重构 JWT 与 Transit 签名流程

internal/signing/jwt_test.go

@@ -21,24 +21,19 @@ func TestIssuerProducesInteroperableRS256JWT(t *testing.T) {
 		t.Fatalf("generate key: %v", err)
 	}
 	signer := &localRS256Signer{keyID: "workload-sts-v1", key: privateKey}
-	issuer, err := NewIssuer(signer)
+	issuer, err := NewIssuer("https://identity.ad.ddupan.top", 5*time.Minute, signer)
 	if err != nil {
 		t.Fatalf("NewIssuer() error = %v", err)
 	}
 	now := time.Unix(1_789_062_000, 0)
-	issuer.now = func() time.Time { return now }
 
-	token, err := issuer.Sign(context.Background(), Claims{
-		Issuer:        "https://identity.ad.ddupan.top",
+	token, err := issuer.issueAt(context.Background(), IssueRequest{
 		Subject:       "01993f4d-5e1a-7000-8000-000000000001",
 		PrincipalName: "ci/homelab-infra-plan",
-		Audience:      []string{"https://bao.ad.ddupan.top:8200"},
-		IssuedAt:      now.Unix(),
-		NotBefore:     now.Unix(),
-		ExpiresAt:     now.Add(5 * time.Minute).Unix(),
+		Audience:      "https://bao.ad.ddupan.top:8200",
 		JWTID:         "01993f4d-5e1a-7000-8000-000000000002",
 		Scope:         "bao.login",
-	})
+	}, now)
 	if err != nil {
 		t.Fatalf("Sign() error = %v", err)
 	}
@@ -79,33 +74,9 @@ func TestIssuerRejectsExcessiveLifetime(t *testing.T) {
 	if err != nil {
 		t.Fatalf("generate key: %v", err)
 	}
-	issuer, err := NewIssuer(&localRS256Signer{keyID: "test", key: privateKey})
-	if err != nil {
-		t.Fatalf("NewIssuer() error = %v", err)
-	}
-	now := time.Unix(1_789_062_000, 0)
-	issuer.now = func() time.Time { return now }
-
-	_, err = issuer.Sign(context.Background(), Claims{
-		Issuer:    "https://identity.ad.ddupan.top",
-		Subject:   "principal",
-		Audience:  []string{"audience"},
-		IssuedAt:  now.Unix(),
-		NotBefore: now.Unix(),
-		ExpiresAt: now.Add(5*time.Minute + time.Second).Unix(),
-		JWTID:     "jti",
-		Scope:     "scope",
-	})
+	_, err = NewIssuer("https://identity.ad.ddupan.top", 5*time.Minute+time.Second, &localRS256Signer{keyID: "test", key: privateKey})
 	if err == nil {
-		t.Fatal("Sign() error = nil, want excessive lifetime error")
-	}
-}
-
-func TestIntegerRejectsNonIntegralJSONNumber(t *testing.T) {
-	for _, value := range []any{1.5, json.Number("1.5")} {
-		if _, err := integer(value); err == nil {
-			t.Fatalf("integer(%v) error = nil, want invalid integer error", value)
-		}
+		t.Fatal("NewIssuer() error = nil, want excessive lifetime error")
 	}
 }