github.com/clerkinc/clerk-sdk-go@v1.49.1/clerk/tokens_test.go

package clerk

import (
	"crypto"
	"crypto/rand"
	"crypto/rsa"
	"crypto/x509"
	"encoding/json"
	"encoding/pem"
	"net/http"
	"reflect"
	"testing"
	"time"

	"github.com/go-jose/go-jose/v3"
	"github.com/go-jose/go-jose/v3/jwt"
	"github.com/stretchr/testify/assert"
)

var (
	dummyTokenClaims = map[string]interface{}{
		"iss":     "issuer",
		"sub":     "subject",
		"aud":     []string{"clerk"},
		"name":    "name",
		"picture": "picture",
	}

	dummyTokenClaimsExpected = TokenClaims{
		Claims: jwt.Claims{
			Issuer:   "issuer",
			Subject:  "subject",
			Audience: jwt.Audience{"clerk"},
			Expiry:   nil,
			IssuedAt: nil,
		},
		Extra: map[string]interface{}{
			"name":    "name",
			"picture": "picture",
		},
	}

	dummySessionClaims = SessionClaims{
		Claims: jwt.Claims{
			Issuer:   "https://clerk.issuer",
			Subject:  "subject",
			Audience: nil,
			Expiry:   nil,
			IssuedAt: nil,
		},
		SessionID:                     "session_id",
		AuthorizedParty:               "authorized_party",
		ActiveOrganizationID:          "org_id",
		ActiveOrganizationSlug:        "org_slug",
		ActiveOrganizationRole:        "org_role",
		ActiveOrganizationPermissions: []string{"org:billing:manage", "org:report:view"},
	}
)

func TestClient_DecodeToken_EmptyToken(t *testing.T) {
	c, _ := NewClient("token")

	_, err := c.DecodeToken("")
	if err == nil {
		t.Errorf("Expected error to be returned")
	}
}

func TestClient_DecodeToken_Success(t *testing.T) {
	c, _ := NewClient("token")
	token, _ := testGenerateTokenJWT(t, dummyTokenClaims, "kid")

	got, _ := c.DecodeToken(token)

	if !reflect.DeepEqual(got, &dummyTokenClaimsExpected) {
		t.Errorf("Expected %+v, but got %+v", &dummyTokenClaimsExpected, got)
	}
}

func TestClient_VerifyToken_EmptyToken(t *testing.T) {
	c, _ := NewClient("token")

	_, err := c.VerifyToken("")
	if err == nil {
		t.Errorf("Expected error to be returned")
	}
}

func TestClient_VerifyToken_MissingKID(t *testing.T) {
	c, _ := NewClient("token")
	token, _ := testGenerateTokenJWT(t, dummySessionClaims, "")

	_, err := c.VerifyToken(token)
	if err == nil {
		t.Errorf("Expected error to be returned")
	}
}

func TestClient_VerifyToken_MismatchKID(t *testing.T) {
	c, _ := NewClient("token")
	token, pubKey := testGenerateTokenJWT(t, dummySessionClaims, "kid")

	client := c.(*client)
	client.jwksCache.set(testBuildJWKS(t, pubKey, jose.RS256, "invalid-kid"))

	_, err := c.VerifyToken(token)
	if err == nil {
		t.Errorf("Expected error to be returned")
	}
}

func TestClient_VerifyToken_MismatchAlgorithm(t *testing.T) {
	c, _ := NewClient("token")
	token, pubKey := testGenerateTokenJWT(t, dummySessionClaims, "kid")

	client := c.(*client)
	client.jwksCache.set(testBuildJWKS(t, pubKey, jose.RS512, "kid"))

	_, err := c.VerifyToken(token)
	if err == nil {
		t.Errorf("Expected error to be returned")
	}
}

func TestClient_VerifyToken_InvalidKey(t *testing.T) {
	c, _ := NewClient("token")
	token, _ := testGenerateTokenJWT(t, dummySessionClaims, "kid")
	privKey, _ := rsa.GenerateKey(rand.Reader, 2048)

	client := c.(*client)
	client.jwksCache.set(testBuildJWKS(t, privKey.Public(), jose.RS256, "kid"))

	_, err := c.VerifyToken(token)
	if err == nil {
		t.Errorf("Expected error to be returned")
	}
}

func TestClient_VerifyToken_InvalidIssuer(t *testing.T) {
	c, _ := NewClient("token")

	claims := dummySessionClaims
	claims.Issuer = "issuer"

	token, pubKey := testGenerateTokenJWT(t, claims, "kid")

	client := c.(*client)
	client.jwksCache.set(testBuildJWKS(t, pubKey, jose.RS256, "kid"))

	_, err := c.VerifyToken(token)
	if err == nil {
		t.Errorf("Expected error to be returned")
	}
}

func TestClient_VerifyToken_IssuerSatelliteDomain(t *testing.T) {
	c, _ := NewClient("token")

	token, pubKey := testGenerateTokenJWT(t, dummySessionClaims, "kid")

	client := c.(*client)
	client.jwksCache.set(testBuildJWKS(t, pubKey, jose.RS256, "kid"))

	got, _ := c.VerifyToken(token, WithSatelliteDomain(true))
	if !reflect.DeepEqual(got, &dummySessionClaims) {
		t.Errorf("Expected %+v, but got %+v", dummySessionClaims, got)
	}
}

func TestClient_VerifyToken_InvalidIssuerProxyURL(t *testing.T) {
	c, _ := NewClient("token")

	claims := dummySessionClaims
	claims.Issuer = "invalid"

	token, pubKey := testGenerateTokenJWT(t, claims, "kid")

	client := c.(*client)
	client.jwksCache.set(testBuildJWKS(t, pubKey, jose.RS256, "kid"))

	_, err := c.VerifyToken(token, WithProxyURL("issuer"))
	if err == nil {
		t.Errorf("Expected error to be returned")
	}
}

func TestClient_VerifyToken_ValidIssuerProxyURL(t *testing.T) {
	c, _ := NewClient("token")

	claims := dummySessionClaims
	claims.Issuer = "issuer"

	token, pubKey := testGenerateTokenJWT(t, claims, "kid")

	client := c.(*client)
	client.jwksCache.set(testBuildJWKS(t, pubKey, jose.RS256, "kid"))

	got, _ := c.VerifyToken(token, WithProxyURL("issuer"))
	if !reflect.DeepEqual(got, &claims) {
		t.Errorf("Expected %+v, but got %+v", claims, got)
	}
}

func TestClient_VerifyToken_ExpiredToken(t *testing.T) {
	c, _ := NewClient("token")

	expiredClaims := dummySessionClaims
	expiredClaims.Expiry = jwt.NewNumericDate(time.Now().Add(time.Second * -1))
	token, pubKey := testGenerateTokenJWT(t, expiredClaims, "kid")

	client := c.(*client)
	client.jwksCache.set(testBuildJWKS(t, pubKey, jose.RS256, "kid"))

	_, err := c.VerifyToken(token)
	if err == nil {
		t.Errorf("Expected error to be returned")
	}
}

func TestClient_VerifyToken_InvalidAuthorizedParty(t *testing.T) {
	c, _ := NewClient("token")

	claims := dummySessionClaims
	claims.AuthorizedParty = "fake-party"

	token, pubKey := testGenerateTokenJWT(t, claims, "kid")

	client := c.(*client)
	client.jwksCache.set(testBuildJWKS(t, pubKey, jose.RS256, "kid"))

	_, err := c.VerifyToken(token, WithAuthorizedParty("authorized_party"))
	if err == nil {
		t.Errorf("Expected error to be returned")
	}
}

func TestClient_VerifyToken_Success(t *testing.T) {
	c, _ := NewClient("token")
	token, pubKey := testGenerateTokenJWT(t, dummySessionClaims, "kid")

	client := c.(*client)
	client.jwksCache.set(testBuildJWKS(t, pubKey, jose.RS256, "kid"))

	got, _ := c.VerifyToken(token)
	if !reflect.DeepEqual(got, &dummySessionClaims) {
		t.Errorf("Expected %+v, but got %+v", dummySessionClaims, got)
	}
}

func TestClient_VerifyToken_Success_NewIssuerFormat(t *testing.T) {
	c, _ := NewClient("token")

	claims := dummySessionClaims
	claims.Issuer = "https://foo-bar-13.clerk.accounts.dev"

	token, pubKey := testGenerateTokenJWT(t, claims, "kid")

	client := c.(*client)
	client.jwksCache.set(testBuildJWKS(t, pubKey, jose.RS256, "kid"))

	got, err := c.VerifyToken(token)
	if err != nil {
		t.Fatalf("Expected no error but got %v", err)
	}

	if !reflect.DeepEqual(got, &claims) {
		t.Errorf("Expected %+v, but got %+v", claims, got)
	}
}

func TestClient_VerifyToken_Success_ExpiredCache(t *testing.T) {
	c, mux, _, teardown := setup("token")
	defer teardown()

	token, pubKey := testGenerateTokenJWT(t, dummySessionClaims, "kid")

	mux.HandleFunc("/jwks", func(w http.ResponseWriter, req *http.Request) {
		testHttpMethod(t, req, "GET")
		testHeader(t, req, "Authorization", "Bearer token")
		_ = json.NewEncoder(w).Encode(testBuildJWKS(t, pubKey, jose.RS256, "kid"))
	})

	client := c.(*client)
	client.jwksCache.expiresAt = time.Now().Add(time.Second * -5)

	got, _ := c.VerifyToken(token)
	if !reflect.DeepEqual(got, &dummySessionClaims) {
		t.Errorf("Expected %+v, but got %+v", dummySessionClaims, got)
	}
}

func TestClient_VerifyToken_Success_AuthorizedParty(t *testing.T) {
	c, mux, _, teardown := setup("token")
	defer teardown()

	token, pubKey := testGenerateTokenJWT(t, dummySessionClaims, "kid")

	mux.HandleFunc("/jwks", func(w http.ResponseWriter, req *http.Request) {
		testHttpMethod(t, req, "GET")
		testHeader(t, req, "Authorization", "Bearer token")
		_ = json.NewEncoder(w).Encode(testBuildJWKS(t, pubKey, jose.RS256, "kid"))
	})

	client := c.(*client)
	client.jwksCache.expiresAt = time.Now().Add(time.Second * -5)

	got, _ := c.VerifyToken(token, WithAuthorizedParty("authorized_party"))
	if !reflect.DeepEqual(got, &dummySessionClaims) {
		t.Errorf("Expected %+v, but got %+v", dummySessionClaims, got)
	}
}

func TestClient_VerifyToken_Success_WithLeeway(t *testing.T) {
	c, _ := NewClient("token")

	expiredClaims := dummySessionClaims
	expiredClaims.Expiry = jwt.NewNumericDate(time.Now().Add(time.Second * -1))
	token, pubKey := testGenerateTokenJWT(t, expiredClaims, "kid")

	client := c.(*client)
	client.jwksCache.set(testBuildJWKS(t, pubKey, jose.RS256, "kid"))

	_, err := c.VerifyToken(token, WithLeeway(3*time.Second))
	if err != nil {
		t.Errorf("Expected no error to be returned, but got: %+v", err)
	}
}

func TestClient_VerifyToken_Success_WithJWTVerificationKey(t *testing.T) {
	c, _ := NewClient("token")
	token, pubKey := testGenerateTokenJWT(t, dummySessionClaims, "kid")
	verificationKey := testRSAPublicKeyToPEM(t, pubKey)

	_, err := c.VerifyToken(token, WithJWTVerificationKey(verificationKey))
	if err != nil {
		t.Errorf("Expected no error, but got: %+v", err)
	}
}

func TestClient_VerifyToken_Success_WithCustomClaims(t *testing.T) {
	c, _ := NewClient("token")

	expectedClaims := map[string]interface{}{
		"iss":       "https://clerk.issuer",
		"sub":       "subject",
		"sid":       "session_id",
		"azp":       "authorized_party",
		"role":      "tester",
		"interests": []string{"tennis", "football"},
	}

	token, pubKey := testGenerateTokenJWT(t, expectedClaims, "kid")

	client := c.(*client)
	client.jwksCache.set(testBuildJWKS(t, pubKey, jose.RS256, "kid"))

	customClaims := struct {
		Issuer    string   `json:"iss"`
		UserID    string   `json:"sub"`
		Role      string   `json:"role"`
		Interests []string `json:"interests"`
	}{}

	_, _ = c.VerifyToken(token, WithCustomClaims(&customClaims))
	assert.Equal(t, expectedClaims["iss"], customClaims.Issuer)
	assert.Equal(t, expectedClaims["sub"], customClaims.UserID)
	assert.Equal(t, expectedClaims["role"], customClaims.Role)
	assert.Equal(t, expectedClaims["interests"], customClaims.Interests)
}

func TestClient_VerifyToken_Error_WithJWTVerificationKey(t *testing.T) {
	c, _ := NewClient("token")
	token, _ := testGenerateTokenJWT(t, dummySessionClaims, "kid")

	// Generate new public key not matching the one from the token
	_, pubKey := testGenerateTokenJWT(t, dummySessionClaims, "kid")
	verificationKey := testRSAPublicKeyToPEM(t, pubKey)

	_, err := c.VerifyToken(token, WithJWTVerificationKey(verificationKey))
	if err == nil {
		t.Errorf("Expected error to be returned")
	}
}

func testGenerateTokenJWT(t *testing.T, claims interface{}, kid string) (string, crypto.PublicKey) {
	t.Helper()

	privKey, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		t.Error(err)
	}

	signerOpts := &jose.SignerOptions{}
	signerOpts.WithType("JWT")
	if kid != "" {
		signerOpts.WithHeader("kid", kid)
	}

	signer, err := jose.NewSigner(jose.SigningKey{Algorithm: jose.RS256, Key: privKey}, signerOpts)
	if err != nil {
		t.Error(err)
	}

	builder := jwt.Signed(signer)
	builder = builder.Claims(claims)

	token, err := builder.CompactSerialize()
	if err != nil {
		t.Error(err)
	}

	return token, privKey.Public()
}

func testBuildJWKS(t *testing.T, pubKey crypto.PublicKey, alg jose.SignatureAlgorithm, kid string) *JWKS {
	t.Helper()

	return &JWKS{Keys: []jose.JSONWebKey{
		{
			Key:       pubKey,
			KeyID:     kid,
			Algorithm: string(alg),
			Use:       "sig",
		},
	}}
}

func testRSAPublicKeyToPEM(t *testing.T, input interface{}) string {
	t.Helper()

	rsaPubKey, ok := input.(*rsa.PublicKey)
	if !ok {
		t.Error("provided input is not an RSA public key")
	}

	pubKeyBytes, err := x509.MarshalPKIXPublicKey(rsaPubKey)
	if err != nil {
		t.Error("failed to marshal public key")
	}

	pemBytes := pem.EncodeToMemory(&pem.Block{
		Type:  "PUBLIC KEY",
		Bytes: pubKeyBytes,
	})

	return string(pemBytes)
}