correct: fail on invalid types of registered JWT claims (exp, nbf, iat, aud)

2025-05-07 21:54:32 +00:00
parent 066b136597
commit b3bff90d68
4 changed files with 99 additions and 30 deletions
@@ -137,6 +137,66 @@ spec = describe "authorization" $ do
    request methodGet "/authors_only" [auth] ""
      `shouldRespondWith` 200

+  it "fails when the exp claim is not a number" $ do
+    let jwtPayload = [json|
+          {
+            "exp": "invalid",
+            "role": "postgrest_test_author"
+          }|]
+        auth = authHeaderJWT $ generateJWT jwtPayload
+    request methodGet "/authors_only" [auth] ""
+      `shouldRespondWith`
+        [json|{"code":"PGRST303","details":null,"hint":null,"message":"The JWT 'exp' claim must be a number"}|]
+        { matchStatus = 401 }
+
+  it "fails when the nbf claim is not a number" $ do
+    let jwtPayload = [json|
+          {
+            "nbf": "invalid",
+            "role": "postgrest_test_author"
+          }|]
+        auth = authHeaderJWT $ generateJWT jwtPayload
+    request methodGet "/authors_only" [auth] ""
+      `shouldRespondWith`
+        [json|{"code":"PGRST303","details":null,"hint":null,"message":"The JWT 'nbf' claim must be a number"}|]
+        { matchStatus = 401 }
+
+  it "fails when the iat claim is not a number" $ do
+    let jwtPayload = [json|
+          {
+            "iat": "invalid",
+            "role": "postgrest_test_author"
+          }|]
+        auth = authHeaderJWT $ generateJWT jwtPayload
+    request methodGet "/authors_only" [auth] ""
+      `shouldRespondWith`
+        [json|{"code":"PGRST303","details":null,"hint":null,"message":"The JWT 'iat' claim must be a number"}|]
+        { matchStatus = 401 }
+
+  it "fails when the aud claim has a single value and it's not a string" $ do
+    let jwtPayload = [json|
+          {
+            "aud": {"invalid": "value"},
+            "role": "postgrest_test_author"
+          }|]
+        auth = authHeaderJWT $ generateJWT jwtPayload
+    request methodGet "/authors_only" [auth] ""
+      `shouldRespondWith`
+        [json|{"code":"PGRST303","details":null,"hint":null,"message":"The JWT 'aud' claim must be a string or an array of strings"}|]
+        { matchStatus = 401 }
+
+  it "fails when the aud claim is an array but it has non-string elements" $ do
+    let jwtPayload = [json|
+          {
+            "aud": [{"invalid": "value"}, "test"],
+            "role": "postgrest_test_author"
+          }|]
+        auth = authHeaderJWT $ generateJWT jwtPayload
+    request methodGet "/authors_only" [auth] ""
+      `shouldRespondWith`
+        [json|{"code":"PGRST303","details":null,"hint":null,"message":"The JWT 'aud' claim must be a string or an array of strings"}|]
+        { matchStatus = 401 }
+
  describe "custom pre-request proc acting on id claim" $ do

    it "able to switch to postgrest_test_author role (id=1)" $