(t *testing.T)
| 37 | } |
| 38 | |
| 39 | func TestSignVerify_AccessToken(t *testing.T) { |
| 40 | s := testSigner(t) |
| 41 | tok, exp, err := s.SignAccessToken("bot@acme.com", "agent", 1, testIssuer) |
| 42 | if err != nil { |
| 43 | t.Fatalf("SignAccessToken: %v", err) |
| 44 | } |
| 45 | if d := time.Until(exp); d > 16*time.Minute || d < 14*time.Minute { |
| 46 | t.Errorf("access_token TTL = %v, want ~15m", d) |
| 47 | } |
| 48 | got, err := s.VerifyToken(tok, TypAccessToken, testIssuer) |
| 49 | if err != nil { |
| 50 | t.Fatalf("VerifyToken: %v", err) |
| 51 | } |
| 52 | if got.Subject != "bot@acme.com" || got.Type != TypAccessToken { |
| 53 | t.Errorf("claims = %+v", got) |
| 54 | } |
| 55 | } |
| 56 | |
| 57 | // TestVerify_TypeConfusion: an access_token must NOT verify as an |
| 58 | // identity_assertion (and vice versa) — the typ claim is load-bearing, so a |
nothing calls this directly
no test coverage detected