fix(oauth2): Raise PyJWKClientError for invalid kid instead of ValueError

Author: macastelaz

packages/google-auth/google/oauth2/id_token.py

@@ -141,6 +141,7 @@ def verify_token(
         try:
             import jwt as jwt_lib
             from jwt.api_jwk import PyJWKSet
+            from jwt.exceptions import PyJWKClientError
         except ImportError as caught_exc:  # pragma: NO COVER
             raise ImportError(
                 "The pyjwt library is not installed, please install the pyjwt package to use the jwk certs format."
@@ -156,7 +157,7 @@ def verify_token(
                 break
 
         if signing_key is None:
-            raise ValueError("Token has an invalid kid")
+            raise PyJWKClientError(f'Unable to find a signing key that matches: "{kid}"')
 
         return jwt_lib.decode(
             id_token,

packages/google-auth/tests/oauth2/test_id_token.py

@@ -117,6 +117,32 @@ def test_verify_token_jwk(decode, get_unverified_header, py_jwk_set, _fetch_cert
     )
 
 
+@mock.patch("google.oauth2.id_token._fetch_certs", autospec=True)
+@mock.patch("jwt.api_jwk.PyJWKSet", autospec=True)
+@mock.patch("jwt.get_unverified_header", autospec=True)
+@mock.patch("jwt.decode", autospec=True)
+def test_verify_token_jwk_missing_kid(decode, get_unverified_header, py_jwk_set, _fetch_certs):
+    from jwt.exceptions import PyJWKClientError
+
+    certs_url = "abc123"
+    data = {"keys": [{"alg": "RS256"}]}
+    _fetch_certs.return_value = data
+    get_unverified_header.return_value = {"kid": "mock-kid"}
+
+    mock_key = mock.MagicMock()
+    mock_key.key_id = "different-kid"
+    mock_key.public_key_use = "sig"
+    mock_key.key = mock.sentinel.key
+    mock_key.algorithm_name = "mock-alg"
+    py_jwk_set.from_dict.return_value.keys = [mock_key]
+
+    with pytest.raises(PyJWKClientError, match='Unable to find a signing key that matches: "mock-kid"'):
+        id_token.verify_token(
+            mock.sentinel.token, mock.sentinel.request, certs_url=certs_url
+        )
+
+
+
 @mock.patch("google.auth.jwt.decode", autospec=True)
 @mock.patch("google.oauth2.id_token._fetch_certs", autospec=True)
 def test_verify_token_args(_fetch_certs, decode):