root/golib
1
0
Fork 0
mirror of https://github.com/therootcompany/golib.git synced 2026-03-28 18:15:30 +00:00
Code Issues Projects Releases Wiki Activity

test(jwt): document why arrays are invalid for SpaceDelimited scope

Browse Source 
Scope is a space-delimited string per RFC 6749 §3.3. A token with
"scope":[] indicates an issuer bug ([]string instead of SpaceDelimited
in the claims struct). Adds array cases to the existing invalid test
and explains the expected root cause.
This commit is contained in:
AJ ONeal 2026-03-26 18:21:28 -06:00
parent 95cf5941c4
commit d83751ad50
No known key found for this signature in database
1 changed files with 5 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
auth/jwt/coverage_test.go
View File

@ -220,22 +220,19 @@ func TestCov_SpaceDelimited_UnmarshalJSON(t *testing.T) {
t.Fatalf("expected empty, got %v", s) t.Fatalf("expected empty, got %v", s)
} }
}) })
// Scope must be a space-delimited string per RFC 6749 §3.3, not a number or
// JSON array. If a token arrives with "scope":[] the issuer has a bug (e.g.
// using []string instead of SpaceDelimited in its claims struct).
t.Run("invalid", func(t *testing.T) { t.Run("invalid", func(t *testing.T) {
var s SpaceDelimited var s SpaceDelimited
if err := json.Unmarshal([]byte(`123`), &s); err == nil { if err := json.Unmarshal([]byte(`123`), &s); err == nil {
t.Fatal("expected error") t.Fatal("expected error")
} }
})
// Scope must be a space-delimited string per RFC 6749 §3.3, not a JSON array.
// If a token arrives with "scope":[] it means the issuer has a bug (e.g. using
// []string instead of SpaceDelimited in its claims struct).
t.Run("array_is_invalid", func(t *testing.T) {
var s SpaceDelimited
if err := json.Unmarshal([]byte(`[]`), &s); err == nil { if err := json.Unmarshal([]byte(`[]`), &s); err == nil {
t.Fatal("expected error for array-typed scope; issuer may have a []string bug") t.Fatal("expected error")
} }
if err := json.Unmarshal([]byte(`["openid","profile"]`), &s); err == nil { if err := json.Unmarshal([]byte(`["openid","profile"]`), &s); err == nil {
t.Fatal("expected error for array-typed scope; issuer may have a []string bug") t.Fatal("expected error")
} }
}) })
} }