patrickandClaude Sonnet 5
e57b0d23b6
CI / Web-Barrierefreiheitspruefung (axe, Tastatur, Reflow, Textabstaende) (push) Canceled after 0s
CI / Core-Modul (Build/Vet/Test) (push) Canceled after 0s
CI / DMS Security-Test-Gate (AC5, Merge-Gate) (push) Canceled after 0s
CI / DMS-Modul (Lint/Build/Test/Coverage/Artefakt) (push) Canceled after 0s
CI / DMS-Modul Supply-Chain-Scan (govulncheck) (push) Canceled after 0s
CI / Web (dms-browser) (push) Canceled after 0s
CI / Web (pdf-viewer) (push) Canceled after 0s
CI / Web (shl) (push) Canceled after 0s
Core-Schnittstellen-Vertragstests / contract-tests (push) Canceled after 0s
Supply-Chain-Scan (Go) / govulncheck (push) Canceled after 0s
Signaturschluessel der Modul-JWTs liegen verschluesselt in der Mandanten-Datenbank (module_signing_keys), werden von mehreren Instanzen geteilt und rotieren mit Ueberlappung; nicht lesbarer Speicher ergibt 503 statt Token/JWKS. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
57 lines
1.4 KiB
Go
57 lines
1.4 KiB
Go
// e2e-modulekeys-verify prueft ein Modul-JWT gegen die JWKS eines Kontodienstes
|
|
// (Hilfswerkzeug fuer scripts/e2e-module-keys.sh). usage: e2e-modulekeys-verify <jwks-url> <token>
|
|
package main
|
|
|
|
import (
|
|
"context"
|
|
"crypto/ed25519"
|
|
"fmt"
|
|
"io"
|
|
"net/http"
|
|
"os"
|
|
"time"
|
|
|
|
"gitea.perlbach24.de/scripte/nexarch/internal/moduletrust"
|
|
)
|
|
|
|
func main() {
|
|
if len(os.Args) != 3 {
|
|
fmt.Fprintln(os.Stderr, "usage: e2e-modulekeys-verify <jwks-url> <token>")
|
|
os.Exit(2)
|
|
}
|
|
url, token := os.Args[1], os.Args[2]
|
|
v := moduletrust.NewVerifier(time.Minute, func(ctx context.Context) (map[string]ed25519.PublicKey, error) {
|
|
req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
resp, err := http.DefaultClient.Do(req)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
defer resp.Body.Close()
|
|
if resp.StatusCode != http.StatusOK {
|
|
return nil, fmt.Errorf("jwks status %d", resp.StatusCode)
|
|
}
|
|
body, err := io.ReadAll(resp.Body)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
raw, err := moduletrust.ParseJWKS(body)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
out := make(map[string]ed25519.PublicKey, len(raw))
|
|
for kid, k := range raw {
|
|
out[kid] = ed25519.PublicKey(k)
|
|
}
|
|
return out, nil
|
|
})
|
|
claims, err := v.Verify(context.Background(), token)
|
|
if err != nil {
|
|
fmt.Println("INVALID:", err)
|
|
os.Exit(1)
|
|
}
|
|
fmt.Printf("VALID sub=%s tenant=%s role=%s\n", claims.Subject, claims.TenantSlug, claims.Role)
|
|
}
|