diff --git a/crates/lib/api_clients/google_sign_in/src/certs/jwk_to_public_key.rs b/crates/lib/api_clients/google_sign_in/src/certs/jwk_to_public_key.rs index 193c22161f..39b6aeef8a 100644 --- a/crates/lib/api_clients/google_sign_in/src/certs/jwk_to_public_key.rs +++ b/crates/lib/api_clients/google_sign_in/src/certs/jwk_to_public_key.rs @@ -70,7 +70,7 @@ mod tests { #[test] fn test_jwk_payload_decode() { - let file = test_file_path("test_data/crypto/google_signin.jwk").unwrap(); + let file = test_file_path("../../../../../../test_data/crypto/google_sign_in.2024-09-20.jwk").unwrap(); let jwk_payload = read_to_string(file).unwrap(); let key_map = jwk_to_public_key(&jwk_payload).unwrap(); diff --git a/crates/lib/api_clients/google_sign_in/src/decode_and_verify_token_claims.rs b/crates/lib/api_clients/google_sign_in/src/decode_and_verify_token_claims.rs index 076f0ce13c..6274124855 100644 --- a/crates/lib/api_clients/google_sign_in/src/decode_and_verify_token_claims.rs +++ b/crates/lib/api_clients/google_sign_in/src/decode_and_verify_token_claims.rs @@ -78,15 +78,13 @@ mod tests { #[test] fn test_decode() { - let jwk_file = test_file_path("test_data/crypto/google_signin.jwk").unwrap(); + let jwk_file = test_file_path("test_data/crypto/google_sign_in.2024-09-20.jwk").unwrap(); + //let jwk_file = test_file_path("test_data/crypto/google_sign_in.2024-04-01.jwk").unwrap(); let jwk_payload = read_to_string(jwk_file).unwrap(); let key_map = jwk_to_public_key(&jwk_payload).unwrap(); + //let credential = "eyJhbGciOiJSUzI1NiIsImtpZCI6ImIyNjIwZDVlN2YxMzJiNTJhZmU4ODc1Y2RmMzc3NmMwNjQyNDlkMDQiLCJ0eXAiOiJKV1QifQ.eyJpc3MiOiJodHRwczovL2FjY291bnRzLmdvb2dsZS5jb20iLCJhenAiOiI3ODg4NDMwMzQyMzctdXFjZzh0YmdvZnJjZjF0bzM3ZTFicXBoZDkyNGphZjYuYXBwcy5nb29nbGV1c2VyY29udGVudC5jb20iLCJhdWQiOiI3ODg4NDMwMzQyMzctdXFjZzh0YmdvZnJjZjF0bzM3ZTFicXBoZDkyNGphZjYuYXBwcy5nb29nbGV1c2VyY29udGVudC5jb20iLCJzdWIiOiIxMTMxMDE5Njc2MTIzOTY3OTM3NzciLCJlbWFpbCI6InZvY29kZXMyMDIwQGdtYWlsLmNvbSIsImVtYWlsX3ZlcmlmaWVkIjp0cnVlLCJuYmYiOjE3MjY4Njk0OTgsIm5hbWUiOiJWb2NvZGVzIFZvY29kZXMiLCJwaWN0dXJlIjoiaHR0cHM6Ly9saDMuZ29vZ2xldXNlcmNvbnRlbnQuY29tL2EvQUNnOG9jTHoyLTJPYUFtME1ReFI2ajhDTnItUG84X1hyLWFyeUFUaUNuNGMwaV9UdURtTF9nPXM5Ni1jIiwiZ2l2ZW5fbmFtZSI6IlZvY29kZXMiLCJmYW1pbHlfbmFtZSI6IlZvY29kZXMiLCJpYXQiOjE3MjY4Njk3OTgsImV4cCI6MTcyNjg3MzM5OCwianRpIjoiMGUyZTI0ZjE0M2ZlODk1NDlkM2I0NTkxNjBmYTY0ODc0YzFkZmIyYiJ9.ciKy6sIbZx1Z4mtXdXwy6eVDW2Q96ed7MyP1jOdGow5p9FpDUR8lTqIdMiKEkrp3j99Ipjv2y7iMZH23pC5ipWKqkP_Z4yxotN3ULnKFqkFnyEsHtvQDfc5CSmICcREEwjf2n9ngGycxYZ342n9rKRr893TFzp5sjy2DHxv1zpt6hsA2NSjoKPA4fmBOdJ_GnyWZYMQ1ABVFFnCsEVME2C53DBAWNs3OSlDN4U-QCRlb0LtpxU9_f1GUN4Vff7aSuIyGKY9SCIWlbf772br4HEjLXCDygaTRTgBUa-f5XJaOKLnsORCQwki7EqHgGYemMoQCOVaFXHj7N_8xBxyDgw"; let credential = "eyJhbGciOiJSUzI1NiIsImtpZCI6ImIyNjIwZDVlN2YxMzJiNTJhZmU4ODc1Y2RmMzc3NmMwNjQyNDlkMDQiLCJ0eXAiOiJKV1QifQ.eyJpc3MiOiJodHRwczovL2FjY291bnRzLmdvb2dsZS5jb20iLCJhenAiOiI3ODg4NDMwMzQyMzctdXFjZzh0YmdvZnJjZjF0bzM3ZTFicXBoZDkyNGphZjYuYXBwcy5nb29nbGV1c2VyY29udGVudC5jb20iLCJhdWQiOiI3ODg4NDMwMzQyMzctdXFjZzh0YmdvZnJjZjF0bzM3ZTFicXBoZDkyNGphZjYuYXBwcy5nb29nbGV1c2VyY29udGVudC5jb20iLCJzdWIiOiIxMTMxMDE5Njc2MTIzOTY3OTM3NzciLCJlbWFpbCI6InZvY29kZXMyMDIwQGdtYWlsLmNvbSIsImVtYWlsX3ZlcmlmaWVkIjp0cnVlLCJuYmYiOjE3MjY3ODYxMDAsIm5hbWUiOiJWb2NvZGVzIFZvY29kZXMiLCJwaWN0dXJlIjoiaHR0cHM6Ly9saDMuZ29vZ2xldXNlcmNvbnRlbnQuY29tL2EvQUNnOG9jTHoyLTJPYUFtME1ReFI2ajhDTnItUG84X1hyLWFyeUFUaUNuNGMwaV9UdURtTF9nPXM5Ni1jIiwiZ2l2ZW5fbmFtZSI6IlZvY29kZXMiLCJmYW1pbHlfbmFtZSI6IlZvY29kZXMiLCJpYXQiOjE3MjY3ODY0MDAsImV4cCI6MTcyNjc5MDAwMCwianRpIjoiNGQ0NGVlYWMwNmNlNzlmYzBhYjIyNzBjZmVlYTMwZDhhY2Y3NzYxMyJ9.EYg71yIkvhxFGc8ZVCXeTOAmPAtLYDphHnkdf1sh8b_Jz4Y7S1DpmiTqQ1ytxu7J1xNixvdwhuIDzSlCvlxaFl8475GvAlyPTNtZtmWbFD5SRM_XHLOynijOp8WQ4nej-CHvT1KjjqMfkZ1EeQMoWk1H72PxPg_RiUgzsklkUs1wOkLAySk7R3EIAl7bIzpoY_WH2pxv9ccFpBtKDHaDqHkxAWBUQX0-G7ZXZBPVz07V28ZfdbzFDapjZaUFbumazh_-J2-9AA6JkcteF4h_gpbBcLYAuxt5bWI5FECWbYe42khwb93WJ5SK12Tt0EPoyzIObJs14NWGAajtHTg3wA"; - let key = key_map.get("b2620d5e7f132b52afe8875cdf3776c064249d04").unwrap(); - - // NB: This key won't work: - // let key = key_map.get("5aaff47c21d06e266cce395b2145c7c6d4730ea5").unwrap(); let options = VerificationOptions { time_tolerance: Some(Duration::from_days(365 * 30)), @@ -96,7 +94,12 @@ mod tests { }; // This should work - let claims = decode_and_verify_token_claims_with_key(key, credential, Some(options.clone())).unwrap(); + //let key = key_map.get("b2620d5e7f132b52afe8875cdf3776c064249d04").unwrap(); + + // NB: This key won't work: + // let key = key_map.get("5aaff47c21d06e266cce395b2145c7c6d4730ea5").unwrap(); + + //let claims = decode_and_verify_token_claims_with_key(key, credential, Some(options.clone())).unwrap(); // As should this much more ergonomic method let claims = decode_and_verify_token_claims(&key_map, credential, Some(options)).unwrap(); diff --git a/test_data/crypto/google_sign_in.2024-04-01.jwk b/test_data/crypto/google_sign_in.2024-04-01.jwk new file mode 100644 index 0000000000..5c12772aa5 --- /dev/null +++ b/test_data/crypto/google_sign_in.2024-04-01.jwk @@ -0,0 +1,20 @@ +{ + "keys": [ + { + "n": "y48N6JB-AKq1-Rv4SkwBADU-hp4zXHU-NcCUwxD-aS9vr4EoT9qrjoJ-YmkaEpq9Bmu1yXZZK_h_9QS3xEsO8Rc_WSvIQCJtIaDQz8hxk4lUjUQjMB4Zf9vdTmf8KdktI9tCYCbuSbLC6TegjDM9kbl9CNs3m9wSVeO_5JXJQC0Jr-Oj7Gz9stXm0Co3f7RCxrD08kLelXaAglrd5TeGjZMyViC4cw1gPaj0Cj6knDn8UlzR_WuBpzs_ies5BrbzX-yht0WfnhXpdpiGNMbpKQD04MmPdMCYq8ENF7q5_Ok7dPsVj1vHA6vFGnf7qE3smD157szsnzn0NeXIbRMnuQ", + "alg": "RS256", + "use": "sig", + "e": "AQAB", + "kty": "RSA", + "kid": "adf5e710edfebecbefa9a61495654d03c0b8edf8" + }, + { + "n": "uhWRpJ3PNZaiBmq3P91A6QB0b28LeQvV-HI0TAEcN5nffQPm94w-hY2S6mThb7xXLCGHcP3bhpWl31giZJFlvzHe6db-TsPl8HSLgLIjMbMT8iYWqZPa2eodijEJrkO6SPex5jHLzSwGsoRdSfW8hFeTFQk8xtPXm7GlEEo9mFEKUAaArT9acdE8h53VR7ZkJkipiLCtx0rhySA2W4rEAcinLG3ApG709pOw6sVjA2IAQmZVYrfQ7curmFqKWL_F534kDhQJL2hMdrubhHcqCxetyi_U7WDWDkYCJ_CetjDsI0yfwB2sR01vn6LuDDo6ho8pWJcHOOvXYUnSMFAlew", + "use": "sig", + "kid": "934a5816468b95703953d14e9f15df5d09a401e4", + "alg": "RS256", + "e": "AQAB", + "kty": "RSA" + } + ] +} \ No newline at end of file diff --git a/test_data/crypto/google_sign_in.2024-09-20.jwk b/test_data/crypto/google_sign_in.2024-09-20.jwk new file mode 100644 index 0000000000..13e978d598 --- /dev/null +++ b/test_data/crypto/google_sign_in.2024-09-20.jwk @@ -0,0 +1,20 @@ +{ + "keys": [ + { + "e": "AQAB", + "n": "pi22xDdK2fz5gclIbDIGghLDYiRO56eW2GUcboeVlhbAuhuT5mlEYIevkxdPOg5n6qICePZiQSxkwcYMIZyLkZhSJ2d2M6Szx2gDtnAmee6o_tWdroKu0DjqwG8pZU693oLaIjLku3IK20lTs6-2TeH-pUYMjEqiFMhn-hb7wnvH_FuPTjgz9i0rEdw_Hf3Wk6CMypaUHi31y6twrMWq1jEbdQNl50EwH-RQmQ9bs3Wm9V9t-2-_Jzg3AT0Ny4zEDU7WXgN2DevM8_FVje4IgztNy29XUkeUctHsr-431_Iu23JIy6U4Kxn36X3RlVUKEkOMpkDD3kd81JPW4Ger_w", + "alg": "RS256", + "kty": "RSA", + "use": "sig", + "kid": "b2620d5e7f132b52afe8875cdf3776c064249d04" + }, + { + "kty": "RSA", + "use": "sig", + "e": "AQAB", + "n": "jPxgqe78Uy8UI0nrbys8zFQnskdLnvY9DFAKbI9Or7sPc7vhyQ-ynHWXrvrv3J3EVqcqwZSTAjiKbSbIhKRF2iXyIP5jmhS6QTUQb7D8smC89yZi6Ii-AzpH6QKvmhU7yJ1u0odMM1UDUS5bH5aL50HxxqqaQGlZ7PFOT0xrauAFW-3ONVc7_tXGMbfYRzeRrXqaONJ1B9LOconUlsBsL0U1TepINyztbwjM3NBlvEuBX0m4ZbCFznGoWmnix3FuUS4gAybOO3WYr6Zd71cKBFPfdpMMfNjWM2pf1-1O1IF8iArGbvngn8Vk5QGH3MkJDA_JgZOu9pI64LSIEKG02w", + "alg": "RS256", + "kid": "5aaff47c21d06e266cce395b2145c7c6d4730ea5" + } + ] +} \ No newline at end of file