Function AppendAuthInfo

testutil/graphql.go:267–298

(schema []byte, algo, publicKeyFile string, closedByDefault bool)

}

func AppendAuthInfo(schema []byte, algo, publicKeyFile string, closedByDefault bool) ([]byte, error) {
	authInfo := `# Dgraph.Authorization {"VerificationKey":"%s","Header":"X-Test-Auth","Namespace":"https://xyz.io/jwt/claims","Algo":"%s","Audience":["aud1","63do0q16n6ebjgkumu05kkeian","aud5"],"ClosedByDefault":%s}`

	closedByDefaultStr := "false"
	if closedByDefault {
		closedByDefaultStr = "true"
	}

	var verificationKey string
	switch algo {
	case "HS256":
		// Widened from the original 9-byte "secretkey" to meet the 14-byte
		// (112-bit) HMAC key minimum that NIST SP 800-131A requires and
		// that some FIPS-validated crypto providers (e.g. the OpenSSL FIPS
		// provider used by Chainguard go-fips / Microsoft Go FIPS-mode builds)
		// enforce at EVP_MAC_init. Benign for non-FIPS builds — a longer
		// HMAC key is always acceptable. See graphql/resolve/auth_test.go
		// for the matching hardcoded JWT tokens signed with this value.
		verificationKey = "secretkey-long-enough"
	case "RS256":
		keyData, err := os.ReadFile(publicKeyFile)
		if err != nil {
			return nil, err
		}
		// Replacing ASCII newline with "\n" as the authorization information in the schema
		// should be present in a single line.
		verificationKey = string(bytes.ReplaceAll(keyData, []byte{10}, []byte{92, 110}))
	}

	authInfo = fmt.Sprintf(authInfo, verificationKey, algo, closedByDefaultStr)
	return append(schema, []byte(authInfo)...), nil
}

func AppendAuthInfoWithJWKUrl(schema []byte) ([]byte, error) {
	authInfo := `#   Dgraph.Authorization {"VerificationKey":"","Header":"X-Test-Auth","jwkurl":"https://dev-hr2kugfp.us.auth0.com/.well-known/jwks.json", "Namespace":"https://xyz.io/jwt/claims","Algo":"","Audience":[ "HhaXkQVRBn5e0K3DmMp2zbjI8i1wcv2e"]}`