sdk/artifact/jwt_test.go

package artifact

import (
	"encoding/base64"
	"encoding/json"
	"testing"
)

func makeToken(t *testing.T, payload map[string]any) string {
	t.Helper()

	header := base64.RawURLEncoding.EncodeToString([]byte(`{"alg":"none"}`))
	body, err := json.Marshal(payload)
	if err != nil {
		t.Fatal(err)
	}
	return header + "." + base64.RawURLEncoding.EncodeToString(body) + ".signature"
}

func TestJobInfo(t *testing.T) {
	t.Parallel()

	cases := []struct {
		name    string
		token   string
		run     string
		job     string
		wantErr bool
	}{
		{
			name:  "single scope",
			token: makeToken(t, map[string]any{"scp": "Actions.Results:123:456"}),
			run:   "123",
			job:   "456",
		},
		{
			name:  "scope among others",
			token: makeToken(t, map[string]any{"scp": "Actions.Cache:x:y Actions.Results:123:456"}),
			run:   "123",
			job:   "456",
		},
		{
			name:    "missing token",
			token:   "",
			wantErr: true,
		},
		{
			name:    "missing scp",
			token:   makeToken(t, map[string]any{"foo": "bar"}),
			wantErr: true,
		},
		{
			name:    "no results scope",
			token:   makeToken(t, map[string]any{"scp": "Actions.Cache:x:y"}),
			wantErr: true,
		},
		{
			name:    "malformed scope",
			token:   makeToken(t, map[string]any{"scp": "Actions.Results:123"}),
			wantErr: true,
		},
		{
			name:    "not a jwt",
			token:   "not-a-jwt",
			wantErr: true,
		},
	}

	for _, tc := range cases {
		tc := tc
		t.Run(tc.name, func(t *testing.T) {
			t.Parallel()

			env := func(key string) string {
				if key == "ACTIONS_RUNTIME_TOKEN" {
					return tc.token
				}
				return ""
			}

			run, job, err := jobInfo(env)
			if tc.wantErr {
				if err == nil {
					t.Fatalf("expected error, got run=%q job=%q", run, job)
				}
				return
			}
			if err != nil {
				t.Fatal(err)
			}
			if run != tc.run || job != tc.job {
				t.Errorf("expected run=%q job=%q, got run=%q job=%q", tc.run, tc.job, run, job)
			}
		})
	}
}