*Issuer) MintIDToken ¶
MintIDToken signs an ID token for email/audience valid for ttl.
func (*Issuer) MintIDTokenClaims ¶
MintIDTokenClaims signs an ID token with exactly the given claims — edge cases (expired, unverified email, missing claims) set them explicitly.
func (*Issuer) TokenEndpoint ¶
TokenEndpoint starts a fake OAuth2 token endpoint implementing the JWT-bearer grant the way Google's does for ID tokens: it decodes the (unverified) assertion, reads the service account's email from `iss` and the requested audience from `target_audience`, and answers with an id_token minted by this issuer. Close the returned server when done.
func (*Issuer) WriteServiceAccountKey ¶
WriteServiceAccountKey writes a fabricated service-account key file whose token_uri points at tokenURL, and returns its path. Point GOOGLE_APPLICATION_CREDENTIALS at it so idtoken.NewTokenSource mints through the real JWT-bearer flow against the fake endpoint.
Source Files