TestDisabledSigner: an empty PEM yields a disabled signer that errs on sign and serves an empty (non-nil) JWKS — the off-by-default posture.
(t *testing.T)
| 103 | // TestDisabledSigner: an empty PEM yields a disabled signer that errs on sign |
| 104 | // and serves an empty (non-nil) JWKS — the off-by-default posture. |
| 105 | func TestDisabledSigner(t *testing.T) { |
| 106 | s, err := NewSigner("", "") |
| 107 | if err != nil { |
| 108 | t.Fatalf("NewSigner(empty): unexpected error %v", err) |
| 109 | } |
| 110 | if s.Enabled() { |
| 111 | t.Error("empty-key signer must be disabled") |
| 112 | } |
| 113 | if _, err := s.Sign(jwt.Claims{Subject: "x"}, nil); err != ErrSigningDisabled { |
| 114 | t.Errorf("Sign on disabled signer = %v, want ErrSigningDisabled", err) |
| 115 | } |
| 116 | jwks := s.PublicJWKS() |
| 117 | if jwks.Keys == nil || len(jwks.Keys) != 0 { |
| 118 | t.Errorf("disabled JWKS must be empty non-nil, got %+v", jwks.Keys) |
| 119 | } |
| 120 | } |
| 121 | |
| 122 | // TestMalformedKeyHardError: a non-empty but invalid key is a startup error |
| 123 | // (fail fast), not a silently-disabled signer. |
nothing calls this directly
no test coverage detected