e2e: implement claims validation

Author: wpjunior

e2e/container/nginx.conf

@@ -27,6 +27,9 @@ http {
                 local cjson = require("cjson.safe")
                 local token, err = libjwt.validate({
                     jwks_files = {"/usr/share/tokens/jwks1.json", "/usr/share/tokens/jwks2.json"},
+                    validate_claims = {
+                        email = {exact = "[email protected]"},
+                    },
                 })
                 ngx.header.content_type = "application/json"
                 if err and err ~= "" then

e2e/e2e_test.go

@@ -212,4 +212,24 @@ func TestNginxContainer(t *testing.T) {
 		assert.Equal(http.StatusOK, statusCode)
 	})
 
+	t.Run("Should deny when passes a invalid claim", func(t *testing.T) {
+		t.Parallel()
+		assert := assertTestify.New(t)
+
+		jwtRequest, err := jwks_test.CreateJWT(
+			privateKey2,
+			jwks_test.JWTParams{KID: "kid-654321", Email: "[email protected]"})
+		assert.NoError(err)
+		body, statusCode, err := request_test.Do(request_test.Params{
+			URL:         URL,
+			HeaderKey:   "Authorization",
+			HeaderValue: fmt.Sprintf("Bearer %s", jwtRequest),
+		})
+		assert.NoError(err)
+		assert.Equal(http.StatusForbidden, statusCode)
+		assert.Equal(string(body), `{"message":"Claim 'email' must be exactly '[email protected]'"}
+`)
+
+	})
+
 }

e2e/jwks/generate.go

@@ -47,6 +47,7 @@ func CreateJWT(privateKey *rsa.PrivateKey, params JWTParams) (string, error) {
 	claims := jwt.MapClaims{
 		"sub":   "1234567890",
 		"name":  "Tsuru",
+		"email": "[email protected]",
 		"admin": true,
 		"iat":   time.Now().Unix(),
 		"exp":   time.Now().Add(time.Hour * 24).Unix(),