Documentation
¶
Overview ¶
Package iamtest is a REAL IAM issuer for tests: a keypair, a JWKS endpoint, and tokens signed with it.
It exists because a stubbed validator cannot observe the bugs that live in the claim mapping. What makes an IAM lane safe is HOW a verified token becomes a principal — which claim is read for the subject, what happens when `sub` is absent, whether an id_token is distinguishable from an access token — and a stub that returns a pre-built identity has already made every one of those decisions itself. A test built on one asserts its own fixture.
It is one package rather than a copy per caller for the same reason everything else here is: two fixtures for one wire drift, and the one that drifts is the one whose test then passes against code that would fail in production.
SIGNING HERE GRANTS NOTHING. The key is generated per test and its JWKS is served on a loopback address the test itself owns; no deployment trusts either. This is the "forging a bad token is how a verifier gets tested" case the token gate names as out of scope, made explicit and shared instead of retyped.
Index ¶
Constants ¶
const Audience = "hanzo-team"
Audience is the app the minted tokens are FOR, unless a case overrides it. A resource server that gates on audience is told this value; one that does not ignores it.
const Issuer = "https://test.iam"
Issuer is the issuer the minted tokens name and the validator under test trusts.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Claims ¶
type Claims struct {
// Sub is the `sub` claim. EMPTY MEANS OMITTED — the subject-confusion case is
// a token that carries none, which a typed struct could not express.
Sub string
// PreferredUsername is the IAM username claim, the half of the canonical-user-id
// fallback chain that a subject-less token resolves through.
PreferredUsername string
// Name is IAM's display-name claim, the last fallback in that chain.
Name string
// Owner is the home org — the tenant every account-store query scopes to.
Owner string
// TokenType is IAM's `tokenType`. Empty defaults to an access token; "-" omits
// the claim entirely, which is the pre-rollout token shape.
TokenType string
// Orgs is the signed membership set. Its FIRST entry is the home org — the
// tenant rule the estate states in idClaims.homeOrg — so a case that omits it
// mints a token with no home, which is what a machine credential looks like.
Orgs []map[string]any
// Aud overrides the audience, for the case where a token was minted for a
// DIFFERENT app than the one being asked to accept it.
Aud string
// Exp defaults to an hour out. A past value mints an expired token.
Exp time.Time
}
Claims is the claim vocabulary a test varies. Every field maps to a real IAM claim; nothing here is a cloud-side invention.
type Issuer0 ¶
type Issuer0 struct {
// URL is the JWKS endpoint. Point a validator at it with CLOUD_JWKS_URL.
URL string
// contains filtered or unexported fields
}
Issuer0 is a signing issuer plus its published JWKS.
Source Files