Skip to content

Commit 423b794

Browse files
kozlovickozlovic
authored
Merge pull request #2004 from nats-io/jwt-issue
[FIXED] private import issue by pulling in up to date jwt library
2 parents 4f8931e + eb1a91d commit 423b794

File tree

178 files changed

+14062
-6337
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

178 files changed

+14062
-6337
lines changed

‎go.mod

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,15 @@
11
module github.com/nats-io/nats-server/v2
22

3-
go 1.15
3+
go 1.16
44

55
require (
6-
github.com/klauspost/compress v1.11.7
7-
github.com/minio/highwayhash v1.0.0
8-
github.com/nats-io/jwt/v2 v2.0.0-20210208203759-ff814ca5f813
6+
github.com/klauspost/compress v1.11.12
7+
github.com/minio/highwayhash v1.0.1
8+
github.com/nats-io/jwt/v2 v2.0.1
99
github.com/nats-io/nats.go v1.10.1-0.20210228004050-ed743748acac
10-
github.com/nats-io/nkeys v0.2.0
10+
github.com/nats-io/nkeys v0.3.0
1111
github.com/nats-io/nuid v1.0.1
12-
golang.org/x/crypto v0.0.0-20201016220609-9e8e0b390897
13-
golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f
12+
golang.org/x/crypto v0.0.0-20210314154223-e6e6c4f2bb5b
13+
golang.org/x/sys v0.0.0-20201119102817-f84b799fce68
1414
golang.org/x/time v0.0.0-20200416051211-89c76fbcd5d1
1515
)

‎go.sum

Lines changed: 18 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -11,17 +11,24 @@ github.com/google/go-cmp v0.4.0 h1:xsAVV57WRhGj6kEIi8ReJzQlHHqcBYCElAvkovg3B/4=
1111
github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
1212
github.com/klauspost/compress v1.11.7 h1:0hzRabrMN4tSTvMfnL3SCv1ZGeAP23ynzodBgaHeMeg=
1313
github.com/klauspost/compress v1.11.7/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
14+
github.com/klauspost/compress v1.11.12 h1:famVnQVu7QwryBN4jNseQdUKES71ZAOnB6UQQJPZvqk=
15+
github.com/klauspost/compress v1.11.12/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
1416
github.com/minio/highwayhash v1.0.0 h1:iMSDhgUILCr0TNm8LWlSjF8N0ZIj2qbO8WHp6Q/J2BA=
1517
github.com/minio/highwayhash v1.0.0/go.mod h1:xQboMTeM9nY9v/LlAOxFctujiv5+Aq2hR5dxBpaMbdc=
18+
github.com/minio/highwayhash v1.0.1 h1:dZ6IIu8Z14VlC0VpfKofAhCy74wu/Qb5gcn52yWoz/0=
19+
github.com/minio/highwayhash v1.0.1/go.mod h1:BQskDq+xkJ12lmlUUi7U0M5Swg3EWR+dLTk+kldvVxY=
1620
github.com/nats-io/jwt v0.3.2/go.mod h1:/euKqTS1ZD+zzjYrY7pseZrTtWQSjujC7xjPc8wL6eU=
1721
github.com/nats-io/jwt v0.3.3-0.20200519195258-f2bf5ce574c7/go.mod h1:n3cvmLfBfnpV4JJRN7lRYCyZnw48ksGsbThGXEk4w9M=
1822
github.com/nats-io/jwt v1.1.0 h1:+vOlgtM0ZsF46GbmUoadq0/2rChNS45gtxHEa3H1gqM=
1923
github.com/nats-io/jwt v1.1.0/go.mod h1:n3cvmLfBfnpV4JJRN7lRYCyZnw48ksGsbThGXEk4w9M=
24+
github.com/nats-io/jwt v1.2.2 h1:w3GMTO969dFg+UOKTmmyuu7IGdusK+7Ytlt//OYH/uU=
25+
github.com/nats-io/jwt v1.2.2/go.mod h1:/xX356yQA6LuXI9xWW7mZNpxgF2mBmGecH+Fj34sP5Q=
2026
github.com/nats-io/jwt/v2 v2.0.0-20200916203241-1f8ce17dff02/go.mod h1:vs+ZEjP+XKy8szkBmQwCB7RjYdIlMaPsFPs4VdS4bTQ=
2127
github.com/nats-io/jwt/v2 v2.0.0-20201015190852-e11ce317263c/go.mod h1:vs+ZEjP+XKy8szkBmQwCB7RjYdIlMaPsFPs4VdS4bTQ=
2228
github.com/nats-io/jwt/v2 v2.0.0-20210125223648-1c24d462becc/go.mod h1:PuO5FToRL31ecdFqVjc794vK0Bj0CwzveQEDvkb7MoQ=
23-
github.com/nats-io/jwt/v2 v2.0.0-20210208203759-ff814ca5f813 h1:km4lLzT86NyJRhO++VqfP/vn5cbfm+E05i2bGdqDbrY=
2429
github.com/nats-io/jwt/v2 v2.0.0-20210208203759-ff814ca5f813/go.mod h1:PuO5FToRL31ecdFqVjc794vK0Bj0CwzveQEDvkb7MoQ=
30+
github.com/nats-io/jwt/v2 v2.0.1 h1:SycklijeduR742i/1Y3nRhURYM7imDzZZ3+tuAQqhQA=
31+
github.com/nats-io/jwt/v2 v2.0.1/go.mod h1:VRP+deawSXyhNjXmxPCHskrR6Mq50BqpEI5SEcNiGlY=
2532
github.com/nats-io/nats-server/v2 v2.1.8-0.20200524125952-51ebd92a9093/go.mod h1:rQnBf2Rv4P9adtAs/Ti6LfFmVtFG6HLhl/H7cVshcJU=
2633
github.com/nats-io/nats-server/v2 v2.1.8-0.20200601203034-f8d6dd992b71/go.mod h1:Nan/1L5Sa1JRW+Thm4HNYcIDcVRFc5zK9OpSZeI2kk4=
2734
github.com/nats-io/nats-server/v2 v2.1.8-0.20200929001935-7f44d075f7ad/go.mod h1:TkHpUIDETmTI7mrHN40D1pzxfzHZuGmtMbtb83TGVQw=
@@ -32,33 +39,38 @@ github.com/nats-io/nats.go v1.10.0/go.mod h1:AjGArbfyR50+afOUotNX2Xs5SYHf+CoOa5H
3239
github.com/nats-io/nats.go v1.10.1-0.20200531124210-96f2130e4d55/go.mod h1:ARiFsjW9DVxk48WJbO3OSZ2DG8fjkMi7ecLmXoY/n9I=
3340
github.com/nats-io/nats.go v1.10.1-0.20200606002146-fc6fed82929a/go.mod h1:8eAIv96Mo9QW6Or40jUHejS7e4VwZ3VRYD6Sf0BTDp4=
3441
github.com/nats-io/nats.go v1.10.1-0.20201021145452-94be476ad6e0/go.mod h1:VU2zERjp8xmF+Lw2NH4u2t5qWZxwc7jB3+7HVMWQXPI=
35-
github.com/nats-io/nats.go v1.10.1-0.20210127212649-5b4924938a9a h1:EjwBk6T/arS7o0ZGdMgdzYrQHeUITT1GHf3cFQFtr3I=
3642
github.com/nats-io/nats.go v1.10.1-0.20210127212649-5b4924938a9a/go.mod h1:Sa3kLIonafChP5IF0b55i9uvGR10I3hPETFbi4+9kOI=
37-
github.com/nats-io/nats.go v1.10.1-0.20210211000709-75ded9c77585 h1:xbs6PNOyQcxNFXII9qcFvodqBtQKec8hP7WzGHOdsz0=
3843
github.com/nats-io/nats.go v1.10.1-0.20210211000709-75ded9c77585/go.mod h1:uBWnCKg9luW1g7hgzPxUjHFRI40EuTSX7RCzgnc74Jk=
3944
github.com/nats-io/nats.go v1.10.1-0.20210228004050-ed743748acac h1:/cF7DEtxQBcwRDhpFZ3J0XU4TFpJa9KQF/xDirRNNI0=
4045
github.com/nats-io/nats.go v1.10.1-0.20210228004050-ed743748acac/go.mod h1:hxFvLNbNmT6UppX5B5Tr/r3g+XSwGjJzFn6mxPNJEHc=
4146
github.com/nats-io/nkeys v0.1.3/go.mod h1:xpnFELMwJABBLVhffcfd1MZx6VsNRFpEugbxziKVo7w=
4247
github.com/nats-io/nkeys v0.1.4/go.mod h1:XdZpAbhgyyODYqjTawOnIOI7VlbKSarI9Gfy1tqEu/s=
43-
github.com/nats-io/nkeys v0.2.0 h1:WXKF7diOaPU9cJdLD7nuzwasQy9vT1tBqzXZZf3AMJM=
4448
github.com/nats-io/nkeys v0.2.0/go.mod h1:XdZpAbhgyyODYqjTawOnIOI7VlbKSarI9Gfy1tqEu/s=
49+
github.com/nats-io/nkeys v0.3.0 h1:cgM5tL53EvYRU+2YLXIK0G2mJtK12Ft9oeooSZMA2G8=
50+
github.com/nats-io/nkeys v0.3.0/go.mod h1:gvUNGjVcM2IPr5rCsRsC6Wb3Hr2CQAm08dsxtV6A5y4=
4551
github.com/nats-io/nuid v1.0.1 h1:5iA8DT8V7q8WK2EScv2padNa/rTESc1KdnPw4TC2paw=
4652
github.com/nats-io/nuid v1.0.1/go.mod h1:19wcPz3Ph3q0Jbyiqsd0kePYG7A95tJPxeL+1OSON2c=
4753
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
4854
golang.org/x/crypto v0.0.0-20190701094942-4def268fd1a4/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
4955
golang.org/x/crypto v0.0.0-20200323165209-0ec3e9974c59/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
50-
golang.org/x/crypto v0.0.0-20201016220609-9e8e0b390897 h1:pLI5jrR7OSLijeIDcmRxNmw2api+jEfxLoykJVice/E=
5156
golang.org/x/crypto v0.0.0-20201016220609-9e8e0b390897/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
57+
golang.org/x/crypto v0.0.0-20210314154223-e6e6c4f2bb5b h1:wSOdpTq0/eI46Ez/LkDwIsAKA71YP2SRKBODiRWM0as=
58+
golang.org/x/crypto v0.0.0-20210314154223-e6e6c4f2bb5b/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
5259
golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
60+
golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
5361
golang.org/x/sys v0.0.0-20190130150945-aca44879d564/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
5462
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
5563
golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
5664
golang.org/x/sys v0.0.0-20191022100944-742c48ecaeb7/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
57-
golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f h1:+Nyd8tzPX9R7BWHguqsrbFdRx3WQ/1ib8I44HXV5yTA=
5865
golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
66+
golang.org/x/sys v0.0.0-20201119102817-f84b799fce68 h1:nxC68pudNYkKU6jWhgrqdreuFiOQWj1Fs7T3VrH4Pjw=
67+
golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
68+
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
5969
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
70+
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
6071
golang.org/x/time v0.0.0-20200416051211-89c76fbcd5d1 h1:NusfzzA6yGQ+ua51ck7E3omNUX/JuqbFSaRGqU8CcLI=
6172
golang.org/x/time v0.0.0-20200416051211-89c76fbcd5d1/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
73+
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
6274
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543 h1:E7g+9GITq07hpfrRu66IVDexMakfv52eLZ2CXBWiKr4=
6375
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
6476
google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=

‎server/accounts.go

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3577,6 +3577,15 @@ func getOperator(s *Server) (string, bool, error) {
35773577
return op, strict, nil
35783578
}
35793579

3580+
func claimValidate(claim *jwt.AccountClaims) error {
3581+
vr := &jwt.ValidationResults{}
3582+
claim.Validate(vr)
3583+
if vr.IsBlocking(false) {
3584+
return fmt.Errorf("validation errors: %v", vr.Errors())
3585+
}
3586+
return nil
3587+
}
3588+
35803589
func (dr *DirAccResolver) Start(s *Server) error {
35813590
op, strict, err := getOperator(s)
35823591
if err != nil {
@@ -3609,7 +3618,9 @@ func (dr *DirAccResolver) Start(s *Server) error {
36093618
return
36103619
}
36113620
if claim, err := jwt.DecodeAccountClaims(string(msg)); err != nil {
3612-
respondToUpdate(s, resp, pubKey, "jwt update resulted in error", err)
3621+
respondToUpdate(s, resp, "n/a", "jwt update resulted in error", err)
3622+
} else if err := claimValidate(claim); err != nil {
3623+
respondToUpdate(s, resp, claim.Subject, "jwt validation failed", err)
36133624
} else if claim.Subject != pubKey {
36143625
err := errors.New("subject does not match jwt content")
36153626
respondToUpdate(s, resp, pubKey, "jwt update resulted in error", err)
@@ -3631,6 +3642,8 @@ func (dr *DirAccResolver) Start(s *Server) error {
36313642
} else if claim.Issuer == op && strict {
36323643
err := errors.New("operator requires issuer to be a signing key")
36333644
respondToUpdate(s, resp, claim.Subject, "jwt update resulted in error", err)
3645+
} else if err := claimValidate(claim); err != nil {
3646+
respondToUpdate(s, resp, claim.Subject, "jwt validation failed", err)
36343647
} else if err := dr.save(claim.Subject, string(msg)); err != nil {
36353648
respondToUpdate(s, resp, claim.Subject, "jwt update resulted in error", err)
36363649
} else {
@@ -3865,6 +3878,8 @@ func (dr *CacheDirAccResolver) Start(s *Server) error {
38653878
respondToUpdate(s, resp, pubKey, "jwt update cache resulted in error", err)
38663879
} else if _, ok := s.accounts.Load(pubKey); !ok {
38673880
respondToUpdate(s, resp, pubKey, "jwt update cache skipped", nil)
3881+
} else if err := claimValidate(claim); err != nil {
3882+
respondToUpdate(s, resp, claim.Subject, "jwt update cache validation failed", err)
38683883
} else if err := dr.save(pubKey, string(msg)); err != nil {
38693884
respondToUpdate(s, resp, pubKey, "jwt update cache resulted in error", err)
38703885
} else {
@@ -3882,6 +3897,8 @@ func (dr *CacheDirAccResolver) Start(s *Server) error {
38823897
respondToUpdate(s, resp, claim.Subject, "jwt update cache resulted in error", err)
38833898
} else if _, ok := s.accounts.Load(claim.Subject); !ok {
38843899
respondToUpdate(s, resp, claim.Subject, "jwt update cache skipped", nil)
3900+
} else if err := claimValidate(claim); err != nil {
3901+
respondToUpdate(s, resp, claim.Subject, "jwt update cache validation failed", err)
38853902
} else if err := dr.save(claim.Subject, string(msg)); err != nil {
38863903
respondToUpdate(s, resp, claim.Subject, "jwt update cache resulted in error", err)
38873904
} else {

‎server/jwt_test.go

Lines changed: 134 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4829,6 +4829,140 @@ func TestJWTAccountImportsWithWildcardSupport(t *testing.T) {
48294829
})
48304830
}
48314831

4832+
func TestJWTAccountTokenImportMisuse(t *testing.T) {
4833+
sysKp, syspub := createKey(t)
4834+
sysJwt := encodeClaim(t, jwt.NewAccountClaims(syspub), syspub)
4835+
sysCreds := newUser(t, sysKp)
4836+
defer os.Remove(sysCreds)
4837+
4838+
aExpKp, aExpPub := createKey(t)
4839+
aExpClaim := jwt.NewAccountClaims(aExpPub)
4840+
aExpClaim.Name = "Export"
4841+
aExpClaim.Exports.Add(&jwt.Export{
4842+
Subject: "$events.*.$in.*.>",
4843+
Type: jwt.Stream,
4844+
TokenReq: true,
4845+
}, &jwt.Export{
4846+
Subject: "foo",
4847+
Type: jwt.Stream,
4848+
TokenReq: true,
4849+
})
4850+
aExpJwt := encodeClaim(t, aExpClaim, aExpPub)
4851+
aExpCreds := newUser(t, aExpKp)
4852+
defer os.Remove(aExpCreds)
4853+
4854+
createImportingAccountClaim := func(aImpKp nkeys.KeyPair, aExpPub string, ac *jwt.ActivationClaims) (string, string) {
4855+
t.Helper()
4856+
token, err := ac.Encode(aExpKp)
4857+
require_NoError(t, err)
4858+
4859+
aImpPub, err := aImpKp.PublicKey()
4860+
require_NoError(t, err)
4861+
aImpClaim := jwt.NewAccountClaims(aImpPub)
4862+
aImpClaim.Name = "Import"
4863+
aImpClaim.Imports.Add(&jwt.Import{
4864+
Subject: "$events.*.$in.*.>",
4865+
Type: jwt.Stream,
4866+
Account: aExpPub,
4867+
Token: token,
4868+
})
4869+
aImpJwt := encodeClaim(t, aImpClaim, aImpPub)
4870+
aImpCreds := newUser(t, aImpKp)
4871+
return aImpJwt, aImpCreds
4872+
}
4873+
4874+
testConnect := func(aExpPub, aExpJwt, aExpCreds, aImpPub, aImpJwt, aImpCreds string) {
4875+
t.Helper()
4876+
ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
4877+
if r.URL.Path == "/A/" {
4878+
// Server startup
4879+
w.Write(nil)
4880+
} else if r.URL.Path == "/A/"+aExpPub {
4881+
w.Write([]byte(aExpJwt))
4882+
} else if r.URL.Path == "/A/"+aImpPub {
4883+
w.Write([]byte(aImpJwt))
4884+
} else {
4885+
t.Fatal("not expected")
4886+
}
4887+
}))
4888+
defer ts.Close()
4889+
cf := createConfFile(t, []byte(fmt.Sprintf(`
4890+
listen: -1
4891+
operator: %s
4892+
resolver: URL("%s/A/")
4893+
`, ojwt, ts.URL)))
4894+
defer os.Remove(cf)
4895+
4896+
s, opts := RunServerWithConfig(cf)
4897+
defer s.Shutdown()
4898+
4899+
ncImp, err := nats.Connect(fmt.Sprintf("nats://%s:%d", opts.Host, opts.Port), nats.UserCredentials(aImpCreds))
4900+
require_Error(t, err) // misuse needs to result in an error
4901+
defer ncImp.Close()
4902+
}
4903+
4904+
testNatsResolver := func(aImpJwt string) {
4905+
t.Helper()
4906+
dirSrv := createDir(t, "srv")
4907+
defer os.RemoveAll(dirSrv)
4908+
cf := createConfFile(t, []byte(fmt.Sprintf(`
4909+
listen: -1
4910+
operator: %s
4911+
system_account: %s
4912+
resolver: {
4913+
type: full
4914+
dir: %s
4915+
}
4916+
`, ojwt, syspub, dirSrv)))
4917+
4918+
s, _ := RunServerWithConfig(cf)
4919+
defer s.Shutdown()
4920+
4921+
require_True(t, updateJwt(t, s.ClientURL(), sysCreds, sysJwt, 1) == 1)
4922+
require_True(t, updateJwt(t, s.ClientURL(), sysCreds, aExpJwt, 1) == 1)
4923+
require_True(t, updateJwt(t, s.ClientURL(), sysCreds, aImpJwt, 1) == 0) // assure this did not succeed
4924+
}
4925+
4926+
t.Run("wrong-account", func(t *testing.T) {
4927+
aImpKp, aImpPub := createKey(t)
4928+
ac := &jwt.ActivationClaims{}
4929+
_, ac.Subject = createKey(t) // on purpose issue this token for another account
4930+
ac.ImportSubject = "$events.*.$in.*.>"
4931+
ac.ImportType = jwt.Stream
4932+
4933+
aImpJwt, aImpCreds := createImportingAccountClaim(aImpKp, aExpPub, ac)
4934+
defer os.Remove(aImpCreds)
4935+
testConnect(aExpPub, aExpJwt, aExpCreds, aImpPub, aImpJwt, aImpCreds)
4936+
testNatsResolver(aImpJwt)
4937+
})
4938+
4939+
t.Run("different-subject", func(t *testing.T) {
4940+
aImpKp, aImpPub := createKey(t)
4941+
ac := &jwt.ActivationClaims{}
4942+
ac.Subject = aImpPub
4943+
ac.ImportSubject = "foo" // on purpose use a subject from another export
4944+
ac.ImportType = jwt.Stream
4945+
4946+
aImpJwt, aImpCreds := createImportingAccountClaim(aImpKp, aExpPub, ac)
4947+
defer os.Remove(aImpCreds)
4948+
testConnect(aExpPub, aExpJwt, aExpCreds, aImpPub, aImpJwt, aImpCreds)
4949+
testNatsResolver(aImpJwt)
4950+
})
4951+
4952+
t.Run("non-existing-subject", func(t *testing.T) {
4953+
aImpKp, aImpPub := createKey(t)
4954+
ac := &jwt.ActivationClaims{}
4955+
ac.Subject = aImpPub
4956+
ac.ImportSubject = "does-not-exist-or-from-different-export" // on purpose use a non exported subject
4957+
ac.ImportType = jwt.Stream
4958+
4959+
aImpJwt, aImpCreds := createImportingAccountClaim(aImpKp, aExpPub, ac)
4960+
defer os.Remove(aImpCreds)
4961+
testConnect(aExpPub, aExpJwt, aExpCreds, aImpPub, aImpJwt, aImpCreds)
4962+
testNatsResolver(aImpJwt)
4963+
})
4964+
}
4965+
48324966
func TestJWTResponseThreshold(t *testing.T) {
48334967
respThresh := 20 * time.Millisecond
48344968
aExpKp, aExpPub := createKey(t)

0 commit comments

Comments
 (0)