root/golib
1
0
Fork 0
mirror of https://github.com/therootcompany/golib.git synced 2026-11-04 06:55:00 +00:00
Code Issues Projects Releases Wiki Activity

ref!(auth/jwt): rename PublicKey.Pub and PrivateKey.Priv

Browse Source
This commit is contained in:
AJ ONeal 2026-08-18 01:17:24 -06:00
parent 1d16cabf87
commit 82ac1e4721
No known key found for this signature in database
5 changed files with 51 additions and 51 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
auth/jwt/coverage_test.go
View File

@ -808,7 +808,7 @@ func TestCov_KeyType(t *testing.T) {
{fakeKey{}, ""},
}
for _, tt := range tests {
pk := PublicKey{Key: tt.key}
pk := PublicKey{Pub: tt.key}
if got := pk.KeyType(); got != tt.expect {
t.Errorf("KeyType(%T)=%q want %q", tt.key, got, tt.expect)
}
@ -934,7 +934,7 @@ func TestCov_Thumbprint(t *testing.T) {
})
}
t.Run("unsupported", func(t *testing.T) {
pk := PublicKey{Key: fakeKey{}}
pk := PublicKey{Pub: fakeKey{}}
_, err := pk.Thumbprint()
if !errors.Is(err, ErrUnsupportedKeyType) {
t.Fatalf("expected ErrUnsupportedKeyType, got %v", err)
@ -963,7 +963,7 @@ func TestCov_PrivateKey_PublicKey(t *testing.T) {
})
t.Run("bad_signer", func(t *testing.T) {
// signer whose Public() returns a non-CryptoPublicKey
pk := &PrivateKey{privKey: fakeSigner{pub: "not a key"}}
pk := &PrivateKey{Priv: fakeSigner{pub: "not a key"}}
_, err := pk.PublicKey()
if !errors.Is(err, ErrSanityFail) {
t.Fatalf("expected ErrSanityFail, got %v", err)
@ -980,8 +980,8 @@ func TestCov_NewPrivateKey(t *testing.T) {
t.Fatal("expected auto KID")
}
// Should be Ed25519
if _, ok := pk.privKey.(ed25519.PrivateKey); !ok {
t.Fatalf("expected Ed25519, got %T", pk.privKey)
if _, ok := pk.Priv.(ed25519.PrivateKey); !ok {
t.Fatalf("expected Ed25519, got %T", pk.Priv)
}
}
@ -1294,7 +1294,7 @@ func TestCov_toPublicKeyOps(t *testing.T) {
}
func TestCov_encode_Unsupported(t *testing.T) {
_, err := encode(PublicKey{Key: fakeKey{}})
_, err := encode(PublicKey{Pub: fakeKey{}})
if !errors.Is(err, ErrUnsupportedKeyType) {
t.Fatalf("expected ErrUnsupportedKeyType, got %v", err)
}
@ -1304,8 +1304,8 @@ func TestCov_encodePrivate_Unsupported(t *testing.T) {
// Signer whose Public() returns a real ed25519 key but signer type is custom
edKey := mustEdKey(t)
pk := PrivateKey{
privKey: fakeSigner{pub: edKey.Public()},
KID: "test",
Priv: fakeSigner{pub: edKey.Public()},
KID: "test",
}
_, err := encodePrivate(pk)
if !errors.Is(err, ErrUnsupportedKeyType) {
@ -1316,7 +1316,7 @@ func TestCov_encodePrivate_Unsupported(t *testing.T) {
func TestCov_encodePrivate_RSA_NoPrimes(t *testing.T) {
rsaKey := mustRSAKey(t)
rsaKey.Primes = nil // remove primes
pk := PrivateKey{privKey: rsaKey, KID: "test"}
pk := PrivateKey{Priv: rsaKey, KID: "test"}
rk, err := encodePrivate(pk)
if err != nil {
t.Fatal(err)
@ -2690,7 +2690,7 @@ func TestCov_PublicKey_MarshalJSON(t *testing.T) {
}
// Error path: unsupported key
bad := PublicKey{Key: fakeKey{}}
bad := PublicKey{Pub: fakeKey{}}
_, err = json.Marshal(bad)
if err == nil {
t.Fatal("expected error for unsupported key")
@ -2847,7 +2847,7 @@ func TestCov_decodeOne_RSA(t *testing.T) {
if err != nil {
t.Fatal(err)
}
if pk.Key == nil {
if pk.Pub == nil {
t.Fatal("expected key")
}
}
@ -2869,7 +2869,7 @@ func TestCov_decodePrivate_RSA(t *testing.T) {
if err != nil {
t.Fatal(err)
}
if priv.privKey == nil {
if priv.Priv == nil {
t.Fatal("expected private key")
}
}
@ -2884,7 +2884,7 @@ func TestCov_decodePrivate_EC(t *testing.T) {
if err != nil {
t.Fatal(err)
}
if priv.privKey == nil {
if priv.Priv == nil {
t.Fatal("expected private key")
}
}

46
auth/jwt/jwk.go
View File

@ -33,9 +33,9 @@ type CryptoPublicKey interface {
//
// PublicKey is the in-memory representation of a JWK.
// [PublicKey.KeyType] returns the JWK kty string ("EC", "RSA", or "OKP").
// To access the raw Go key, type-switch on Key:
// To access the raw Go key, type-switch on Pub:
//
// switch key := pk.Key.(type) {
// switch key := pk.Pub.(type) {
// case *ecdsa.PublicKey: // ...
// case *rsa.PublicKey: // ...
// case ed25519.PublicKey: // ...
@ -44,7 +44,7 @@ type CryptoPublicKey interface {
// For signing keys, use [PrivateKey] instead - it holds the [crypto.Signer]
// and derives a PublicKey on demand.
type PublicKey struct {
Key CryptoPublicKey
Pub CryptoPublicKey
KID string
Use string
Alg string
@ -54,9 +54,9 @@ type PublicKey struct {
// KeyType returns the JWK "kty" string for the key: "EC", "RSA", or "OKP".
// Returns "" if the key type is unrecognized.
//
// To access the underlying Go key, use a type switch on Key:
// To access the underlying Go key, use a type switch on Pub:
//
// switch key := k.Key.(type) {
// switch key := k.Pub.(type) {
// case *ecdsa.PublicKey: // kty "EC"
// // key is *ecdsa.PublicKey
// case *rsa.PublicKey: // kty "RSA"
@ -67,7 +67,7 @@ type PublicKey struct {
// // unrecognized key type
// }
func (k PublicKey) KeyType() string {
switch k.Key.(type) {
switch k.Pub.(type) {
case *ecdsa.PublicKey:
return "EC"
case *rsa.PublicKey:
@ -163,11 +163,11 @@ func (k PublicKey) Thumbprint() (string, error) {
//
// Use [FromPrivateKey] to construct.
type PrivateKey struct {
privKey crypto.Signer
KID string
Use string
Alg string
KeyOps []string
Priv crypto.Signer
KID string
Use string
Alg string
KeyOps []string
}
// PublicKey derives the [PublicKey] for this signing key.
@ -179,12 +179,12 @@ type PrivateKey struct {
// known CryptoPublicKey type - this should never happen for keys created
// through this library.
func (k *PrivateKey) PublicKey() (*PublicKey, error) {
pub, ok := k.privKey.Public().(CryptoPublicKey)
pub, ok := k.Priv.Public().(CryptoPublicKey)
if !ok {
return nil, fmt.Errorf("%w: private key type %T did not produce a known public key type", ErrSanityFail, k.privKey)
return nil, fmt.Errorf("%w: private key type %T did not produce a known public key type", ErrSanityFail, k.Priv)
}
return &PublicKey{
Key: pub,
Pub: pub,
KID: k.KID,
Use: k.Use,
Alg: k.Alg,
@ -242,7 +242,7 @@ func NewPrivateKey() (*PrivateKey, error) {
if err != nil {
return nil, fmt.Errorf("NewPrivateKey: generate Ed25519 key: %w", err)
}
pk := &PrivateKey{privKey: priv}
pk := &PrivateKey{Priv: priv}
kid, err := pk.Thumbprint()
if err != nil {
return nil, fmt.Errorf("NewPrivateKey: compute thumbprint: %w", err)
@ -313,7 +313,7 @@ type WellKnownJWKs struct {
func encode(k PublicKey) (rawKey, error) {
rk := rawKey{KID: k.KID, Use: k.Use, Alg: k.Alg, KeyOps: k.KeyOps}
switch key := k.Key.(type) {
switch key := k.Pub.(type) {
case *ecdsa.PublicKey:
ci, err := ecInfo(key.Curve)
if err != nil {
@ -343,7 +343,7 @@ func encode(k PublicKey) (rawKey, error) {
return rk, nil
default:
return rawKey{}, fmt.Errorf("%T: %w", k.Key, ErrUnsupportedKeyType)
return rawKey{}, fmt.Errorf("%T: %w", k.Pub, ErrUnsupportedKeyType)
}
}
@ -360,7 +360,7 @@ func encodePrivate(k PrivateKey) (rawKey, error) {
return rawKey{}, err
}
switch priv := k.privKey.(type) {
switch priv := k.Priv.(type) {
case *ecdsa.PrivateKey:
dBytes, err := priv.Bytes()
if err != nil {
@ -385,7 +385,7 @@ func encodePrivate(k PrivateKey) (rawKey, error) {
rk.D = base64.RawURLEncoding.EncodeToString(priv.Seed())
default:
return rawKey{}, fmt.Errorf("%T: %w", k.privKey, ErrUnsupportedKeyType)
return rawKey{}, fmt.Errorf("%T: %w", k.Priv, ErrUnsupportedKeyType)
}
return rk, nil
@ -402,7 +402,7 @@ func FromPublicKey(pub crypto.PublicKey) (*PublicKey, error) {
return nil, fmt.Errorf("%T: %w", pub, ErrUnsupportedKeyType)
}
pk := &PublicKey{Key: cpk}
pk := &PublicKey{Pub: cpk}
// Derive Alg from key type.
switch key := pub.(type) {
@ -441,7 +441,7 @@ func FromPrivateKey(signer crypto.Signer, kid string) (*PrivateKey, error) {
if err != nil {
return nil, err
}
return &PrivateKey{privKey: signer, KID: kid, Alg: alg}, nil
return &PrivateKey{Priv: signer, KID: kid, Alg: alg}, nil
}
// decodeOne parses a single rawKey wire struct into a [PublicKey].
@ -579,13 +579,13 @@ func decodePrivate(kj rawKey) (*PrivateKey, error) {
// newPublicKey creates a [PublicKey] from a crypto key, copying metadata
// (KID, Use, Alg, KeyOps) from the rawKey.
func (kj rawKey) newPublicKey(key CryptoPublicKey) *PublicKey {
return &PublicKey{Key: key, KID: kj.KID, Use: kj.Use, Alg: kj.Alg, KeyOps: kj.KeyOps}
return &PublicKey{Pub: key, KID: kj.KID, Use: kj.Use, Alg: kj.Alg, KeyOps: kj.KeyOps}
}
// newPrivateKey creates a [PrivateKey] from a crypto.Signer, copying metadata
// (KID, Use, Alg, KeyOps) from the rawKey.
func (kj rawKey) newPrivateKey(signer crypto.Signer) *PrivateKey {
return &PrivateKey{privKey: signer, KID: kj.KID, Use: kj.Use, Alg: kj.Alg, KeyOps: kj.KeyOps}
return &PrivateKey{Priv: signer, KID: kj.KID, Use: kj.Use, Alg: kj.Alg, KeyOps: kj.KeyOps}
}
// decodeB64Field decodes a base64url-encoded JWK field value, returning a

2
auth/jwt/keyfile/keyfile_test.go
View File

@ -228,7 +228,7 @@ func TestParsePublicJWK(t *testing.T) {
if pk.KID == "" {
t.Error("KID should be set")
}
if pk.Key == nil {
if pk.Pub == nil {
t.Error("Key should be set")
}
}

22
auth/jwt/sign.go
View File

@ -65,13 +65,13 @@ func NewSigner(keys []*PrivateKey, retiredKeys ...PublicKey) (*Signer, error) {
// Copy so the caller can't mutate after construction.
ss := make([]PrivateKey, len(keys))
for i, k := range keys {
if k == nil || k.privKey == nil {
if k == nil || k.Priv == nil {
return nil, fmt.Errorf("NewSigner: key[%d]: %w", i, ErrNoSigningKey)
}
ss[i] = *k
// Derive algorithm from key type; validate caller's Alg if already set.
alg, _, _, err := signingParams(ss[i].privKey)
alg, _, _, err := signingParams(ss[i].Priv)
if err != nil {
return nil, fmt.Errorf("NewSigner: key[%d]: %w", i, err)
}
@ -168,11 +168,11 @@ func (s *Signer) SignJWT(jws SignableJWT) error {
pk = s.nextKey()
hdr.KID = pk.KID
}
if pk.privKey == nil {
if pk.Priv == nil {
return fmt.Errorf("kid %q: %w", pk.KID, ErrNoSigningKey)
}
alg, hash, ecKeySize, err := signingParams(pk.privKey)
alg, hash, ecKeySize, err := signingParams(pk.Priv)
if err != nil {
return err
}
@ -189,7 +189,7 @@ func (s *Signer) SignJWT(jws SignableJWT) error {
input := signingInputBytes(jws.GetProtected(), jws.GetPayload())
sig, err := signBytes(pk.privKey, alg, hash, ecKeySize, input)
sig, err := signBytes(pk.Priv, alg, hash, ecKeySize, input)
if err != nil {
return err
}
@ -214,13 +214,13 @@ func (s *Signer) SignJWT(jws SignableJWT) error {
// produces an empty payload segment (used by ACME POST-as-GET).
func (s *Signer) SignRaw(hdr Header, payload []byte) (*RawJWT, error) {
pk := s.nextKey()
if pk.privKey == nil {
if pk.Priv == nil {
return nil, fmt.Errorf("kid %q: %w", pk.KID, ErrNoSigningKey)
}
rfc := hdr.GetRFCHeader()
alg, hash, ecKeySize, err := signingParams(pk.privKey)
alg, hash, ecKeySize, err := signingParams(pk.Priv)
if err != nil {
return nil, err
}
@ -239,7 +239,7 @@ func (s *Signer) SignRaw(hdr Header, payload []byte) (*RawJWT, error) {
input := signingInputBytes([]byte(protectedB64), []byte(payloadB64))
sig, err := signBytes(pk.privKey, alg, hash, ecKeySize, input)
sig, err := signBytes(pk.Priv, alg, hash, ecKeySize, input)
if err != nil {
return nil, err
}
@ -328,21 +328,21 @@ func signBytes(signer crypto.Signer, alg string, hash crypto.Hash, ecKeySize int
// validateSigningKey performs a test sign+verify round-trip to catch bad
// keys at construction time rather than on first use.
func validateSigningKey(pk *PrivateKey, pub *PublicKey) error {
alg, hash, ecKeySize, err := signingParams(pk.privKey)
alg, hash, ecKeySize, err := signingParams(pk.Priv)
if err != nil {
return err
}
testInput := []byte("jwt-key-validation")
sig, err := signBytes(pk.privKey, alg, hash, ecKeySize, testInput)
sig, err := signBytes(pk.Priv, alg, hash, ecKeySize, testInput)
if err != nil {
return fmt.Errorf("test sign: %w", err)
}
// Verify against the public key.
h := RFCHeader{Alg: alg, KID: pk.KID}
if err := verifyOneKey(h, pub.Key, testInput, sig); err != nil {
if err := verifyOneKey(h, pub.Pub, testInput, sig); err != nil {
return fmt.Errorf("test verify: %w", err)
}
return nil

6
auth/jwt/verify.go
View File

@ -60,7 +60,7 @@ func NewVerifier(keys []PublicKey) (*Verifier, error) {
entries := seen[k.KID]
dup := false
for _, e := range entries {
if e.key.Equal(k.Key) {
if e.key.Equal(k.Pub) {
dup = true
break
}
@ -68,7 +68,7 @@ func NewVerifier(keys []PublicKey) (*Verifier, error) {
if dup {
continue // identical key material, skip
}
seen[k.KID] = append(entries, seenEntry{key: k.Key, index: len(deduped)})
seen[k.KID] = append(entries, seenEntry{key: k.Pub, index: len(deduped)})
deduped = append(deduped, k)
}
return &Verifier{
@ -136,7 +136,7 @@ func (v *Verifier) Verify(jws VerifiableJWT) error {
// for the token's algorithm) since it's more informative.
var bestErr error
for _, pk := range candidates {
err := verifyOneKey(h, pk.Key, signingInput, sig)
err := verifyOneKey(h, pk.Pub, signingInput, sig)
if err == nil {
return nil
}