Add generic JWK/JWKS-from-JSON importer - #1
Merged
Merged
Conversation
Add ParseJWK and ParseJWKS: read a single JWK or a JWKS ({"keys":[...]})
from JSON and materialise each RSA (n/e) or EC (crv/x/y) entry into a
usable crypto public key, keyed by the provider-assigned "kid" and
selectable by kid/alg/kty/use. This is the import half of the gem's
JWT::JWK, complementing the existing NewJWK/Export path.
The importer is transport- and protocol-agnostic (no issuer/audience/
nonce logic), so any JWS consumer can turn a provider's key set into
verification keys. JWKS.Select resolves a key by kid, falling back for a
kid-less token to the sole signing-capable key whose type serves the
header alg; the Decode kid-resolution path now routes through it so a
kid-less single-key set also verifies.
Import is endian-safe: fields are base64url text decoded byte-wise and
read big-endian by math/big.Int.SetBytes, both byte-order independent
(verified by the s390x qemu CI lane).
Add ErrJWK (the gem's JWT::JWKError, a DecodeError) for malformed JWK,
bad key material, and unsupported key type/curve.
100% coverage retained; -race clean; builds on all six 64-bit arches.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a generic, protocol-agnostic JWK/JWKS-from-JSON importer to the library — the import counterpart of the existing
NewJWK/Exportpath. Any JWS consumer (not just OIDC) can now turn a provider's key set into verification keys.The logic is upstreamed from
go-ruby-oidc/oidc, which carried an OIDC-specificKeySet/ParseJWKSthat is really generic JWT infrastructure. Only the reusable core moves here; issuer/audience/nonce/HTTP-cache logic stays in oidc.API added
ParseJWK(data []byte) (*JWK, error)— parse a single JWK, materialising its RSA (n/e) or EC (crv/x/y) public key. An unsupported key type is an error.ParseJWKS(data []byte) (*JWKS, error)— parse a{"keys":[...]}set; RSA/EC keys are materialised and keyed by the providerkid, a key type the library cannot use for JWS (e.g.oct) is skipped.(*JWKS) Select(kid, alg string) (*JWK, error)— resolve a key bykid; for a kid-less token fall back to the sole signing-capable key whose type servesalg(rejecting an ambiguous/empty set).JWK.Alg/JWK.Usefields (populated by the importers) and theErrJWKsentinel (the gem'sJWT::JWKError, aDecodeError).Decode's kid-resolution now routes throughSelect, so a kid-less single-key JWKS also verifies.Endianness
Import is endian-safe: every field is base64url text decoded byte-wise and read big-endian by
math/big.Int.SetBytes, both byte-order independent. Exercised by the existing s390x (big-endian) qemu CI lane.Tests
kid; wrong-kid cross-verification fails.ErrJWK.Selectkid hit/miss, kid-less sole/ambiguous/no-candidate/enc-use arms.-raceclean, builds on all six 64-bit arches + darwin/windows.🤖 Generated with Claude Code