Documentation
¶
Overview ¶
Package identitytest is a fake OpenID Provider for the identity verifier's tests and for the API layer's real-token tests (api/identitylane_test.go).
It deliberately does not import internal/identity: with no cycle, that package's own in-package test files may use it, and so may any consumer. For the same reason there is no fake verifier here — a consumer that wants one declares the interface it needs in its own test files, where a Go consumer's interface belongs.
Index ¶
- type Clock
- type IdP
- func (p *IdP) ActiveKID() string
- func (p *IdP) AddECKey(t *testing.T) string
- func (p *IdP) AddKey(t *testing.T, alg string) string
- func (p *IdP) BlockJWKS(release <-chan struct{})
- func (p *IdP) Claims(aud string, now time.Time) map[string]any
- func (p *IdP) Client() *http.Client
- func (p *IdP) Discoveries() int
- func (p *IdP) DiscoveryURL() string
- func (p *IdP) FailJWKS(status int)
- func (p *IdP) Fetches() int
- func (p *IdP) Issuer() string
- func (p *IdP) JWKSURL() string
- func (p *IdP) Mint(t *testing.T, claims map[string]any) string
- func (p *IdP) MintRaw(t *testing.T, header, claims map[string]any, ...) string
- func (p *IdP) MintWith(t *testing.T, kid string, claims map[string]any) string
- func (p *IdP) PublicKeyDER(t *testing.T, kid string) []byte
- func (p *IdP) RedirectJWKS(status int, to string)
- func (p *IdP) Restore()
- func (p *IdP) Retire(t *testing.T, kid string)
- func (p *IdP) Rotate(t *testing.T) string
- func (p *IdP) SetDiscovery(doc map[string]any)
- func (p *IdP) SetJWKSBody(body []byte)
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Clock ¶
type Clock struct {
// contains filtered or unexported fields
}
Clock is a race-safe test clock for a verifier's Now, over atomic nanoseconds, so a -race test may advance it while verifications run.
type IdP ¶
type IdP struct {
// contains filtered or unexported fields
}
IdP is a fake OpenID Provider on httptest: a discovery document, a JWK Set, and token minting, with per-test overrides for the failure shapes a verifier must survive.
func (*IdP) AddKey ¶
AddKey publishes an additional key for one of the five allowed algorithms and returns its kid. The active key is unchanged.
func (*IdP) BlockJWKS ¶
func (p *IdP) BlockJWKS(release <-chan struct{})
BlockJWKS holds the key-set handler open until release is closed, so a test can drive the single-flight and deadline paths without sleeping.
func (*IdP) Claims ¶
Claims returns a minimally valid claim set: iss, aud, sub, iat, nbf and an exp one hour out, and nothing else. A test mutates or deletes fields to build its case; Mint fills in nothing, so no later reader has to reverse-engineer a hidden default.
func (*IdP) Client ¶
Client reaches the provider on loopback. Supply it as the verifier's HTTP client: the production client's dial guard refuses loopback by design.
func (*IdP) Discoveries ¶
Discoveries counts well-known requests served.
func (*IdP) DiscoveryURL ¶
DiscoveryURL is the well-known metadata URL.
func (*IdP) MintRaw ¶
func (p *IdP) MintRaw(t *testing.T, header, claims map[string]any, sign func(signingInput []byte) []byte) string
MintRaw assembles b64(header).b64(claims).b64(sign(signingInput)) by hand.
It exists because go-jose will not sign alg:none and will not HMAC with an RSA public key — and those two tokens, the none forgery and the classic key-confusion token MACed with the published public key, are exactly the ones a verifier must refuse. Neither can be built through any signing library.
func (*IdP) PublicKeyDER ¶
PublicKeyDER returns a key's public half in DER — the "secret" a key-confusion token is MACed with.
func (*IdP) RedirectJWKS ¶
RedirectJWKS makes the key-set endpoint redirect.
func (*IdP) Retire ¶
Retire removes a key from the published set. Tokens it signed stay valid until the verifier's key set expires, which is the property under test.
func (*IdP) Rotate ¶
Rotate publishes a new RS256 key, makes it active, and keeps the old one published — the shape a real rotation takes.
func (*IdP) SetDiscovery ¶
SetDiscovery replaces the metadata document: a wrong issuer, a missing or non-https jwks_uri.
func (*IdP) SetJWKSBody ¶
SetJWKSBody replaces the key-set response with arbitrary bytes: malformed, oversize, or holding entries no library can build.
Source Files