Documentation
¶
Overview ¶
Package keystest provides RSA / HMAC key fixtures for tests that exercise the auth subsystem (JWT issue/verify, HMAC service-token rings, OIDC stubs).
All helpers in this package are STRICTLY test-only. Production callers must use runtime/auth.GenerateRSAKeyPair / NewKeySet / NewHMACKeyRing directly.
The package was extracted from runtime/auth in PR #B2-K-02 to physically isolate test-only Must* helpers from the production auth namespace: production callers cannot accidentally pull in test key material because the symbol `auth.MustGenerateTestKeyPair` no longer exists — they must explicitly import `runtime/auth/keystest`, which any code review will flag.
See ADR `docs/architecture/202605171800-adr-kernel-mustctor-removal.md` (Hard 主防线 = symbol 物理迁包) and K8s `net/http/httptest` precedent.
Naming: helpers drop the legacy `Test` infix (`MustGenerateKeyPair`, `MustNewKeySet`, `MustNewKeyProvider`) because the package name already conveys the test context. Following K8s `httptest.NewRecorder`, not `httptest.NewTestRecorder`.
Coverage note: the panic blocks below are defensive against errors that are unreachable in practice (crypto/rand never fails, hardcoded HMAC secret is always ≥32 bytes, MustGenerateKeyPair returns non-nil keys). Per PANIC-REGISTERED-01 (panicregister.Approved reason must be a const string literal at the panic call site), these blocks cannot be funneled through a single helper without violating the literal-reason invariant — see the mustNoErr funnel design rejected at PR #553 review, ADR §"Coverage limits".
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func MustGenerateKeyPair ¶
func MustGenerateKeyPair() (*rsa.PrivateKey, *rsa.PublicKey)
MustGenerateKeyPair generates a 2048-bit RSA key pair for tests and examples. Panics on RNG failure (extremely rare; treated as a programmer error in the test caller's environment).
func MustNewKeyProvider ¶
func MustNewKeyProvider(clk clock.Clock) auth.KeyProvider
MustNewKeyProvider creates an auth.KeyProvider with ephemeral RSA and HMAC keys for tests. Panics on construction error. clk is required.
WARNING: hardcoded HMAC secret. DO NOT use in any production or staging path.
func MustNewKeySet ¶
MustNewKeySet creates a *auth.KeySet from a freshly generated 2048-bit RSA key pair. Panics on construction error. clk is required; pass clock.Real() from the test composition root or clockmock.New(...) for time-controlled tests.
Types ¶
This section is empty.
Source Files