go-replidentity/identity_test.go at main · replit/go-replidentity · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
package replidentity_test

import (
	"fmt"
	"os"

	"github.com/replit/go-replidentity"
)

func Example() {
	identity := os.Getenv("REPL_IDENTITY")
	if identity == "" {
		fmt.Println("Sorry, this repl does not yet have an identity (anonymous run?).")
		return
	}
	identityKey := os.Getenv("REPL_IDENTITY_KEY")
	if identity == "" {
		fmt.Println("Sorry, this repl does not yet have an identity (anonymous run?).")
		return
	}

	// This should be set to the Repl ID of the repl you want to prove your
	// identity to.
	targetRepl := "target_repl"

	// Create a signing authority that is authorized to emit tokens for the
	// current repl.
	signingAuthority, err := replidentity.NewSigningAuthority(
		string(identityKey),
		identity,
		os.Getenv("REPL_ID"),
		replidentity.ReadPublicKeyFromEnv,
	)
	if err != nil {
		panic(err)
	}

	signedToken, err := signingAuthority.Sign(targetRepl)
	if err != nil {
		panic(err)
	}

	// Verify the signed token, pretending we are the target repl.
	replIdentity, err := replidentity.VerifyIdentity(
		signedToken,
		[]string{targetRepl},
		replidentity.ReadPublicKeyFromEnv,
	)
	if err != nil {
		panic(err)
	}

	fmt.Println()
	fmt.Printf("The identity in the repl's token (%d bytes) is:\n", len(identity))
	fmt.Printf(
		"repl id: %s\n   user: %s\n   slug: %s  audience: %s\n",
		replIdentity.Replid,
		replIdentity.User,
		replIdentity.Slug,
		replIdentity.Aud,
	)
}

func ExampleVerifyRenewIdentity() {
	identity := os.Getenv("REPL_RENEWAL")
	if identity == "" {
		fmt.Println("Sorry, this repl does not yet have an identity (anonymous run?).")
		return
	}
	identityKey := os.Getenv("REPL_RENEWAL_KEY")
	if identity == "" {
		fmt.Println("Sorry, this repl does not yet have an identity (anonymous run?).")
		return
	}

	// This should be set to the Repl ID of the repl you want to prove your
	// identity to.
	targetRepl := "target_repl"

	// Create a signing authority that is authorized to emit tokens for the
	// current repl.
	signingAuthority, err := replidentity.NewSigningAuthority(
		string(identityKey),
		identity,
		os.Getenv("REPL_ID"),
		replidentity.ReadPublicKeyFromEnv,
	)
	if err != nil {
		panic(err)
	}

	signedToken, err := signingAuthority.Sign(targetRepl)
	if err != nil {
		panic(err)
	}

	// Verify the signed token, pretending we are the target repl.
	replIdentity, err := replidentity.VerifyRenewIdentity(
		signedToken,
		[]string{targetRepl},
		replidentity.ReadPublicKeyFromEnv,
	)
	if err != nil {
		panic(err)
	}

	fmt.Println()
	fmt.Printf("The identity in the repl's token (%d bytes) is:\n", len(identity))
	fmt.Printf(
		"repl id: %s\n   user: %s\n   slug: %s  audience: %s\n",
		replIdentity.Replid,
		replIdentity.User,
		replIdentity.Slug,
		replIdentity.Aud,
	)
}