fix(oauth2): enforce sig usage on JWK set

Author: macastelaz

packages/google-auth/google/oauth2/id_token.py

@@ -151,7 +151,7 @@ def verify_token(
 
         signing_key = None
         for key in jwkset.keys:
-            if key.key_id == kid:
+            if kid and key.key_id == kid and key.public_key_use in ("sig", None):
                 signing_key = key
                 break
 

packages/google-auth/tests/oauth2/test_id_token.py

@@ -95,8 +95,9 @@ def test_verify_token_jwk(decode, get_unverified_header, py_jwk_set, _fetch_cert
     _fetch_certs.return_value = data
     get_unverified_header.return_value = {"kid": "mock-kid"}
 
-    mock_key = mock.Mock()
+    mock_key = mock.MagicMock()
     mock_key.key_id = "mock-kid"
+    mock_key.public_key_use = "sig"
     mock_key.key = mock.sentinel.key
     mock_key.algorithm_name = "mock-alg"
     py_jwk_set.from_dict.return_value.keys = [mock_key]