Improve specs and blind spots

Author: anakinj

lib/jwt/decode.rb

@@ -77,11 +77,8 @@ def allowed_and_valid_algorithms
                       :algorithms].freeze
 
     def given_algorithms
-      ALGORITHM_KEYS.each do |alg_key|
-        alg = @options[alg_key]
-        return Array(alg) if alg
-      end
-      []
+      alg_key = ALGORITHM_KEYS.find { |key| @options[key] }
+      Array(@options[alg_key])
     end
 
     def allowed_algorithms

lib/jwt/jwa/ecdsa.rb

@@ -56,10 +56,6 @@ def verify(data:, signature:, verification_key:)
         register_algorithm(new(v[:algorithm], v[:digest]))
       end
 
-      def self.from_algorithm(algorithm)
-        new(algorithm, algorithm.downcase.gsub('es', 'sha'))
-      end
-
       def self.curve_by_name(name)
         NAMED_CURVES.fetch(name) do
           raise UnsupportedEcdsaCurve, "The ECDSA curve '#{name}' is not supported"

lib/jwt/jwa/hmac.rb

@@ -6,10 +6,6 @@ module JWA
     class Hmac
       include JWT::JWA::SigningAlgorithm
 
-      def self.from_algorithm(algorithm)
-        new(algorithm, OpenSSL::Digest.new(algorithm.downcase.gsub('hs', 'sha')))
-      end
-
       def initialize(alg, digest)
         @alg = alg
         @digest = digest

lib/jwt/jwk/ec.rb

@@ -124,10 +124,6 @@ def encode_octets(octets)
         ::JWT::Base64.url_encode(octets)
       end
 
-      def encode_open_ssl_bn(key_part)
-        ::JWT::Base64.url_encode(key_part.to_s(BINARY))
-      end
-
       def parse_ec_key(key)
         crv, x_octets, y_octets = keypair_components(key)
         octets = key.private_key&.to_bn&.to_s(BINARY)

lib/jwt/jwk/rsa.rb

@@ -165,6 +165,8 @@ def create_rsa_key_using_sets(rsa_parameters)
           end
         end
 
+        # :nocov:
+        # Before openssl 2.0, we need to use the accessors to set the key
         def create_rsa_key_using_accessors(rsa_parameters) # rubocop:disable Metrics/AbcSize
           validate_rsa_parameters!(rsa_parameters)
 
@@ -179,6 +181,7 @@ def create_rsa_key_using_accessors(rsa_parameters) # rubocop:disable Metrics/Abc
             rsa_key.iqmp = rsa_parameters[:qi] if rsa_parameters[:qi]
           end
         end
+        # :nocov:
 
         def validate_rsa_parameters!(rsa_parameters)
           return unless rsa_parameters.key?(:d)

spec/jwt/claims/verifier_spec.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+RSpec.describe JWT::Claims::Verifier do
+  describe '.verify!' do
+    context 'when all claims are given' do
+      let(:options) do
+        [
+          :exp,
+          :nbf,
+          { iss: 'issuer' },
+          :iat,
+          :jti,
+          { aud: 'aud' },
+          :sub,
+          :crit,
+          { required: [] },
+          :numeric
+        ]
+      end
+
+      it 'verifies all claims' do
+        token = SpecSupport::Token.new(payload: { 'iss' => 'issuer', 'jti' => 1, 'aud' => 'aud' }, header: { 'crit' => [] })
+        expect(described_class.verify!(token, *options)).to eq(nil)
+      end
+    end
+  end
+end

spec/jwt/jwa/none_spec.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+RSpec.describe JWT::JWA::None do
+  subject { described_class.new }
+
+  describe '#sign' do
+    it 'returns an empty string' do
+      expect(subject.sign('data', 'key')).to eq('')
+    end
+  end
+
+  describe '#verify' do
+    it 'returns true' do
+      expect(subject.verify('data', 'signature', 'key')).to be true
+    end
+  end
+end

spec/jwt/jwa/ps_spec.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 RSpec.describe JWT::JWA::Ps do
-  let(:rsa_key) { OpenSSL::PKey::RSA.generate(2048) }
+  let(:rsa_key) { test_pkey('rsa-2048-private.pem') }
   let(:data) { 'test data' }
   let(:ps256_instance) { described_class.new('PS256') }
   let(:ps384_instance) { described_class.new('PS384') }
@@ -44,7 +44,7 @@
     end
 
     context 'with a key length less than 2048 bits' do
-      let(:rsa_key) { OpenSSL::PKey::RSA.generate(1024) }
+      let(:rsa_key) { OpenSSL::PKey::RSA.generate(2047) }
 
       it 'raises an error' do
         expect do

spec/jwt/jwa/rsa_spec.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 RSpec.describe JWT::JWA::Rsa do
-  let(:rsa_key) { OpenSSL::PKey::RSA.generate(2048) }
+  let(:rsa_key) { test_pkey('rsa-2048-private.pem') }
   let(:data) { 'test data' }
   let(:rsa_instance) { described_class.new('RS256') }
 
@@ -21,7 +21,7 @@
     end
 
     context 'with a key length less than 2048 bits' do
-      let(:rsa_key) { OpenSSL::PKey::RSA.generate(1024) }
+      let(:rsa_key) { OpenSSL::PKey::RSA.generate(2047) }
 
       it 'raises an error' do
         expect do

spec/jwt/jwa/unsupported_spec.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+RSpec.describe JWT::JWA::Unsupported do
+  describe '.sign' do
+    it 'raises an error for unsupported signing method' do
+      expect { described_class.sign('data', 'key') }.to raise_error(JWT::EncodeError, 'Unsupported signing method')
+    end
+  end
+
+  describe '.verify' do
+    it 'raises an error for unsupported algorithm' do
+      expect { described_class.verify('data', 'signature', 'key') }.to raise_error(JWT::VerificationError, 'Algorithm not supported')
+    end
+  end
+end