feat(deps): update go-jose to v4 (#588)

This change updates to go-jose v4, which was a new major release.

jose.ParseSigned now expects the supported signing algorithms to be passed, on which we previously did our own check. As they use a dedicated type for this, the slice of string needs to be converted. The returned error also need to be handled in a non-standard way in order to stay compatible.

For OIDC v4 we should use the jose.SignatureAlgorithm  type directly and wrap errors, instead of returned static defined errors.

Closes #583

pkg/op/discovery.go

@@ -4,7 +4,7 @@ import (
 	"context"
 	"net/http"
 
-	jose "github.com/go-jose/go-jose/v3"
+	jose "github.com/go-jose/go-jose/v4"
 
 	httphelper "github.com/zitadel/oidc/v3/pkg/http"
 	"github.com/zitadel/oidc/v3/pkg/oidc"

pkg/op/discovery_test.go

@@ -6,7 +6,7 @@ import (
 	"net/http/httptest"
 	"testing"
 
-	jose "github.com/go-jose/go-jose/v3"
+	jose "github.com/go-jose/go-jose/v4"
 	"github.com/golang/mock/gomock"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"

pkg/op/keys.go

@@ -4,7 +4,7 @@ import (
 	"context"
 	"net/http"
 
-	jose "github.com/go-jose/go-jose/v3"
+	jose "github.com/go-jose/go-jose/v4"
 
 	httphelper "github.com/zitadel/oidc/v3/pkg/http"
 )

pkg/op/keys_test.go

@@ -7,7 +7,7 @@ import (
 	"net/http/httptest"
 	"testing"
 
-	jose "github.com/go-jose/go-jose/v3"
+	jose "github.com/go-jose/go-jose/v4"
 	"github.com/golang/mock/gomock"
 	"github.com/stretchr/testify/assert"
 

pkg/op/mock/authorizer.mock.impl.go

@@ -4,7 +4,7 @@ import (
 	"context"
 	"testing"
 
-	jose "github.com/go-jose/go-jose/v3"
+	jose "github.com/go-jose/go-jose/v4"
 	"github.com/golang/mock/gomock"
 	"github.com/zitadel/schema"
 

pkg/op/mock/discovery.mock.go

@@ -8,7 +8,7 @@ import (
 	context "context"
 	reflect "reflect"
 
-	jose "github.com/go-jose/go-jose/v3"
+	jose "github.com/go-jose/go-jose/v4"
 	gomock "github.com/golang/mock/gomock"
 )
 

pkg/op/mock/signer.mock.go

@@ -7,7 +7,7 @@ package mock
 import (
 	reflect "reflect"
 
-	jose "github.com/go-jose/go-jose/v3"
+	jose "github.com/go-jose/go-jose/v4"
 	gomock "github.com/golang/mock/gomock"
 )
 

pkg/op/mock/storage.mock.go

@@ -9,7 +9,7 @@ import (
 	reflect "reflect"
 	time "time"
 
-	jose "github.com/go-jose/go-jose/v3"
+	jose "github.com/go-jose/go-jose/v4"
 	gomock "github.com/golang/mock/gomock"
 	oidc "github.com/zitadel/oidc/v3/pkg/oidc"
 	op "github.com/zitadel/oidc/v3/pkg/op"

pkg/op/op.go

@@ -8,7 +8,7 @@ import (
 	"time"
 
 	"github.com/go-chi/chi/v5"
-	jose "github.com/go-jose/go-jose/v3"
+	jose "github.com/go-jose/go-jose/v4"
 	"github.com/rs/cors"
 	"github.com/zitadel/schema"
 	"go.opentelemetry.io/otel"

pkg/op/signer.go

@@ -3,7 +3,7 @@ package op
 import (
 	"errors"
 
-	jose "github.com/go-jose/go-jose/v3"
+	jose "github.com/go-jose/go-jose/v4"
 )
 
 var ErrSignerCreationFailed = errors.New("signer creation failed")

pkg/op/storage.go

@@ -5,7 +5,7 @@ import (
 	"errors"
 	"time"
 
-	jose "github.com/go-jose/go-jose/v3"
+	jose "github.com/go-jose/go-jose/v4"
 
 	"github.com/zitadel/oidc/v3/pkg/oidc"
 )

pkg/op/verifier_jwt_profile.go

@@ -6,7 +6,7 @@ import (
 	"fmt"
 	"time"
 
-	jose "github.com/go-jose/go-jose/v3"
+	jose "github.com/go-jose/go-jose/v4"
 
 	"github.com/zitadel/oidc/v3/pkg/oidc"
 )