chore(rust): add test coverage for crate edge cases (#400)

Signed-off-by: Yordis Prieto <yordis.prieto@gmail.com>

Author: yordis

.gitignore

@@ -2,6 +2,7 @@
 debug
 /rsworkspace/target/
 /rsworkspace/crates/*/target/
+/target/
 **/*.rs.bk
 *.pdb
 *.rlib

rsworkspace/Cargo.lock

@@ -38,3 +38,6 @@ impl fmt::Display for CallerJwtHeaderValue {
         f.write_str("<redacted>")
     }
 }
+
+#[cfg(test)]
+mod tests;

rsworkspace/crates/a2a-auth-callout/src/caller_jwt_header.rs

@@ -0,0 +1,43 @@
+use super::*;
+use crate::jwt::MintedUserJwt;
+
+#[test]
+fn from_minted_copies_jwt_string() {
+    let token = MintedUserJwt::new("a.b.c").unwrap();
+    let header = CallerJwtHeaderValue::from_minted(&token);
+    assert_eq!(header.as_str(), "a.b.c");
+}
+
+#[test]
+fn parse_accepts_trimmed_compact_jwt() {
+    let header = CallerJwtHeaderValue::parse("  a.b.c  ").unwrap();
+    assert_eq!(header.as_str(), "a.b.c");
+}
+
+#[test]
+fn parse_rejects_empty_and_whitespace_only() {
+    assert!(matches!(
+        CallerJwtHeaderValue::parse("").unwrap_err(),
+        JwtError::Decode(_)
+    ));
+    assert!(matches!(
+        CallerJwtHeaderValue::parse("   ").unwrap_err(),
+        JwtError::Decode(_)
+    ));
+}
+
+#[test]
+fn parse_rejects_non_compact_jwt() {
+    for bad in ["a.b", "a..c", "a.b."] {
+        assert!(
+            matches!(CallerJwtHeaderValue::parse(bad).unwrap_err(), JwtError::Decode(_)),
+            "expected rejection for {bad:?}"
+        );
+    }
+}
+
+#[test]
+fn display_redacts_value() {
+    let header = CallerJwtHeaderValue::parse("a.b.c").unwrap();
+    assert_eq!(header.to_string(), "<redacted>");
+}

rsworkspace/crates/a2a-auth-callout/src/caller_jwt_header/tests.rs

@@ -1,5 +1,6 @@
 use super::*;
 use crate::error::CredentialError;
+use crate::jwt::JwtError;
 
 fn make_registry() -> ApiKeyRegistry {
     ApiKeyRegistry::new(b"test-hmac-secret".to_vec())
@@ -68,6 +69,15 @@ fn apikey_rejects_empty() {
     assert_eq!(err.to_string(), "API key must not be empty");
 }
 
+#[test]
+fn caller_id_derivation_failure_maps_to_invalid_credentials() {
+    let err: AuthCalloutError = ApiKeyError::CallerIdDerivation(JwtError::InvalidCallerId).into();
+    let AuthCalloutError::CredentialVerification(CredentialError::InvalidCredentials(message)) = err else {
+        panic!("expected InvalidCredentials");
+    };
+    assert!(message.contains("caller_id derivation failed"));
+}
+
 #[test]
 fn registry_collides_on_double_register() {
     let mut registry = make_registry();

rsworkspace/crates/a2a-auth-callout/src/credentials/api_key/tests.rs

@@ -1,4 +1,6 @@
 use rcgen::{BasicConstraints, CertificateParams, DistinguishedName, DnType, IsCa, KeyPair};
+use time::OffsetDateTime;
+use x509_parser::pem::Pem;
 
 use super::*;
 
@@ -75,3 +77,115 @@ async fn rejects_wrong_anchor() {
         AuthCalloutError::CredentialVerification(CredentialError::InvalidCredentials(_))
     ));
 }
+
+#[test]
+fn rejects_pem_with_no_certificate_block() {
+    // A PEM file with no CERTIFICATE labels causes chain_ders to return an empty
+    // vector error.
+    let pem = "-----BEGIN PRIVATE KEY-----\nYWJj\n-----END PRIVATE KEY-----\n";
+    let err = X509MtlsVerifier::chain_ders(pem).unwrap_err();
+    assert!(matches!(
+        err,
+        AuthCalloutError::CredentialVerification(CredentialError::InvalidCredentials(_))
+    ));
+}
+
+#[test]
+fn parse_cas_skips_non_certificate_pem_labels() {
+    // A bundle where all entries are not CERTIFICATE labels: parse_cas must
+    // skip them all and then return an empty-bundle error.
+    let bundle = "-----BEGIN PRIVATE KEY-----\nYWJj\n-----END PRIVATE KEY-----\n";
+    let pems: Vec<Pem> = Pem::iter_from_buffer(bundle.as_bytes())
+        .filter_map(|r| r.ok())
+        .collect();
+    let err = X509MtlsVerifier::parse_cas(&pems).unwrap_err();
+    assert!(matches!(
+        err,
+        AuthCalloutError::CredentialVerification(CredentialError::InvalidCredentials(_))
+    ));
+}
+
+#[tokio::test]
+async fn rejects_expired_certificate() {
+    let ca_key = KeyPair::generate().expect("ca key");
+    let mut ca_dn = DistinguishedName::new();
+    ca_dn.push(DnType::CommonName, "test-ca");
+    let mut ca_params = CertificateParams::default();
+    ca_params.distinguished_name = ca_dn;
+    ca_params.is_ca = IsCa::Ca(BasicConstraints::Unconstrained);
+    let ca = ca_params.self_signed(&ca_key).expect("ca");
+
+    let ee_key = KeyPair::generate().expect("ee key");
+    let mut ee_dn = DistinguishedName::new();
+    ee_dn.push(DnType::CommonName, "test-service");
+    let mut ee_params = CertificateParams::default();
+    ee_params.distinguished_name = ee_dn;
+    let ee = ee_params.signed_by(&ee_key, &ca, &ca_key).expect("ee");
+
+    let v = X509MtlsVerifier::new(TrustAnchorPem::new(ca.pem()));
+    // Use a `now` far in the past so the cert is outside its validity window.
+    let past = OffsetDateTime::from_unix_timestamp(0).unwrap();
+    let err = v
+        .verify_sync(&ClientCertPem::new(ee.pem()), &AudienceAccount::new("acct"), past)
+        .unwrap_err();
+    assert!(matches!(
+        err,
+        AuthCalloutError::CredentialVerification(CredentialError::InvalidCredentials(_))
+    ));
+}
+
+#[tokio::test]
+async fn rejects_ca_cert_presented_as_leaf() {
+    let ca_key = KeyPair::generate().expect("ca key");
+    let mut ca_dn = DistinguishedName::new();
+    ca_dn.push(DnType::CommonName, "test-ca");
+    let mut ca_params = CertificateParams::default();
+    ca_params.distinguished_name = ca_dn;
+    ca_params.is_ca = IsCa::Ca(BasicConstraints::Unconstrained);
+    let ca = ca_params.self_signed(&ca_key).expect("ca");
+
+    // Present the CA cert itself as the client cert.
+    let v = X509MtlsVerifier::new(TrustAnchorPem::new(ca.pem()));
+    let now = OffsetDateTime::now_utc();
+    let err = v
+        .verify_sync(&ClientCertPem::new(ca.pem()), &AudienceAccount::new("acct"), now)
+        .unwrap_err();
+    assert!(matches!(
+        err,
+        AuthCalloutError::CredentialVerification(CredentialError::InvalidCredentials(_))
+    ));
+}
+
+#[tokio::test]
+async fn verifies_cert_that_is_itself_a_trust_anchor() {
+    // A self-signed end-entity cert. When the same cert is placed in both the
+    // client PEM and the trust anchor bundle it should short-circuit to
+    // trusted = true via the "current cert is itself a configured trust anchor"
+    // branch.
+    let key = KeyPair::generate().expect("key");
+    let mut dn = DistinguishedName::new();
+    dn.push(DnType::CommonName, "self-signed-ee");
+    let mut params = CertificateParams::default();
+    params.distinguished_name = dn;
+    let cert = params.self_signed(&key).expect("cert");
+
+    let v = X509MtlsVerifier::new(TrustAnchorPem::new(cert.pem()));
+    let now = OffsetDateTime::now_utc();
+    let claims = v
+        .verify_sync(&ClientCertPem::new(cert.pem()), &AudienceAccount::new("acct"), now)
+        .expect("should be trusted");
+    assert_eq!(claims.aud.as_str(), "acct");
+}
+
+#[test]
+fn client_cert_pem_accessors_work() {
+    let pem = ClientCertPem::new("-----BEGIN CERTIFICATE-----\nYWJj\n-----END CERTIFICATE-----");
+    assert!(pem.as_str().contains("CERTIFICATE"));
+    let pem2 = pem.clone();
+    assert_eq!(pem, pem2);
+
+    let anchor = TrustAnchorPem::new("bundle");
+    assert_eq!(anchor.as_str(), "bundle");
+    let anchor2 = anchor.clone();
+    assert_eq!(anchor, anchor2);
+}

rsworkspace/crates/a2a-auth-callout/src/credentials/mtls/tests.rs

@@ -5,7 +5,8 @@ use std::time::Duration;
 
 use base64::{Engine, engine::general_purpose::URL_SAFE_NO_PAD};
 use jsonwebtoken::jwk::{
-    AlgorithmParameters, CommonParameters, Jwk, KeyOperations, PublicKeyUse, RSAKeyParameters, RSAKeyType,
+    AlgorithmParameters, CommonParameters, EllipticCurveKeyParameters, EllipticCurveKeyType, Jwk, KeyOperations,
+    PublicKeyUse, RSAKeyParameters, RSAKeyType,
 };
 use rand::rngs::OsRng;
 use rsa::RsaPrivateKey;
@@ -292,3 +293,116 @@ fn same_origin_normalizes_default_ports() {
         "https://idp.example.com"
     ));
 }
+
+#[test]
+fn oidc_issuer_url_strips_trailing_slashes_and_rejects_empty() {
+    let url = OidcIssuerUrl::parse("https://idp.example.com///").unwrap();
+    assert_eq!(url.as_str(), "https://idp.example.com");
+
+    let err = OidcIssuerUrl::parse("///").unwrap_err();
+    assert!(matches!(
+        err,
+        AuthCalloutError::CredentialVerification(CredentialError::InvalidCredentials(_))
+    ));
+
+    let err_empty = OidcIssuerUrl::parse("").unwrap_err();
+    assert!(matches!(
+        err_empty,
+        AuthCalloutError::CredentialVerification(CredentialError::InvalidCredentials(_))
+    ));
+}
+
+#[test]
+fn oidc_client_id_as_str_returns_value() {
+    let id = OidcClientId::new("my-client").unwrap();
+    assert_eq!(id.as_str(), "my-client");
+}
+
+#[test]
+fn same_origin_returns_false_when_candidate_has_no_scheme() {
+    // No "://" separator → url_origin returns None → same_origin returns false.
+    assert!(!super::same_origin("no-scheme", "https://idp.example.com"));
+}
+
+#[test]
+fn same_origin_returns_false_when_expected_has_no_scheme() {
+    assert!(!super::same_origin("https://idp.example.com/jwks", "no-scheme"));
+}
+
+#[test]
+fn same_origin_returns_false_for_empty_host() {
+    // scheme://... with no host component → url_origin returns None.
+    assert!(!super::same_origin("https:///path", "https://idp.example.com"));
+}
+
+#[tokio::test]
+async fn verify_fails_with_non_rsa_jwk() {
+    let issuer = OidcIssuerUrl::parse("https://issuer.example").unwrap();
+    let ec_jwk = Jwk {
+        common: CommonParameters {
+            key_id: Some("ec-kid".into()),
+            ..Default::default()
+        },
+        algorithm: AlgorithmParameters::EllipticCurve(EllipticCurveKeyParameters {
+            key_type: EllipticCurveKeyType::EC,
+            curve: jsonwebtoken::jwk::EllipticCurve::P256,
+            x: "dummyx".into(),
+            y: "dummyy".into(),
+        }),
+    };
+    let jwks = JwkSet { keys: vec![ec_jwk] };
+    let verifier = JwksOidcVerifier::with_static_jwks(issuer, vec!["aud".into()], jwks);
+
+    // Craft a fake JWT whose kid matches the EC JWK; decode_header will succeed
+    // but decoding_key_for_jwk must reject the non-RSA key.
+    // We can't sign with the EC key easily, but we can make a header-only token
+    // that references the EC kid.  decode_header just parses the header.
+    let header_b64 =
+        base64::engine::general_purpose::URL_SAFE_NO_PAD.encode(br#"{"alg":"ES256","kid":"ec-kid","typ":"JWT"}"#);
+    let payload_b64 = base64::engine::general_purpose::URL_SAFE_NO_PAD.encode(b"{}");
+    let fake_token = format!("{header_b64}.{payload_b64}.sig");
+
+    let err = verifier
+        .verify_internal(&BearerToken::new(fake_token), &AudienceAccount::new("acct"))
+        .await
+        .unwrap_err();
+    assert!(matches!(
+        err,
+        AuthCalloutError::CredentialVerification(CredentialError::InvalidCredentials(_))
+    ));
+}
+
+#[tokio::test]
+async fn oidc_verifier_trait_delegates_to_verify_internal() {
+    // Exercise the OidcVerifier::verify blanket impl on JwksOidcVerifier.
+    let rng = &mut OsRng;
+    let (jwks, enc) = test_jwks_and_encoding_key(rng);
+    let issuer = OidcIssuerUrl::parse("https://issuer.example").unwrap();
+    let verifier: &dyn OidcVerifier =
+        &JwksOidcVerifier::with_static_jwks(issuer.clone(), vec!["a2a-client".into()], jwks);
+    #[derive(Serialize)]
+    struct IdClaims {
+        sub: String,
+        iss: String,
+        aud: String,
+        exp: u64,
+    }
+    let now = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .unwrap()
+        .as_secs();
+    let id = IdClaims {
+        sub: "user-1".into(),
+        iss: issuer.as_str().to_owned(),
+        aud: "a2a-client".into(),
+        exp: now + 600,
+    };
+    let mut header = jsonwebtoken::Header::new(jsonwebtoken::Algorithm::RS256);
+    header.kid = Some("test-kid".into());
+    let token = jsonwebtoken::encode(&header, &id, &enc).expect("encode");
+    let claims = verifier
+        .verify(&BearerToken::new(token), &AudienceAccount::new("nats-acct"))
+        .await
+        .expect("verify via trait");
+    assert_eq!(claims.sub.as_str(), "user-1");
+}

rsworkspace/crates/a2a-auth-callout/src/credentials/oidc/tests.rs

@@ -96,3 +96,31 @@ fn credential_invalid_request_maps_to_invalid_request() {
         DenialCategory::InvalidRequest
     );
 }
+
+#[test]
+fn key_load_variants_map_to_internal_error() {
+    assert_eq!(
+        DenialCategory::from_auth_callout_error(&AuthCalloutError::MissingEnvVar("SIGNING_KEY")),
+        DenialCategory::InternalError
+    );
+    assert_eq!(
+        DenialCategory::from_auth_callout_error(&AuthCalloutError::UnknownSigningKeySource("vault".into())),
+        DenialCategory::InternalError
+    );
+    assert_eq!(
+        DenialCategory::from_auth_callout_error(&AuthCalloutError::VaultNotConfigured),
+        DenialCategory::InternalError
+    );
+    assert_eq!(
+        DenialCategory::from_auth_callout_error(&AuthCalloutError::KeyLoadIo {
+            path: std::path::PathBuf::from("/etc/key"),
+            source: std::io::Error::new(std::io::ErrorKind::NotFound, "file not found"),
+        }),
+        DenialCategory::InternalError
+    );
+    let utf8_err = String::from_utf8(vec![0x80, 0x80]).unwrap_err().utf8_error();
+    assert_eq!(
+        DenialCategory::from_auth_callout_error(&AuthCalloutError::KeyLoadUtf8(utf8_err)),
+        DenialCategory::InternalError
+    );
+}