coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Move the caller verifier onto internal/jose
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 33s
Details

Browse source 
Completes KEY-WP-0019. Client.Verify now delegates JWK-set parsing and RS256
signature checking to internal/jose, so the caller path and upstream provider
verification share one implementation rather than two copies that drift. Its
claim policy stays put: audience and nonce bindings belong to the caller.

The existing authclient tests pass unchanged, which is the evidence the
migration preserved behaviour. One deliberate strictness increase: a key set
containing any malformed RSA signing key is refused outright rather than used
alongside a good key. KeyCape's /jwks publishes a single key, so no current
deployment is affected.

Adds direct tests for internal/jose. It is now the single verifier behind both
paths, and testing it only through its callers would leave duplicate key ids,
crit headers, even exponents and undersized moduli covered by accident.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NV9oijZukGyGbRQGGKnK4P

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 713576@bnt-lap001
Assistant-Session: 384c511d-9bce-4cb8-a676-2aef6c0c8df6
This commit is contained in:
tegwick 2026-09-07 09:01:16 +02:00
parent 8c1a3e052c
commit 3ec8404c87
4 changed files with 197 additions and 59 deletions
Download patch file Download diff file Expand all files Collapse all files

19
workplans/KEY-WP-0019-upstream-provider-token-verification.md
View file

@ -4,7 +4,7 @@ type: workplan
title: "Verify upstream Authelia ID tokens"
domain: infotech
repo: key-cape
status: active
status: finished
owner: claude
topic_slug: upstream-provider-token-verification
created: "2026-09-07"
@ -119,7 +119,7 @@ including why no transport enforcement exists, so its absence reads as a choice.
```task
id: KEY-WP-0019-T05
status: todo
status: done
priority: medium
state_hub_task_id: "0dc909fe-1772-5816-9e11-dbe7664a4e1f"
```
@ -128,3 +128,18 @@ Move `internal/authclient`'s inline verification onto `internal/jose` so one
implementation serves both paths. Kept separate from T01/T02 deliberately: the
caller verifier is a tested security path, and destabilising it in the same
change that introduces upstream verification would confuse the evidence for both.
`Client.Verify` now fetches the raw key set and delegates parsing and signature
checking to `internal/jose`, keeping its own claim policy — audience and nonce
bindings are the caller's and cannot live in a shared verifier. Its existing
tests pass unchanged, which is the point: the migration preserved behaviour.
One deliberate strictness increase: a key set containing any malformed RSA
signing key is now refused outright, where the previous code would have used a
good key alongside a bad one. KeyCape's own `/jwks` publishes a single key, so
this affects no current deployment.
Also added direct tests for `internal/jose` (17 cases). It is now the single
verifier behind both paths, so testing it only through its callers would leave
its edges — duplicate key ids, `crit`, even exponents, undersized moduli — to be
covered by accident.