mirror of
https://github.com/hanzoai/kms.git
synced 2026-10-17 11:18:16 +00:00
zeekay
f3fbb687d2
Following the earlier AdminShell+CollectionCRUD rewrite (PR #14) which already deleted backend/, backend-go/, cloudformation/, helm-charts/, nginx/, sink/, wasm/, upgrade-impact/, e2e/, migration/, package.json and switched the frontend to a 184K Hanzo-first build, complete the cleanup by deleting the remaining Infisical-era residue: - docs/ (1.0G Infisical mintlify docs) - .env.example, .env.dev.example, .env.migration.example, .env.test.example (legacy Postgres/Redis envs; no Go code references them) - .eslintignore, .husky/ (TS toolchain leftovers) - CODE_OF_CONDUCT.md, CONTRIBUTING.md, SECURITY.md (Infisical repo boilerplate) Working tree drops from ~1.0G to <600K of content (1.5G total is .git/ which `git gc --aggressive --prune=now` shrinks locally; the remote keeps its history shape — anyone pulling gets the lean checkout). Build + test verification: go build ./... (4 cmd binaries: green) go test ./... -count=1 -short (all packages: ok) Kept: cmd/, pkg/, sdk/, frontend/ (AdminShell), schema/, examples/, root Go (audit.go, auth.go, consensus.go, embed.go, jwks.go, mount.go, versioning.go + tests), Dockerfile, Dockerfile.kms-fetch, Makefile, LLM.md, CLAUDE.md, DEPRECATED.md, SOVEREIGN-KMS-ARCHITECTURE.md, TFHE-KMS-ARCHITECTURE.md, LICENSE, README.md, VERSION, .github/ (8 Hanzo workflows: build, build-kms-fetch, check-fe-ts-and-lint, ci, pr-preview, release, validate-pr-title, workflow-sanity).
92 lines
2.5 KiB
Go
92 lines
2.5 KiB
Go
// Shared test utilities. The package-level sharedTestJWT is bound during
|
|
// TestMain so every test can produce a signed JWT without re-spinning a
|
|
// JWKS server per test.
|
|
//
|
|
// This replaces the previous mintToken() unsigned-JWT helper. Post-patch
|
|
// the KMS authz layer requires real RS256 signatures; an unsigned token
|
|
// returns 401 (as Red F3 demands).
|
|
package kms
|
|
|
|
import (
|
|
"crypto/rand"
|
|
"crypto/rsa"
|
|
"encoding/base64"
|
|
"encoding/json"
|
|
"math/big"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"os"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/golang-jwt/jwt/v5"
|
|
)
|
|
|
|
// shared fixtures bound in TestMain.
|
|
var (
|
|
sharedPriv *rsa.PrivateKey
|
|
sharedKid = "kms-shared-test-kid"
|
|
sharedJWKS *httptest.Server
|
|
sharedIssuer = "https://iam.test.hanzo.id"
|
|
sharedAudience = "kms"
|
|
)
|
|
|
|
func TestMain(m *testing.M) {
|
|
// Generate a single RSA key for the whole test binary.
|
|
priv, err := rsa.GenerateKey(rand.Reader, 2048)
|
|
if err != nil {
|
|
panic("testutil: keygen: " + err.Error())
|
|
}
|
|
sharedPriv = priv
|
|
|
|
nB64 := base64.RawURLEncoding.EncodeToString(priv.N.Bytes())
|
|
eB64 := base64.RawURLEncoding.EncodeToString(big.NewInt(int64(priv.E)).Bytes())
|
|
jwksJSON, _ := json.Marshal(map[string]any{
|
|
"keys": []map[string]string{
|
|
{"kty": "RSA", "kid": sharedKid, "use": "sig", "alg": "RS256", "n": nB64, "e": eB64},
|
|
},
|
|
})
|
|
sharedJWKS = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
w.Header().Set("Content-Type", "application/json")
|
|
w.Write(jwksJSON)
|
|
}))
|
|
|
|
os.Setenv("IAM_ISSUER", sharedIssuer)
|
|
os.Setenv("IAM_AUDIENCE", sharedAudience)
|
|
os.Setenv("IAM_KEYS_URL", sharedJWKS.URL)
|
|
os.Setenv("KMS_ENV", "dev")
|
|
|
|
applyAuthConfig(loadAuthConfig())
|
|
resetJWKSCacheForTest()
|
|
|
|
code := m.Run()
|
|
sharedJWKS.Close()
|
|
os.Exit(code)
|
|
}
|
|
|
|
// mintTestJWTSigned produces an RS256-signed JWT using the shared test
|
|
// keypair + kid + JWKS. Defaults iss/aud/exp/iat to the shared test
|
|
// fixtures unless the caller overrides them.
|
|
func mintTestJWTSigned(t *testing.T, claims jwt.MapClaims) string {
|
|
t.Helper()
|
|
if _, ok := claims["iss"]; !ok {
|
|
claims["iss"] = sharedIssuer
|
|
}
|
|
if _, ok := claims["aud"]; !ok {
|
|
claims["aud"] = sharedAudience
|
|
}
|
|
if _, ok := claims["exp"]; !ok {
|
|
claims["exp"] = time.Now().Add(10 * time.Minute).Unix()
|
|
}
|
|
if _, ok := claims["iat"]; !ok {
|
|
claims["iat"] = time.Now().Unix()
|
|
}
|
|
token := jwt.NewWithClaims(jwt.SigningMethodRS256, claims)
|
|
token.Header["kid"] = sharedKid
|
|
s, err := token.SignedString(sharedPriv)
|
|
if err != nil {
|
|
t.Fatalf("mintTestJWTSigned: %v", err)
|
|
}
|
|
return s
|
|
}
|