Merge pull request #53 from shogo82148/migrate-jwt-go

migrate dgrijalva/jwt-go to golang-jwt/jwt-go

.github/workflows/go.yml

@@ -11,10 +11,10 @@ jobs:
     name: Build
     runs-on: ubuntu-latest
     steps:
-      - name: Set up Go 1.13
+      - name: Set up Go 1.17
         uses: actions/setup-go@v2
         with:
-          go-version: 1.13
+          go-version: 1.17
 
       - name: Check out code
         uses: actions/checkout@v2

README.md

@@ -89,4 +89,4 @@ WebHook request
 
 # Dependencies
 
--   [github.com/dgrijalva/jwt-go](https://github.com/dgrijalva/jwt-go)
+-   [github.com/golang-jwt/jwt-go](https://github.com/golang-jwt/jwt-go)

appsTransport.go

@@ -8,7 +8,7 @@ import (
 	"strconv"
 	"time"
 
-	jwt "github.com/dgrijalva/jwt-go/v4"
+	jwt "github.com/golang-jwt/jwt/v4"
 )
 
 // AppsTransport provides a http.RoundTripper by wrapping an existing
@@ -70,8 +70,8 @@ func (t *AppsTransport) RoundTrip(req *http.Request) (*http.Response, error) {
 	iss := time.Now().Add(-30 * time.Second).Truncate(time.Second)
 	exp := iss.Add(2 * time.Minute)
 	claims := &jwt.StandardClaims{
-		IssuedAt:  jwt.At(iss),
-		ExpiresAt: jwt.At(exp),
+		IssuedAt:  iss.Unix(),
+		ExpiresAt: exp.Unix(),
 		Issuer:    strconv.FormatInt(t.appID, 10),
 	}
 	bearer := jwt.NewWithClaims(jwt.SigningMethodRS256, claims)

appsTransport_test.go

@@ -2,15 +2,15 @@ package ghinstallation
 
 import (
 	"bytes"
+	"fmt"
 	"io/ioutil"
 	"net/http"
 	"net/http/httptest"
 	"os"
 	"strings"
 	"testing"
-	"time"
 
-	jwt "github.com/dgrijalva/jwt-go/v4"
+	jwt "github.com/golang-jwt/jwt/v4"
 	"github.com/google/go-cmp/cmp"
 )
 
@@ -80,16 +80,19 @@ func TestJWTExpiry(t *testing.T) {
 	check := RoundTrip{
 		rt: func(req *http.Request) (*http.Response, error) {
 			token := strings.Fields(req.Header.Get("Authorization"))[1]
-			tok, err := jwt.ParseWithClaims(token, &jwt.StandardClaims{}, jwt.KnownKeyfunc(jwt.SigningMethodRS256, key))
+			tok, err := jwt.ParseWithClaims(token, &jwt.StandardClaims{}, func(t *jwt.Token) (interface{}, error) {
+				if t.Header["alg"] != "RS256" {
+					return nil, fmt.Errorf("unexpected signing method: %v, expected: %v", t.Header["alg"], "RS256")
+				}
+				return &key.PublicKey, nil
+			})
 			if err != nil {
 				t.Fatalf("jwt parse: %v", err)
 			}
 
 			c := tok.Claims.(*jwt.StandardClaims)
-			if c.ExpiresAt == nil {
+			if c.ExpiresAt == 0 {
 				t.Fatalf("missing exp claim")
-			} else if c.ExpiresAt.Time != c.ExpiresAt.Truncate(time.Second) {
-				t.Fatalf("bad exp %v: not truncated to whole seconds", c.ExpiresAt.Time)
 			}
 			return nil, nil
 		},

go.mod

@@ -3,7 +3,7 @@ module github.com/bradleyfalzon/ghinstallation/v2
 go 1.13
 
 require (
-	github.com/dgrijalva/jwt-go/v4 v4.0.0-preview1
+	github.com/golang-jwt/jwt/v4 v4.0.0
 	github.com/google/go-cmp v0.5.6
 	github.com/google/go-github/v39 v39.0.0
 )

go.sum

@@ -1,5 +1,5 @@
-github.com/dgrijalva/jwt-go/v4 v4.0.0-preview1 h1:CaO/zOnF8VvUfEbhRatPcwKVWamvbYd8tQGRWacE9kU=
-github.com/dgrijalva/jwt-go/v4 v4.0.0-preview1/go.mod h1:+hnT3ywWDTAFrW5aE+u2Sa/wT555ZqwoCS+pk3p6ry4=
+github.com/golang-jwt/jwt/v4 v4.0.0 h1:RAqyYixv1p7uEnocuy8P1nru5wprCh/MH2BIlW5z5/o=
+github.com/golang-jwt/jwt/v4 v4.0.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzwAxVc6locg=
 github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=

transport_test.go

@@ -242,6 +242,9 @@ func TestRefreshTokenWithParameters(t *testing.T) {
 	tr.InstallationTokenOptions = installationTokenOptions
 
 	req, err := http.NewRequest("POST", fmt.Sprintf("%s/app/installations/%v/access_tokens", tr.BaseURL, tr.installationID), body)
+	if err != nil {
+		t.Fatal("unexpected error:", err)
+	}
 	if _, err := tr.RoundTrip(req); err != nil {
 		t.Fatalf("error calling RoundTrip: %v", err)
 	}