test: remove live Google JWKS call from JwtBearerTokenTest#24486
Merged
Conversation
JwtBearerTokenTest.testExpiredToken cleared the local JwtDecoder and replayed a real (long-expired) Google id_token, forcing JwtDecoders.fromIssuerLocation to perform live OIDC discovery and a JWKS fetch of https://www.googleapis.com/oauth2/v3/certs on every CI run. Any egress blip failed the build (RemoteKeySourceException). Rewrite the test to run fully offline using the existing local RSA fixtures: testExpiredToken now mints a locally-signed token with a fixed past exp and asserts the actual expiry error, and a new testUnknownSigningKey preserves the original intent (token signed with a key/algorithm the server does not accept) by signing with RS384 against the RS256 decoder, asserting the same error message the old test relied on Google's key rotation to produce. The unused Google token, client id and provider setup are removed. Test-only change; no production code affected.
This was referenced Jul 17, 2026
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #24486 +/- ##
=============================================
+ Coverage 30.40% 69.53% +39.12%
+ Complexity 1196 728 -468
=============================================
Files 3679 3711 +32
Lines 142430 143877 +1447
Branches 16619 16775 +156
=============================================
+ Hits 43308 100040 +56732
+ Misses 94894 36131 -58763
- Partials 4228 7706 +3478
Flags with carried forward coverage won't be shown. Click here to find out more. Continue to review full report in Codecov by Harness.
🚀 New features to boost your workflow:
|
jbee
approved these changes
Jul 20, 2026
david-mackessy
approved these changes
Jul 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
JwtBearerTokenTest.testExpiredTokencleared the localJwtDecoderand replayed a real (long-expired) Google id_token, forcingJwtDecoders.fromIssuerLocationto perform live OIDC discovery plus a JWKS fetch ofhttps://www.googleapis.com/oauth2/v3/certson every CI run. Any egress blip failed the build:External requests do not belong in the automated CI build.
What changed (test-only)
testExpiredTokennow mints a locally-signed token with a fixed pastexpand asserts the actual expiry error (Jwt expired at …). Previously the asserted message was a key-not-found error caused by Google having long rotated the 2021 signing key out of its JWKS — token expiry was never actually exercised.testUnknownSigningKeypreserves the original intent (a token signed with a key the server no longer accepts, e.g. ephemeral signing keys after a restart) fully offline: an RS384-signed token against the RS256 local decoder produces the same error message the old test relied on Google's key rotation to trigger.No production code affected.
Verification
I/O error on GET request for "https://accounts.google.com/.well-known/openid-configuration").AI Assisted