cim/zitadel-oidc
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

use type aliases for oidc.Verifier

Browse source 
this binds the correct contstructor to each verifier usecase.
This commit is contained in:
Tim Möhlmann 2023-03-17 17:30:58 +02:00
parent aad76b0d91
commit 88aab28603
17 changed files with 64 additions and 59 deletions
Download patch file Download diff file Expand all files Collapse all files

8
pkg/client/rp/relying_party.go
View file

@ -63,8 +63,8 @@ type RelyingParty interface {
// be used to start a DeviceAuthorization flow. // be used to start a DeviceAuthorization flow.
GetDeviceAuthorizationEndpoint() string GetDeviceAuthorizationEndpoint() string
// IDTokenVerifier returns the verifier interface used for oidc id_token verification // IDTokenVerifier returns the verifier used for oidc id_token verification
IDTokenVerifier() *oidc.Verifier IDTokenVerifier() *IDTokenVerifier
// ErrorHandler returns the handler used for callback errors // ErrorHandler returns the handler used for callback errors
ErrorHandler() func(http.ResponseWriter, *http.Request, string, string, string) ErrorHandler() func(http.ResponseWriter, *http.Request, string, string, string)
@ -88,7 +88,7 @@ type relyingParty struct {
cookieHandler *httphelper.CookieHandler cookieHandler *httphelper.CookieHandler
errorHandler func(http.ResponseWriter, *http.Request, string, string, string) errorHandler func(http.ResponseWriter, *http.Request, string, string, string)
idTokenVerifier *oidc.Verifier idTokenVerifier *IDTokenVerifier
verifierOpts []VerifierOption verifierOpts []VerifierOption
signer jose.Signer signer jose.Signer
} }
@ -137,7 +137,7 @@ func (rp *relyingParty) GetRevokeEndpoint() string {
return rp.endpoints.RevokeURL return rp.endpoints.RevokeURL
} }
func (rp *relyingParty) IDTokenVerifier() *oidc.Verifier { func (rp *relyingParty) IDTokenVerifier() *IDTokenVerifier {
if rp.idTokenVerifier == nil { if rp.idTokenVerifier == nil {
rp.idTokenVerifier = NewIDTokenVerifier(rp.issuer, rp.oauthConfig.ClientID, NewRemoteKeySet(rp.httpClient, rp.endpoints.JKWsURL), rp.verifierOpts...) rp.idTokenVerifier = NewIDTokenVerifier(rp.issuer, rp.oauthConfig.ClientID, NewRemoteKeySet(rp.httpClient, rp.endpoints.JKWsURL), rp.verifierOpts...)
} }

28
pkg/client/rp/verifier.go
View file

@ -11,7 +11,7 @@ import (
// VerifyTokens implement the Token Response Validation as defined in OIDC specification // VerifyTokens implement the Token Response Validation as defined in OIDC specification
// https://openid.net/specs/openid-connect-core-1_0.html#TokenResponseValidation // https://openid.net/specs/openid-connect-core-1_0.html#TokenResponseValidation
func VerifyTokens[C oidc.IDClaims](ctx context.Context, accessToken, idToken string, v *oidc.Verifier) (claims C, err error) { func VerifyTokens[C oidc.IDClaims](ctx context.Context, accessToken, idToken string, v *IDTokenVerifier) (claims C, err error) {
var nilClaims C var nilClaims C
claims, err = VerifyIDToken[C](ctx, idToken, v) claims, err = VerifyIDToken[C](ctx, idToken, v)
@ -26,7 +26,7 @@ func VerifyTokens[C oidc.IDClaims](ctx context.Context, accessToken, idToken str
// VerifyIDToken validates the id token according to // VerifyIDToken validates the id token according to
// https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation // https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation
func VerifyIDToken[C oidc.Claims](ctx context.Context, token string, v *oidc.Verifier) (claims C, err error) { func VerifyIDToken[C oidc.Claims](ctx context.Context, token string, v *IDTokenVerifier) (claims C, err error) {
var nilClaims C var nilClaims C
decrypted, err := oidc.DecryptToken(token) decrypted, err := oidc.DecryptToken(token)
@ -80,6 +80,8 @@ func VerifyIDToken[C oidc.Claims](ctx context.Context, token string, v *oidc.Ver
return claims, nil return claims, nil
} }
type IDTokenVerifier oidc.Verifier
// VerifyAccessToken validates the access token according to // VerifyAccessToken validates the access token according to
// https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowTokenValidation // https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowTokenValidation
func VerifyAccessToken(accessToken, atHash string, sigAlgorithm jose.SignatureAlgorithm) error { func VerifyAccessToken(accessToken, atHash string, sigAlgorithm jose.SignatureAlgorithm) error {
@ -98,8 +100,8 @@ func VerifyAccessToken(accessToken, atHash string, sigAlgorithm jose.SignatureAl
} }
// NewIDTokenVerifier returns a oidc.Verifier suitable for ID token verification. // NewIDTokenVerifier returns a oidc.Verifier suitable for ID token verification.
func NewIDTokenVerifier(issuer, clientID string, keySet oidc.KeySet, options ...VerifierOption) *oidc.Verifier { func NewIDTokenVerifier(issuer, clientID string, keySet oidc.KeySet, options ...VerifierOption) *IDTokenVerifier {
v := &oidc.Verifier{ v := &IDTokenVerifier{
Issuer: issuer, Issuer: issuer,
ClientID: clientID, ClientID: clientID,
KeySet: keySet, KeySet: keySet,
@ -117,47 +119,47 @@ func NewIDTokenVerifier(issuer, clientID string, keySet oidc.KeySet, options ...
} }
// VerifierOption is the type for providing dynamic options to the IDTokenVerifier // VerifierOption is the type for providing dynamic options to the IDTokenVerifier
type VerifierOption func(*oidc.Verifier) type VerifierOption func(*IDTokenVerifier)
// WithIssuedAtOffset mitigates the risk of iat to be in the future // WithIssuedAtOffset mitigates the risk of iat to be in the future
// because of clock skews with the ability to add an offset to the current time // because of clock skews with the ability to add an offset to the current time
func WithIssuedAtOffset(offset time.Duration) func(*oidc.Verifier) { func WithIssuedAtOffset(offset time.Duration) VerifierOption {
return func(v *oidc.Verifier) { return func(v *IDTokenVerifier) {
v.Offset = offset v.Offset = offset
} }
} }
// WithIssuedAtMaxAge provides the ability to define the maximum duration between iat and now // WithIssuedAtMaxAge provides the ability to define the maximum duration between iat and now
func WithIssuedAtMaxAge(maxAge time.Duration) func(*oidc.Verifier) { func WithIssuedAtMaxAge(maxAge time.Duration) VerifierOption {
return func(v *oidc.Verifier) { return func(v *IDTokenVerifier) {
v.MaxAgeIAT = maxAge v.MaxAgeIAT = maxAge
} }
} }
// WithNonce sets the function to check the nonce // WithNonce sets the function to check the nonce
func WithNonce(nonce func(context.Context) string) VerifierOption { func WithNonce(nonce func(context.Context) string) VerifierOption {
return func(v *oidc.Verifier) { return func(v *IDTokenVerifier) {
v.Nonce = nonce v.Nonce = nonce
} }
} }
// WithACRVerifier sets the verifier for the acr claim // WithACRVerifier sets the verifier for the acr claim
func WithACRVerifier(verifier oidc.ACRVerifier) VerifierOption { func WithACRVerifier(verifier oidc.ACRVerifier) VerifierOption {
return func(v *oidc.Verifier) { return func(v *IDTokenVerifier) {
v.ACR = verifier v.ACR = verifier
} }
} }
// WithAuthTimeMaxAge provides the ability to define the maximum duration between auth_time and now // WithAuthTimeMaxAge provides the ability to define the maximum duration between auth_time and now
func WithAuthTimeMaxAge(maxAge time.Duration) VerifierOption { func WithAuthTimeMaxAge(maxAge time.Duration) VerifierOption {
return func(v *oidc.Verifier) { return func(v *IDTokenVerifier) {
v.MaxAge = maxAge v.MaxAge = maxAge
} }
} }
// WithSupportedSigningAlgorithms overwrites the default RS256 signing algorithm // WithSupportedSigningAlgorithms overwrites the default RS256 signing algorithm
func WithSupportedSigningAlgorithms(algs ...string) VerifierOption { func WithSupportedSigningAlgorithms(algs ...string) VerifierOption {
return func(v *oidc.Verifier) { return func(v *IDTokenVerifier) {
v.SupportedSignAlgs = algs v.SupportedSignAlgs = algs
} }
} }

8
pkg/client/rp/verifier_test.go
View file

@ -13,7 +13,7 @@ import (
) )
func TestVerifyTokens(t *testing.T) { func TestVerifyTokens(t *testing.T) {
verifier := &oidc.Verifier{ verifier := &IDTokenVerifier{
Issuer: tu.ValidIssuer, Issuer: tu.ValidIssuer,
MaxAgeIAT: 2 * time.Minute, MaxAgeIAT: 2 * time.Minute,
Offset: time.Second, Offset: time.Second,
@ -91,7 +91,7 @@ func TestVerifyTokens(t *testing.T) {
} }
func TestVerifyIDToken(t *testing.T) { func TestVerifyIDToken(t *testing.T) {
verifier := &oidc.Verifier{ verifier := &IDTokenVerifier{
Issuer: tu.ValidIssuer, Issuer: tu.ValidIssuer,
MaxAgeIAT: 2 * time.Minute, MaxAgeIAT: 2 * time.Minute,
Offset: time.Second, Offset: time.Second,
@ -300,7 +300,7 @@ func TestNewIDTokenVerifier(t *testing.T) {
tests := []struct { tests := []struct {
name string name string
args args args args
want *oidc.Verifier want *IDTokenVerifier
}{ }{
{ {
name: "nil nonce", // otherwise assert.Equal will fail on the function name: "nil nonce", // otherwise assert.Equal will fail on the function
@ -317,7 +317,7 @@ func TestNewIDTokenVerifier(t *testing.T) {
WithSupportedSigningAlgorithms("ABC", "DEF"), WithSupportedSigningAlgorithms("ABC", "DEF"),
}, },
}, },
want: &oidc.Verifier{ want: &IDTokenVerifier{
Issuer: tu.ValidIssuer, Issuer: tu.ValidIssuer,
Offset: time.Minute, Offset: time.Minute,
MaxAgeIAT: time.Hour, MaxAgeIAT: time.Hour,

8
pkg/op/auth_request.go
View file

@ -38,7 +38,7 @@ type Authorizer interface {
Storage() Storage Storage() Storage
Decoder() httphelper.Decoder Decoder() httphelper.Decoder
Encoder() httphelper.Encoder Encoder() httphelper.Encoder
IDTokenHintVerifier(context.Context) *oidc.Verifier IDTokenHintVerifier(context.Context) *IDTokenHintVerifier
Crypto() Crypto Crypto() Crypto
RequestObjectSupported() bool RequestObjectSupported() bool
} }
@ -47,7 +47,7 @@ type Authorizer interface {
// implementing its own validation mechanism for the auth request // implementing its own validation mechanism for the auth request
type AuthorizeValidator interface { type AuthorizeValidator interface {
Authorizer Authorizer
ValidateAuthRequest(context.Context, *oidc.AuthRequest, Storage, *oidc.Verifier) (string, error) ValidateAuthRequest(context.Context, *oidc.AuthRequest, Storage, *IDTokenHintVerifier) (string, error)
} }
func authorizeHandler(authorizer Authorizer) func(http.ResponseWriter, *http.Request) { func authorizeHandler(authorizer Authorizer) func(http.ResponseWriter, *http.Request) {
@ -204,7 +204,7 @@ func CopyRequestObjectToAuthRequest(authReq *oidc.AuthRequest, requestObject *oi
} }
// ValidateAuthRequest validates the authorize parameters and returns the userID of the id_token_hint if passed // ValidateAuthRequest validates the authorize parameters and returns the userID of the id_token_hint if passed
func ValidateAuthRequest(ctx context.Context, authReq *oidc.AuthRequest, storage Storage, verifier *oidc.Verifier) (sub string, err error) { func ValidateAuthRequest(ctx context.Context, authReq *oidc.AuthRequest, storage Storage, verifier *IDTokenHintVerifier) (sub string, err error) {
authReq.MaxAge, err = ValidateAuthReqPrompt(authReq.Prompt, authReq.MaxAge) authReq.MaxAge, err = ValidateAuthReqPrompt(authReq.Prompt, authReq.MaxAge)
if err != nil { if err != nil {
return "", err return "", err
@ -384,7 +384,7 @@ func ValidateAuthReqResponseType(client Client, responseType oidc.ResponseType)
// ValidateAuthReqIDTokenHint validates the id_token_hint (if passed as parameter in the request) // ValidateAuthReqIDTokenHint validates the id_token_hint (if passed as parameter in the request)
// and returns the `sub` claim // and returns the `sub` claim
func ValidateAuthReqIDTokenHint(ctx context.Context, idTokenHint string, verifier *oidc.Verifier) (string, error) { func ValidateAuthReqIDTokenHint(ctx context.Context, idTokenHint string, verifier *IDTokenHintVerifier) (string, error) {
if idTokenHint == "" { if idTokenHint == "" {
return "", nil return "", nil
} }

2
pkg/op/auth_request_test.go
View file

@ -146,7 +146,7 @@ func TestValidateAuthRequest(t *testing.T) {
type args struct { type args struct {
authRequest *oidc.AuthRequest authRequest *oidc.AuthRequest
storage op.Storage storage op.Storage
verifier *oidc.Verifier verifier *op.IDTokenHintVerifier
} }
tests := []struct { tests := []struct {
name string name string

5
pkg/op/mock/authorizer.mock.go
View file

@ -11,7 +11,6 @@ import (
gomock "github.com/golang/mock/gomock" gomock "github.com/golang/mock/gomock"
http "github.com/zitadel/oidc/v3/pkg/http" http "github.com/zitadel/oidc/v3/pkg/http"
op "github.com/zitadel/oidc/v3/pkg/op" op "github.com/zitadel/oidc/v3/pkg/op"
oidc "github.com/zitadel/oidc/v3/pkg/oidc"
) )
// MockAuthorizer is a mock of Authorizer interface. // MockAuthorizer is a mock of Authorizer interface.
@ -80,10 +79,10 @@ func (mr *MockAuthorizerMockRecorder) Encoder() *gomock.Call {
} }
// IDTokenHintVerifier mocks base method. // IDTokenHintVerifier mocks base method.
func (m *MockAuthorizer) IDTokenHintVerifier(arg0 context.Context) *oidc.Verifier { func (m *MockAuthorizer) IDTokenHintVerifier(arg0 context.Context) *op.IDTokenHintVerifier {
m.ctrl.T.Helper() m.ctrl.T.Helper()
ret := m.ctrl.Call(m, "IDTokenHintVerifier", arg0) ret := m.ctrl.Call(m, "IDTokenHintVerifier", arg0)
ret0, _ := ret[0].(*oidc.Verifier) ret0, _ := ret[0].(*op.IDTokenHintVerifier)
return ret0 return ret0
} }

2
pkg/op/mock/authorizer.mock.impl.go
View file

@ -49,7 +49,7 @@ func ExpectEncoder(a op.Authorizer) {
func ExpectVerifier(a op.Authorizer, t *testing.T) { func ExpectVerifier(a op.Authorizer, t *testing.T) {
mockA := a.(*MockAuthorizer) mockA := a.(*MockAuthorizer)
mockA.EXPECT().IDTokenHintVerifier(gomock.Any()).DoAndReturn( mockA.EXPECT().IDTokenHintVerifier(gomock.Any()).DoAndReturn(
func() *oidc.Verifier { func() *op.IDTokenHintVerifier {
return op.NewIDTokenHintVerifier("", nil) return op.NewIDTokenHintVerifier("", nil)
}) })
} }

8
pkg/op/op.go
View file

@ -73,8 +73,8 @@ type OpenIDProvider interface {
Storage() Storage Storage() Storage
Decoder() httphelper.Decoder Decoder() httphelper.Decoder
Encoder() httphelper.Encoder Encoder() httphelper.Encoder
IDTokenHintVerifier(context.Context) *oidc.Verifier IDTokenHintVerifier(context.Context) *IDTokenHintVerifier
AccessTokenVerifier(context.Context) *oidc.Verifier AccessTokenVerifier(context.Context) *AccessTokenVerifier
Crypto() Crypto Crypto() Crypto
DefaultLogoutRedirectURI() string DefaultLogoutRedirectURI() string
Probes() []ProbesFn Probes() []ProbesFn
@ -342,7 +342,7 @@ func (o *Provider) Encoder() httphelper.Encoder {
return o.encoder return o.encoder
} }
func (o *Provider) IDTokenHintVerifier(ctx context.Context) *oidc.Verifier { func (o *Provider) IDTokenHintVerifier(ctx context.Context) *IDTokenHintVerifier {
return NewIDTokenHintVerifier(IssuerFromContext(ctx), o.openIDKeySet(), o.idTokenHintVerifierOpts...) return NewIDTokenHintVerifier(IssuerFromContext(ctx), o.openIDKeySet(), o.idTokenHintVerifierOpts...)
} }
@ -350,7 +350,7 @@ func (o *Provider) JWTProfileVerifier(ctx context.Context) *JWTProfileVerifier {
return NewJWTProfileVerifier(o.Storage(), IssuerFromContext(ctx), 1*time.Hour, time.Second) return NewJWTProfileVerifier(o.Storage(), IssuerFromContext(ctx), 1*time.Hour, time.Second)
} }
func (o *Provider) AccessTokenVerifier(ctx context.Context) *oidc.Verifier { func (o *Provider) AccessTokenVerifier(ctx context.Context) *AccessTokenVerifier {
return NewAccessTokenVerifier(IssuerFromContext(ctx), o.openIDKeySet(), o.accessTokenVerifierOpts...) return NewAccessTokenVerifier(IssuerFromContext(ctx), o.openIDKeySet(), o.accessTokenVerifierOpts...)
} }

2
pkg/op/session.go
View file

@ -13,7 +13,7 @@ import (
type SessionEnder interface { type SessionEnder interface {
Decoder() httphelper.Decoder Decoder() httphelper.Decoder
Storage() Storage Storage() Storage
IDTokenHintVerifier(context.Context) *oidc.Verifier IDTokenHintVerifier(context.Context) *IDTokenHintVerifier
DefaultLogoutRedirectURI() string DefaultLogoutRedirectURI() string
} }

2
pkg/op/token_intospection.go
View file

@ -13,7 +13,7 @@ type Introspector interface {
Decoder() httphelper.Decoder Decoder() httphelper.Decoder
Crypto() Crypto Crypto() Crypto
Storage() Storage Storage() Storage
AccessTokenVerifier(context.Context) *oidc.Verifier AccessTokenVerifier(context.Context) *AccessTokenVerifier
} }
type IntrospectorJWTProfile interface { type IntrospectorJWTProfile interface {

4
pkg/op/token_request.go
View file

@ -20,8 +20,8 @@ type Exchanger interface {
GrantTypeJWTAuthorizationSupported() bool GrantTypeJWTAuthorizationSupported() bool
GrantTypeClientCredentialsSupported() bool GrantTypeClientCredentialsSupported() bool
GrantTypeDeviceCodeSupported() bool GrantTypeDeviceCodeSupported() bool
AccessTokenVerifier(context.Context) *oidc.Verifier AccessTokenVerifier(context.Context) *AccessTokenVerifier
IDTokenHintVerifier(context.Context) *oidc.Verifier IDTokenHintVerifier(context.Context) *IDTokenHintVerifier
} }
func tokenHandler(exchanger Exchanger) func(w http.ResponseWriter, r *http.Request) { func tokenHandler(exchanger Exchanger) func(w http.ResponseWriter, r *http.Request) {

2
pkg/op/token_revocation.go
View file

@ -15,7 +15,7 @@ type Revoker interface {
Decoder() httphelper.Decoder Decoder() httphelper.Decoder
Crypto() Crypto Crypto() Crypto
Storage() Storage Storage() Storage
AccessTokenVerifier(context.Context) *oidc.Verifier AccessTokenVerifier(context.Context) *AccessTokenVerifier
AuthMethodPrivateKeyJWTSupported() bool AuthMethodPrivateKeyJWTSupported() bool
AuthMethodPostSupported() bool AuthMethodPostSupported() bool
} }

2
pkg/op/userinfo.go
View file

@ -14,7 +14,7 @@ type UserinfoProvider interface {
Decoder() httphelper.Decoder Decoder() httphelper.Decoder
Crypto() Crypto Crypto() Crypto
Storage() Storage Storage() Storage
AccessTokenVerifier(context.Context) *oidc.Verifier AccessTokenVerifier(context.Context) *AccessTokenVerifier
} }
func userinfoHandler(userinfoProvider UserinfoProvider) func(http.ResponseWriter, *http.Request) { func userinfoHandler(userinfoProvider UserinfoProvider) func(http.ResponseWriter, *http.Request) {

14
pkg/op/verifier_access_token.go
View file

@ -6,17 +6,19 @@ import (
"github.com/zitadel/oidc/v3/pkg/oidc" "github.com/zitadel/oidc/v3/pkg/oidc"
) )
type AccessTokenVerifierOpt func(*oidc.Verifier) type AccessTokenVerifier oidc.Verifier
type AccessTokenVerifierOpt func(*AccessTokenVerifier)
func WithSupportedAccessTokenSigningAlgorithms(algs ...string) AccessTokenVerifierOpt { func WithSupportedAccessTokenSigningAlgorithms(algs ...string) AccessTokenVerifierOpt {
return func(verifier *oidc.Verifier) { return func(verifier *AccessTokenVerifier) {
verifier.SupportedSignAlgs = algs verifier.SupportedSignAlgs = algs
} }
} }
// NewAccessTokenVerifier returns a oidc.Verifier suitable for access token verification. // NewAccessTokenVerifier returns a AccessTokenVerifier suitable for access token verification.
func NewAccessTokenVerifier(issuer string, keySet oidc.KeySet, opts ...AccessTokenVerifierOpt) *oidc.Verifier { func NewAccessTokenVerifier(issuer string, keySet oidc.KeySet, opts ...AccessTokenVerifierOpt) *AccessTokenVerifier {
verifier := &oidc.Verifier{ verifier := &AccessTokenVerifier{
Issuer: issuer, Issuer: issuer,
KeySet: keySet, KeySet: keySet,
} }
@ -27,7 +29,7 @@ func NewAccessTokenVerifier(issuer string, keySet oidc.KeySet, opts ...AccessTok
} }
// VerifyAccessToken validates the access token (issuer, signature and expiration). // VerifyAccessToken validates the access token (issuer, signature and expiration).
func VerifyAccessToken[C oidc.Claims](ctx context.Context, token string, v *oidc.Verifier) (claims C, err error) { func VerifyAccessToken[C oidc.Claims](ctx context.Context, token string, v *AccessTokenVerifier) (claims C, err error) {
var nilClaims C var nilClaims C
decrypted, err := oidc.DecryptToken(token) decrypted, err := oidc.DecryptToken(token)

8
pkg/op/verifier_access_token_test.go
View file

@ -20,7 +20,7 @@ func TestNewAccessTokenVerifier(t *testing.T) {
tests := []struct { tests := []struct {
name string name string
args args args args
want *oidc.Verifier want *AccessTokenVerifier
}{ }{
{ {
name: "simple", name: "simple",
@ -28,7 +28,7 @@ func TestNewAccessTokenVerifier(t *testing.T) {
issuer: tu.ValidIssuer, issuer: tu.ValidIssuer,
keySet: tu.KeySet{}, keySet: tu.KeySet{},
}, },
want: &oidc.Verifier{ want: &AccessTokenVerifier{
Issuer: tu.ValidIssuer, Issuer: tu.ValidIssuer,
KeySet: tu.KeySet{}, KeySet: tu.KeySet{},
}, },
@ -42,7 +42,7 @@ func TestNewAccessTokenVerifier(t *testing.T) {
WithSupportedAccessTokenSigningAlgorithms("ABC", "DEF"), WithSupportedAccessTokenSigningAlgorithms("ABC", "DEF"),
}, },
}, },
want: &oidc.Verifier{ want: &AccessTokenVerifier{
Issuer: tu.ValidIssuer, Issuer: tu.ValidIssuer,
KeySet: tu.KeySet{}, KeySet: tu.KeySet{},
SupportedSignAlgs: []string{"ABC", "DEF"}, SupportedSignAlgs: []string{"ABC", "DEF"},
@ -58,7 +58,7 @@ func TestNewAccessTokenVerifier(t *testing.T) {
} }
func TestVerifyAccessToken(t *testing.T) { func TestVerifyAccessToken(t *testing.T) {
verifier := &oidc.Verifier{ verifier := &AccessTokenVerifier{
Issuer: tu.ValidIssuer, Issuer: tu.ValidIssuer,
MaxAgeIAT: 2 * time.Minute, MaxAgeIAT: 2 * time.Minute,
Offset: time.Second, Offset: time.Second,

12
pkg/op/verifier_id_token_hint.go
View file

@ -6,16 +6,18 @@ import (
"github.com/zitadel/oidc/v3/pkg/oidc" "github.com/zitadel/oidc/v3/pkg/oidc"
) )
type IDTokenHintVerifierOpt func(*oidc.Verifier) type IDTokenHintVerifier oidc.Verifier
type IDTokenHintVerifierOpt func(*IDTokenHintVerifier)
func WithSupportedIDTokenHintSigningAlgorithms(algs ...string) IDTokenHintVerifierOpt { func WithSupportedIDTokenHintSigningAlgorithms(algs ...string) IDTokenHintVerifierOpt {
return func(verifier *oidc.Verifier) { return func(verifier *IDTokenHintVerifier) {
verifier.SupportedSignAlgs = algs verifier.SupportedSignAlgs = algs
} }
} }
func NewIDTokenHintVerifier(issuer string, keySet oidc.KeySet, opts ...IDTokenHintVerifierOpt) *oidc.Verifier { func NewIDTokenHintVerifier(issuer string, keySet oidc.KeySet, opts ...IDTokenHintVerifierOpt) *IDTokenHintVerifier {
verifier := &oidc.Verifier{ verifier := &IDTokenHintVerifier{
Issuer: issuer, Issuer: issuer,
KeySet: keySet, KeySet: keySet,
} }
@ -27,7 +29,7 @@ func NewIDTokenHintVerifier(issuer string, keySet oidc.KeySet, opts ...IDTokenHi
// VerifyIDTokenHint validates the id token according to // VerifyIDTokenHint validates the id token according to
// https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation // https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation
func VerifyIDTokenHint[C oidc.Claims](ctx context.Context, token string, v *oidc.Verifier) (claims C, err error) { func VerifyIDTokenHint[C oidc.Claims](ctx context.Context, token string, v *IDTokenHintVerifier) (claims C, err error) {
var nilClaims C var nilClaims C
decrypted, err := oidc.DecryptToken(token) decrypted, err := oidc.DecryptToken(token)

8
pkg/op/verifier_id_token_hint_test.go
View file

@ -20,7 +20,7 @@ func TestNewIDTokenHintVerifier(t *testing.T) {
tests := []struct { tests := []struct {
name string name string
args args args args
want *oidc.Verifier want *IDTokenHintVerifier
}{ }{
{ {
name: "simple", name: "simple",
@ -28,7 +28,7 @@ func TestNewIDTokenHintVerifier(t *testing.T) {
issuer: tu.ValidIssuer, issuer: tu.ValidIssuer,
keySet: tu.KeySet{}, keySet: tu.KeySet{},
}, },
want: &oidc.Verifier{ want: &IDTokenHintVerifier{
Issuer: tu.ValidIssuer, Issuer: tu.ValidIssuer,
KeySet: tu.KeySet{}, KeySet: tu.KeySet{},
}, },
@ -42,7 +42,7 @@ func TestNewIDTokenHintVerifier(t *testing.T) {
WithSupportedIDTokenHintSigningAlgorithms("ABC", "DEF"), WithSupportedIDTokenHintSigningAlgorithms("ABC", "DEF"),
}, },
}, },
want: &oidc.Verifier{ want: &IDTokenHintVerifier{
Issuer: tu.ValidIssuer, Issuer: tu.ValidIssuer,
KeySet: tu.KeySet{}, KeySet: tu.KeySet{},
SupportedSignAlgs: []string{"ABC", "DEF"}, SupportedSignAlgs: []string{"ABC", "DEF"},
@ -58,7 +58,7 @@ func TestNewIDTokenHintVerifier(t *testing.T) {
} }
func TestVerifyIDTokenHint(t *testing.T) { func TestVerifyIDTokenHint(t *testing.T) {
verifier := &oidc.Verifier{ verifier := &IDTokenHintVerifier{
Issuer: tu.ValidIssuer, Issuer: tu.ValidIssuer,
MaxAgeIAT: 2 * time.Minute, MaxAgeIAT: 2 * time.Minute,
Offset: time.Second, Offset: time.Second,