Add JKWS endpoint for GOV.UK One Login public key

Add a publicly accessible endpoint that returns a JSON Web Key Set
(JWKS) to share our public key with GOV.UK One Login.

Author: stephencdaly

app/controllers/one_login_jwks_controller.rb

@@ -0,0 +1,6 @@
+class OneLoginJwksController < ApplicationController
+  def show
+    jwk = Rails.application.config.x.one_login.public_key_jwk
+    render json: JWT::JWK::Set.new(jwk).export
+  end
+end

config/routes.rb

@@ -19,6 +19,8 @@
   get "/submission" => "submission_status#status", as: :status
   get "/.well-known/security.txt" => redirect("https://vulnerability-reporting.service.security.gov.uk/.well-known/security.txt")
 
+  get "/govuk-one-login-jwks", to: "one_login_jwks#show", as: :one_login_jwks
+
   form_id_constraints = { form_id: UrlPatterns::FORM_ID_REGEX }
   form_constraints = {
     **form_id_constraints,

spec/requests/one_login_jwks_controller_spec.rb

@@ -0,0 +1,34 @@
+require "rails_helper"
+require "base64"
+
+RSpec.describe OneLoginJwksController, type: :request do
+  describe "GET #show" do
+    before do
+      public_key = OpenSSL::PKey::RSA.generate(2048).public_key
+      public_key_jwk = JWT::JWK.new(public_key, use: "sig")
+
+      one_login_config = ActiveSupport::OrderedOptions.new
+      one_login_config.public_key_jwk = public_key_jwk
+
+      allow(Rails.application.config.x).to receive(:one_login).and_return(one_login_config)
+    end
+
+    it "returns the JWKS JSON" do
+      get one_login_jwks_path
+
+      expect(response).to have_http_status(:ok)
+      expect(response.content_type).to eq("application/json; charset=utf-8")
+      expect(response.parsed_body).to match({
+        "keys" => [
+          {
+            "e" => "AQAB",
+            "kty" => "RSA",
+            "use" => "sig",
+            "kid" => a_kind_of(String),
+            "n" => a_kind_of(String),
+          },
+        ],
+      })
+    end
+  end
+end