jwt_test.go

// Copyright 2018-2024 The NATS Authors
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

package server

import (
"bufio"
"context"
"encoding/base64"
"encoding/json"
"errors"
"fmt"
"io"
"net/http"
"net/http/httptest"
"os"
"path/filepath"
"strings"
"sync"
"sync/atomic"
"testing"
"time"

"github.com/nats-io/jwt/v2"
"github.com/nats-io/nats.go"
"github.com/nats-io/nkeys"
)

var (
// This matches ./configs/nkeys_jwts/test.seed
oSeed= []byte("SOAFYNORQLQFJYBYNUGC5D7SH2MXMUX5BFEWWGHN3EK4VGG5TPT5DZP7QU")
// This matches ./configs/nkeys/op.jwt
ojwt="eyJ0eXAiOiJqd3QiLCJhbGciOiJlZDI1NTE5In0.eyJhdWQiOiJURVNUUyIsImV4cCI6MTg1OTEyMTI3NSwianRpIjoiWE5MWjZYWVBIVE1ESlFSTlFPSFVPSlFHV0NVN01JNVc1SlhDWk5YQllVS0VRVzY3STI1USIsImlhdCI6MTU0Mzc2MTI3NSwiaXNzIjoiT0NBVDMzTVRWVTJWVU9JTUdOR1VOWEo2NkFIMlJMU0RBRjNNVUJDWUFZNVFNSUw2NU5RTTZYUUciLCJuYW1lIjoiU3luYWRpYSBDb21tdW5pY2F0aW9ucyBJbmMuIiwibmJmIjoxNTQzNzYxMjc1LCJzdWIiOiJPQ0FUMzNNVFZVMlZVT0lNR05HVU5YSjY2QUgyUkxTREFGM01VQkNZQVk1UU1JTDY1TlFNNlhRRyIsInR5cGUiOiJvcGVyYXRvciIsIm5hdHMiOnsic2lnbmluZ19rZXlzIjpbIk9EU0tSN01ZRlFaNU1NQUo2RlBNRUVUQ1RFM1JJSE9GTFRZUEpSTUFWVk40T0xWMllZQU1IQ0FDIiwiT0RTS0FDU1JCV1A1MzdEWkRSVko2NTdKT0lHT1BPUTZLRzdUNEhONk9LNEY2SUVDR1hEQUhOUDIiLCJPRFNLSTM2TFpCNDRPWTVJVkNSNlA1MkZaSlpZTVlXWlZXTlVEVExFWjVUSzJQTjNPRU1SVEFCUiJdfX0.hyfz6E39BMUh0GLzovFfk3wT4OfualftjdJ_eYkLfPvu5tZubYQ_Pn9oFYGCV_6yKy3KMGhWGUCyCdHaPhalBw"
oKp nkeys.KeyPair
)

funcinit() {
varerrerror
oKp, err=nkeys.FromSeed(oSeed)
iferr!=nil {
panic(fmt.Sprintf("Parsing oSeed failed with: %v", err))
 }
}

funcchanRecv(t*testing.T, recvChan<-chanstruct{}, limit time.Duration) {
t.Helper()
select {
case<-recvChan:
case<-time.After(limit):
t.Fatal("Should have received from channel")
 }
}

funcopTrustBasicSetup() *Server {
kp, _:=nkeys.FromSeed(oSeed)
pub, _:=kp.PublicKey()
opts:=defaultServerOptions
opts.TrustedKeys= []string{pub}
s, c, _, _:=rawSetup(opts)
c.close()
returns
}

funcbuildMemAccResolver(s*Server) {
mr:=&MemAccResolver{}
s.SetAccountResolver(mr)
}

funcaddAccountToMemResolver(s*Server, pub, jwtclaimstring) {
s.AccountResolver().Store(pub, jwtclaim)
}

funccreateClient(t*testing.T, s*Server, akp nkeys.KeyPair) (*testAsyncClient, *bufio.Reader, string) {
returncreateClientWithIssuer(t, s, akp, "")
}

funccreateClientWithIssuer(t*testing.T, s*Server, akp nkeys.KeyPair, optIssuerAccountstring) (*testAsyncClient, *bufio.Reader, string) {
t.Helper()
nkp, _:=nkeys.CreateUser()
pub, _:=nkp.PublicKey()
nuc:=jwt.NewUserClaims(pub)
ifoptIssuerAccount!="" {
nuc.IssuerAccount=optIssuerAccount
 }
ujwt, err:=nuc.Encode(akp)
iferr!=nil {
t.Fatalf("Error generating user JWT: %v", err)
 }
c, cr, l:=newClientForServer(s)

// Sign Nonce
varinfononceInfo
json.Unmarshal([]byte(l[5:]), &info)
sigraw, _:=nkp.Sign([]byte(info.Nonce))
sig:=base64.RawURLEncoding.EncodeToString(sigraw)

cs:=fmt.Sprintf("CONNECT {\"jwt\":%q,\"sig\":\"%s\"}\r\nPING\r\n", ujwt, sig)
returnc, cr, cs
}

funcsetupJWTTestWithClaims(t*testing.T, nac*jwt.AccountClaims, nuc*jwt.UserClaims, expectedstring) (*Server, nkeys.KeyPair, *testAsyncClient, *bufio.Reader) {
t.Helper()

akp, _:=nkeys.CreateAccount()
apub, _:=akp.PublicKey()
ifnac==nil {
nac=jwt.NewAccountClaims(apub)
 } else {
nac.Subject=apub
 }
ajwt, err:=nac.Encode(oKp)
iferr!=nil {
t.Fatalf("Error generating account JWT: %v", err)
 }

nkp, _:=nkeys.CreateUser()
pub, _:=nkp.PublicKey()
ifnuc==nil {
nuc=jwt.NewUserClaims(pub)
 } else {
nuc.Subject=pub
 }
jwt, err:=nuc.Encode(akp)
iferr!=nil {
t.Fatalf("Error generating user JWT: %v", err)
 }

s:=opTrustBasicSetup()
buildMemAccResolver(s)
addAccountToMemResolver(s, apub, ajwt)

c, cr, l:=newClientForServer(s)

// Sign Nonce
varinfononceInfo
json.Unmarshal([]byte(l[5:]), &info)
sigraw, _:=nkp.Sign([]byte(info.Nonce))
sig:=base64.RawURLEncoding.EncodeToString(sigraw)

// PING needed to flush the +OK/-ERR to us.
cs:=fmt.Sprintf("CONNECT {\"jwt\":%q,\"sig\":\"%s\",\"verbose\":true,\"pedantic\":true}\r\nPING\r\n", jwt, sig)
wg:= sync.WaitGroup{}
wg.Add(1)
gofunc() {
c.parse([]byte(cs))
wg.Done()
 }()
l, _=cr.ReadString('\n')
if!strings.HasPrefix(l, expected) {
t.Fatalf("Expected %q, got %q", expected, l)
 }
wg.Wait()

returns, akp, c, cr
}

funcsetupJWTTestWitAccountClaims(t*testing.T, nac*jwt.AccountClaims, expectedstring) (*Server, nkeys.KeyPair, *testAsyncClient, *bufio.Reader) {
t.Helper()
returnsetupJWTTestWithClaims(t, nac, nil, expected)
}

// This is used in test to create account claims and pass it
// to setupJWTTestWitAccountClaims.
funcnewJWTTestAccountClaims() *jwt.AccountClaims {
// We call NewAccountClaims() because it sets some defaults.
// However, this call needs a subject, but the real subject will
// be set in setupJWTTestWitAccountClaims(). Use some temporary one
// here.
returnjwt.NewAccountClaims("temp")
}

funcsetupJWTTestWithUserClaims(t*testing.T, nuc*jwt.UserClaims, expectedstring) (*Server, *testAsyncClient, *bufio.Reader) {
t.Helper()
s, _, c, cr:=setupJWTTestWithClaims(t, nil, nuc, expected)
returns, c, cr
}

// This is used in test to create user claims and pass it
// to setupJWTTestWithUserClaims.
funcnewJWTTestUserClaims() *jwt.UserClaims {
// As of now, tests could simply do &jwt.UserClaims{}, but in
// case some defaults are later added, we call NewUserClaims().
// However, this call needs a subject, but the real subject will
// be set in setupJWTTestWithUserClaims(). Use some temporary one
// here.
returnjwt.NewUserClaims("temp")
}

funcTestJWTUser(t*testing.T) {
s:=opTrustBasicSetup()
defers.Shutdown()

// Check to make sure we would have an authTimer
if!s.info.AuthRequired {
t.Fatalf("Expect the server to require auth")
 }

c, cr, _:=newClientForServer(s)
deferc.close()

// Don't send jwt field, should fail.
c.parseAsync("CONNECT {\"verbose\":true,\"pedantic\":true}\r\nPING\r\n")
l, _:=cr.ReadString('\n')
if!strings.HasPrefix(l, "-ERR ") {
t.Fatalf("Expected an error")
 }

okp, _:=nkeys.FromSeed(oSeed)

// Create an account that will be expired.
akp, _:=nkeys.CreateAccount()
apub, _:=akp.PublicKey()
nac:=jwt.NewAccountClaims(apub)
ajwt, err:=nac.Encode(okp)
iferr!=nil {
t.Fatalf("Error generating account JWT: %v", err)
 }

c, cr, cs:=createClient(t, s, akp)
deferc.close()

// PING needed to flush the +OK/-ERR to us.
// This should fail too since no account resolver is defined.
c.parseAsync(cs)
l, _=cr.ReadString('\n')
if!strings.HasPrefix(l, "-ERR ") {
t.Fatalf("Expected an error")
 }

// Ok now let's walk through and make sure all is good.
// We will set the account resolver by hand to a memory resolver.
buildMemAccResolver(s)
addAccountToMemResolver(s, apub, ajwt)

c, cr, cs=createClient(t, s, akp)
deferc.close()

c.parseAsync(cs)
l, _=cr.ReadString('\n')
if!strings.HasPrefix(l, "PONG") {
t.Fatalf("Expected a PONG, got %q", l)
 }
}

funcTestJWTUserBadTrusted(t*testing.T) {
s:=opTrustBasicSetup()
defers.Shutdown()

// Check to make sure we would have an authTimer
if!s.info.AuthRequired {
t.Fatalf("Expect the server to require auth")
 }
// Now place bad trusted key
s.mu.Lock()
s.trustedKeys= []string{"bad"}
s.mu.Unlock()

buildMemAccResolver(s)

okp, _:=nkeys.FromSeed(oSeed)

// Create an account that will be expired.
akp, _:=nkeys.CreateAccount()
apub, _:=akp.PublicKey()
nac:=jwt.NewAccountClaims(apub)
ajwt, err:=nac.Encode(okp)
iferr!=nil {
t.Fatalf("Error generating account JWT: %v", err)
 }
addAccountToMemResolver(s, apub, ajwt)

c, cr, cs:=createClient(t, s, akp)
deferc.close()
c.parseAsync(cs)
l, _:=cr.ReadString('\n')
if!strings.HasPrefix(l, "-ERR ") {
t.Fatalf("Expected an error")
 }
}

// Test that if a user tries to connect with an expired user JWT we do the right thing.
funcTestJWTUserExpired(t*testing.T) {
nuc:=newJWTTestUserClaims()
nuc.IssuedAt=time.Now().Add(-10*time.Second).Unix()
nuc.Expires=time.Now().Add(-2*time.Second).Unix()
s, c, _:=setupJWTTestWithUserClaims(t, nuc, "-ERR ")
c.close()
s.Shutdown()
}

funcTestJWTUserExpiresAfterConnect(t*testing.T) {
nuc:=newJWTTestUserClaims()
nuc.IssuedAt=time.Now().Unix()
nuc.Expires=time.Now().Add(time.Second).Unix()
s, c, cr:=setupJWTTestWithUserClaims(t, nuc, "+OK")
defers.Shutdown()
deferc.close()
l, err:=cr.ReadString('\n')
iferr!=nil {
t.Fatalf("Received %v", err)
 }
if!strings.HasPrefix(l, "PONG") {
t.Fatalf("Expected a PONG")
 }

// Now we should expire after 1 second or so.
time.Sleep(1250*time.Millisecond)

l, err=cr.ReadString('\n')
iferr!=nil {
t.Fatalf("Received %v", err)
 }
if!strings.HasPrefix(l, "-ERR ") {
t.Fatalf("Expected an error")
 }
if!strings.Contains(l, "Expired") {
t.Fatalf("Expected 'Expired' to be in the error")
 }
}

funcTestJWTUserPermissionClaims(t*testing.T) {
nuc:=newJWTTestUserClaims()
nuc.Permissions.Pub.Allow.Add("foo")
nuc.Permissions.Pub.Allow.Add("bar")
nuc.Permissions.Pub.Deny.Add("baz")
nuc.Permissions.Sub.Allow.Add("foo")
nuc.Permissions.Sub.Allow.Add("bar")
nuc.Permissions.Sub.Deny.Add("baz")

s, c, _:=setupJWTTestWithUserClaims(t, nuc, "+OK")
defers.Shutdown()
deferc.close()

// Now check client to make sure permissions transferred.
c.mu.Lock()
deferc.mu.Unlock()

ifc.perms==nil {
t.Fatalf("Expected client permissions to be set")
 }

iflpa:=c.perms.pub.allow.Count(); lpa!=2 {
t.Fatalf("Expected 2 publish allow subjects, got %d", lpa)
 }
iflpd:=c.perms.pub.deny.Count(); lpd!=1 {
t.Fatalf("Expected 1 publish deny subjects, got %d", lpd)
 }
iflsa:=c.perms.sub.allow.Count(); lsa!=2 {
t.Fatalf("Expected 2 subscribe allow subjects, got %d", lsa)
 }
iflsd:=c.perms.sub.deny.Count(); lsd!=1 {
t.Fatalf("Expected 1 subscribe deny subjects, got %d", lsd)
 }
}

funcTestJWTUserResponsePermissionClaims(t*testing.T) {
nuc:=newJWTTestUserClaims()
nuc.Permissions.Resp=&jwt.ResponsePermission{
MaxMsgs: 22,
Expires: 100*time.Millisecond,
 }
s, c, _:=setupJWTTestWithUserClaims(t, nuc, "+OK")
defers.Shutdown()
deferc.close()

// Now check client to make sure permissions transferred.
c.mu.Lock()
deferc.mu.Unlock()

ifc.perms==nil {
t.Fatalf("Expected client permissions to be set")
 }
ifc.perms.pub.allow==nil {
t.Fatalf("Expected client perms for pub allow to be non-nil")
 }
iflpa:=c.perms.pub.allow.Count(); lpa!=0 {
t.Fatalf("Expected 0 publish allow subjects, got %d", lpa)
 }
ifc.perms.resp==nil {
t.Fatalf("Expected client perms for response permissions to be non-nil")
 }
ifc.perms.resp.MaxMsgs!=nuc.Permissions.Resp.MaxMsgs {
t.Fatalf("Expected client perms for response permissions MaxMsgs to be same as jwt: %d vs %d",
c.perms.resp.MaxMsgs, nuc.Permissions.Resp.MaxMsgs)
 }
ifc.perms.resp.Expires!=nuc.Permissions.Resp.Expires {
t.Fatalf("Expected client perms for response permissions Expires to be same as jwt: %v vs %v",
c.perms.resp.Expires, nuc.Permissions.Resp.Expires)
 }
}

funcTestJWTUserResponsePermissionClaimsDefaultValues(t*testing.T) {
nuc:=newJWTTestUserClaims()
nuc.Permissions.Resp=&jwt.ResponsePermission{}
s, c, _:=setupJWTTestWithUserClaims(t, nuc, "+OK")
defers.Shutdown()
deferc.close()

// Now check client to make sure permissions transferred
// and defaults are set.
c.mu.Lock()
deferc.mu.Unlock()

ifc.perms==nil {
t.Fatalf("Expected client permissions to be set")
 }
ifc.perms.pub.allow==nil {
t.Fatalf("Expected client perms for pub allow to be non-nil")
 }
iflpa:=c.perms.pub.allow.Count(); lpa!=0 {
t.Fatalf("Expected 0 publish allow subjects, got %d", lpa)
 }
ifc.perms.resp==nil {
t.Fatalf("Expected client perms for response permissions to be non-nil")
 }
ifc.perms.resp.MaxMsgs!=DEFAULT_ALLOW_RESPONSE_MAX_MSGS {
t.Fatalf("Expected client perms for response permissions MaxMsgs to be default %v, got %v",
DEFAULT_ALLOW_RESPONSE_MAX_MSGS, c.perms.resp.MaxMsgs)
 }
ifc.perms.resp.Expires!=DEFAULT_ALLOW_RESPONSE_EXPIRATION {
t.Fatalf("Expected client perms for response permissions Expires to be default %v, got %v",
DEFAULT_ALLOW_RESPONSE_EXPIRATION, c.perms.resp.Expires)
 }
}

funcTestJWTUserResponsePermissionClaimsNegativeValues(t*testing.T) {
nuc:=newJWTTestUserClaims()
nuc.Permissions.Resp=&jwt.ResponsePermission{
MaxMsgs: -1,
Expires: -1*time.Second,
 }
s, c, _:=setupJWTTestWithUserClaims(t, nuc, "+OK")
defers.Shutdown()
deferc.close()

// Now check client to make sure permissions transferred
// and negative values are transferred.
c.mu.Lock()
deferc.mu.Unlock()

ifc.perms==nil {
t.Fatalf("Expected client permissions to be set")
 }
ifc.perms.pub.allow==nil {
t.Fatalf("Expected client perms for pub allow to be non-nil")
 }
iflpa:=c.perms.pub.allow.Count(); lpa!=0 {
t.Fatalf("Expected 0 publish allow subjects, got %d", lpa)
 }
ifc.perms.resp==nil {
t.Fatalf("Expected client perms for response permissions to be non-nil")
 }
ifc.perms.resp.MaxMsgs!=-1 {
t.Fatalf("Expected client perms for response permissions MaxMsgs to be %v, got %v",
-1, c.perms.resp.MaxMsgs)
 }
ifc.perms.resp.Expires!=-1*time.Second {
t.Fatalf("Expected client perms for response permissions Expires to be %v, got %v",
-1*time.Second, c.perms.resp.Expires)
 }
}

funcTestJWTAccountExpired(t*testing.T) {
nac:=newJWTTestAccountClaims()
nac.IssuedAt=time.Now().Add(-10*time.Second).Unix()
nac.Expires=time.Now().Add(-2*time.Second).Unix()
s, _, c, _:=setupJWTTestWitAccountClaims(t, nac, "-ERR ")
defers.Shutdown()
deferc.close()
}

funcTestJWTAccountExpiresAfterConnect(t*testing.T) {
nac:=newJWTTestAccountClaims()
now:=time.Now()
nac.IssuedAt=now.Add(-10*time.Second).Unix()
nac.Expires=now.Round(time.Second).Add(time.Second).Unix()
s, akp, c, cr:=setupJWTTestWitAccountClaims(t, nac, "+OK")
defers.Shutdown()
deferc.close()

apub, _:=akp.PublicKey()
acc, err:=s.LookupAccount(apub)
ifacc==nil||err!=nil {
t.Fatalf("Expected to retrieve the account")
 }

ifl, _:=cr.ReadString('\n'); !strings.HasPrefix(l, "PONG") {
t.Fatalf("Expected PONG, got %q", l)
 }

// Wait for the account to be expired.
checkFor(t, 3*time.Second, 100*time.Millisecond, func() error {
ifacc.IsExpired() {
returnnil
 }
returnfmt.Errorf("Account not expired yet")
 })

l, _:=cr.ReadString('\n')
if!strings.HasPrefix(l, "-ERR ") {
t.Fatalf("Expected an error, got %q", l)
 }
if!strings.Contains(l, "Expired") {
t.Fatalf("Expected 'Expired' to be in the error")
 }

// Now make sure that accounts that have expired return an error.
c, cr, cs:=createClient(t, s, akp)
deferc.close()
c.parseAsync(cs)
l, _=cr.ReadString('\n')
if!strings.HasPrefix(l, "-ERR ") {
t.Fatalf("Expected an error")
 }
}

funcTestJWTAccountRenew(t*testing.T) {
nac:=newJWTTestAccountClaims()
// Create an account that has expired.
nac.IssuedAt=time.Now().Add(-10*time.Second).Unix()
nac.Expires=time.Now().Add(-2*time.Second).Unix()
// Expect an error
s, akp, c, _:=setupJWTTestWitAccountClaims(t, nac, "-ERR ")
defers.Shutdown()
deferc.close()

okp, _:=nkeys.FromSeed(oSeed)
apub, _:=akp.PublicKey()

// Now update with new expiration
nac.IssuedAt=time.Now().Unix()
nac.Expires=time.Now().Add(5*time.Second).Unix()
ajwt, err:=nac.Encode(okp)
iferr!=nil {
t.Fatalf("Error generating account JWT: %v", err)
 }

// Update the account
addAccountToMemResolver(s, apub, ajwt)
acc, _:=s.LookupAccount(apub)
ifacc==nil {
t.Fatalf("Expected to retrieve the account")
 }
s.UpdateAccountClaims(acc, nac)

// Now make sure we can connect.
c, cr, cs:=createClient(t, s, akp)
deferc.close()
c.parseAsync(cs)
ifl, _:=cr.ReadString('\n'); !strings.HasPrefix(l, "PONG") {
t.Fatalf("Expected a PONG, got: %q", l)
 }
}

funcTestJWTAccountRenewFromResolver(t*testing.T) {
s:=opTrustBasicSetup()
defers.Shutdown()
buildMemAccResolver(s)

okp, _:=nkeys.FromSeed(oSeed)

akp, _:=nkeys.CreateAccount()
apub, _:=akp.PublicKey()
nac:=jwt.NewAccountClaims(apub)
nac.IssuedAt=time.Now().Add(-10*time.Second).Unix()
nac.Expires=time.Now().Add(time.Second).Unix()
ajwt, err:=nac.Encode(okp)
iferr!=nil {
t.Fatalf("Error generating account JWT: %v", err)
 }

addAccountToMemResolver(s, apub, ajwt)
// Force it to be loaded by the server and start the expiration timer.
acc, _:=s.LookupAccount(apub)
ifacc==nil {
t.Fatalf("Could not retrieve account for %q", apub)
 }

// Create a new user
c, cr, cs:=createClient(t, s, akp)
deferc.close()
// Wait for expiration.
time.Sleep(1250*time.Millisecond)

c.parseAsync(cs)
l, _:=cr.ReadString('\n')
if!strings.HasPrefix(l, "-ERR ") {
t.Fatalf("Expected an error")
 }

// Now update with new expiration
nac.IssuedAt=time.Now().Unix()
nac.Expires=time.Now().Add(5*time.Second).Unix()
ajwt, err=nac.Encode(okp)
iferr!=nil {
t.Fatalf("Error generating account JWT: %v", err)
 }

// Update the account
addAccountToMemResolver(s, apub, ajwt)
// Make sure the too quick update suppression does not bite us.
acc.mu.Lock()
acc.updated=time.Now().UTC().Add(-1*time.Hour)
acc.mu.Unlock()

// Do not update the account directly. The resolver should
// happen automatically.

// Now make sure we can connect.
c, cr, cs=createClient(t, s, akp)
deferc.close()
c.parseAsync(cs)
l, _=cr.ReadString('\n')
if!strings.HasPrefix(l, "PONG") {
t.Fatalf("Expected a PONG, got: %q", l)
 }
}

funcTestJWTAccountBasicImportExport(t*testing.T) {
s:=opTrustBasicSetup()
defers.Shutdown()
buildMemAccResolver(s)

okp, _:=nkeys.FromSeed(oSeed)

// Create accounts and imports/exports.
fooKP, _:=nkeys.CreateAccount()
fooPub, _:=fooKP.PublicKey()
fooAC:=jwt.NewAccountClaims(fooPub)

// Now create Exports.
streamExport:=&jwt.Export{Subject: "foo", Type: jwt.Stream}
streamExport2:=&jwt.Export{Subject: "private", Type: jwt.Stream, TokenReq: true}
serviceExport:=&jwt.Export{Subject: "req.echo", Type: jwt.Service, TokenReq: true}
serviceExport2:=&jwt.Export{Subject: "req.add", Type: jwt.Service, TokenReq: true}

fooAC.Exports.Add(streamExport, streamExport2, serviceExport, serviceExport2)
fooJWT, err:=fooAC.Encode(okp)
iferr!=nil {
t.Fatalf("Error generating account JWT: %v", err)
 }

addAccountToMemResolver(s, fooPub, fooJWT)

acc, _:=s.LookupAccount(fooPub)
ifacc==nil {
t.Fatalf("Expected to retrieve the account")
 }

// Check to make sure exports transferred over.
ifles:=len(acc.exports.streams); les!=2 {
t.Fatalf("Expected exports streams len of 2, got %d", les)
 }
ifles:=len(acc.exports.services); les!=2 {
t.Fatalf("Expected exports services len of 2, got %d", les)
 }
_, ok:=acc.exports.streams["foo"]
if!ok {
t.Fatalf("Expected to map a stream export")
 }
se, ok:=acc.exports.services["req.echo"]
if!ok||se==nil {
t.Fatalf("Expected to map a service export")
 }
if!se.tokenReq {
t.Fatalf("Expected the service export to require tokens")
 }

barKP, _:=nkeys.CreateAccount()
barPub, _:=barKP.PublicKey()
barAC:=jwt.NewAccountClaims(barPub)

streamImport:=&jwt.Import{Account: fooPub, Subject: "foo", To: "import.foo", Type: jwt.Stream}
serviceImport:=&jwt.Import{Account: fooPub, Subject: "req.echo", Type: jwt.Service}
barAC.Imports.Add(streamImport, serviceImport)
barJWT, err:=barAC.Encode(okp)
iferr!=nil {
t.Fatalf("Error generating account JWT: %v", err)
 }
addAccountToMemResolver(s, barPub, barJWT)

acc, _=s.LookupAccount(barPub)
ifacc==nil {
t.Fatalf("Expected to retrieve the account")
 }
ifles:=len(acc.imports.streams); les!=1 {
t.Fatalf("Expected imports streams len of 1, got %d", les)
 }
// Our service import should have failed without a token.
ifles:=len(acc.imports.services); les!=0 {
t.Fatalf("Expected imports services len of 0, got %d", les)
 }

// Now add in a bad activation token.
barAC=jwt.NewAccountClaims(barPub)
serviceImport=&jwt.Import{Account: fooPub, Subject: "req.echo", Token: "not a token", Type: jwt.Service}
barAC.Imports.Add(serviceImport)
barJWT, err=barAC.Encode(okp)
iferr!=nil {
t.Fatalf("Error generating account JWT: %v", err)
 }
addAccountToMemResolver(s, barPub, barJWT)

s.UpdateAccountClaims(acc, barAC)

// Our service import should have failed with a bad token.
ifles:=len(acc.imports.services); les!=0 {
t.Fatalf("Expected imports services len of 0, got %d", les)
 }

// Now make a correct one.
barAC=jwt.NewAccountClaims(barPub)
serviceImport=&jwt.Import{Account: fooPub, Subject: "req.echo", Type: jwt.Service}

activation:=jwt.NewActivationClaims(barPub)
activation.ImportSubject="req.echo"
activation.ImportType=jwt.Service
actJWT, err:=activation.Encode(fooKP)
iferr!=nil {
t.Fatalf("Error generating activation token: %v", err)
 }
serviceImport.Token=actJWT
barAC.Imports.Add(serviceImport)
barJWT, err=barAC.Encode(okp)
iferr!=nil {
t.Fatalf("Error generating account JWT: %v", err)
 }

vr:= jwt.ValidationResults{}
barAC.Validate(&vr)
ifvr.IsBlocking(true) {
t.Fatalf("Error generating account JWT: %v", vr)
 }

addAccountToMemResolver(s, barPub, barJWT)
s.UpdateAccountClaims(acc, barAC)
// Our service import should have succeeded.
ifles:=len(acc.imports.services); les!=1 {
t.Fatalf("Expected imports services len of 1, got %d", les)
 }

// Now streams
barAC=jwt.NewAccountClaims(barPub)
streamImport=&jwt.Import{Account: fooPub, Subject: "private", To: "import.private", Type: jwt.Stream}

barAC.Imports.Add(streamImport)
barJWT, err=barAC.Encode(okp)
iferr!=nil {
t.Fatalf("Error generating account JWT: %v", err)
 }
addAccountToMemResolver(s, barPub, barJWT)
s.UpdateAccountClaims(acc, barAC)
// Our stream import should have not succeeded.
ifles:=len(acc.imports.streams); les!=0 {
t.Fatalf("Expected imports services len of 0, got %d", les)
 }

// Now add in activation.
barAC=jwt.NewAccountClaims(barPub)
streamImport=&jwt.Import{Account: fooPub, Subject: "private", To: "import.private", Type: jwt.Stream}

activation=jwt.NewActivationClaims(barPub)
activation.ImportSubject="private"
activation.ImportType=jwt.Stream
actJWT, err=activation.Encode(fooKP)
iferr!=nil {
t.Fatalf("Error generating activation token: %v", err)
 }
streamImport.Token=actJWT
barAC.Imports.Add(streamImport)
barJWT, err=barAC.Encode(okp)
iferr!=nil {
t.Fatalf("Error generating account JWT: %v", err)
 }
addAccountToMemResolver(s, barPub, barJWT)
s.UpdateAccountClaims(acc, barAC)
// Our stream import should have not succeeded.
ifles:=len(acc.imports.streams); les!=1 {
t.Fatalf("Expected imports services len of 1, got %d", les)
 }
}

funcTestJWTAccountExportWithResponseType(t*testing.T) {
s:=opTrustBasicSetup()
defers.Shutdown()
buildMemAccResolver(s)

okp, _:=nkeys.FromSeed(oSeed)

// Create accounts and imports/exports.
fooKP, _:=nkeys.CreateAccount()
fooPub, _:=fooKP.PublicKey()
fooAC:=jwt.NewAccountClaims(fooPub)

// Now create Exports.
serviceStreamExport:=&jwt.Export{Subject: "test.stream", Type: jwt.Service, ResponseType: jwt.ResponseTypeStream, TokenReq: false}
serviceChunkExport:=&jwt.Export{Subject: "test.chunk", Type: jwt.Service, ResponseType: jwt.ResponseTypeChunked, TokenReq: false}
serviceSingletonExport:=&jwt.Export{Subject: "test.single", Type: jwt.Service, ResponseType: jwt.ResponseTypeSingleton, TokenReq: true}
serviceDefExport:=&jwt.Export{Subject: "test.def", Type: jwt.Service, TokenReq: true}
serviceOldExport:=&jwt.Export{Subject: "test.old", Type: jwt.Service, TokenReq: false}

fooAC.Exports.Add(serviceStreamExport, serviceSingletonExport, serviceChunkExport, serviceDefExport, serviceOldExport)
fooJWT, err:=fooAC.Encode(okp)
iferr!=nil {
t.Fatalf("Error generating account JWT: %v", err)
 }

addAccountToMemResolver(s, fooPub, fooJWT)

fooAcc, _:=s.LookupAccount(fooPub)
iffooAcc==nil {
t.Fatalf("Expected to retrieve the account")
 }

services:=fooAcc.exports.services

iflen(services) !=5 {
t.Fatalf("Expected 4 services")
 }

se, ok:=services["test.stream"]
if!ok||se==nil {
t.Fatalf("Expected to map a service export")
 }
ifse.tokenReq {
t.Fatalf("Expected the service export to not require tokens")
 }
ifse.respType!=Streamed {
t.Fatalf("Expected the service export to respond with a stream")
 }

se, ok=services["test.chunk"]
if!ok||se==nil {
t.Fatalf("Expected to map a service export")
 }
ifse.tokenReq {
t.Fatalf("Expected the service export to not require tokens")
 }
ifse.respType!=Chunked {
t.Fatalf("Expected the service export to respond with a stream")
 }

se, ok=services["test.def"]
if!ok||se==nil {
t.Fatalf("Expected to map a service export")
 }
if!se.tokenReq {
t.Fatalf("Expected the service export to not require tokens")
 }
ifse.respType!=Singleton {
t.Fatalf("Expected the service export to respond with a stream")
 }

se, ok=services["test.single"]
if!ok||se==nil {
t.Fatalf("Expected to map a service export")
 }
if!se.tokenReq {
t.Fatalf("Expected the service export to not require tokens")
 }
ifse.respType!=Singleton {
t.Fatalf("Expected the service export to respond with a stream")
 }

se, ok=services["test.old"]
if!ok||se==nil||len(se.approved) >0 {
t.Fatalf("Service with a singleton response and no tokens should not be nil and have no approvals")
 }
}

funcexpectPong(t*testing.T, cr*bufio.Reader) {
t.Helper()
l, _:=cr.ReadString('\n')
if!strings.HasPrefix(l, "PONG") {
t.Fatalf("Expected a PONG, got %q", l)
 }
}

funcexpectMsg(t*testing.T, cr*bufio.Reader, sub, payloadstring) {
t.Helper()
l, _:=cr.ReadString('\n')
expected:="MSG "+sub
if!strings.HasPrefix(l, expected) {
t.Fatalf("Expected %q, got %q", expected, l)
 }
l, _=cr.ReadString('\n')
ifl!=payload+"\r\n" {
t.Fatalf("Expected %q, got %q", payload, l)
 }
expectPong(t, cr)
}

funcTestJWTAccountImportExportUpdates(t*testing.T) {
s:=opTrustBasicSetup()
defers.Shutdown()
buildMemAccResolver(s)

okp, _:=nkeys.FromSeed(oSeed)

// Create accounts and imports/exports.
fooKP, _:=nkeys.CreateAccount()
fooPub, _:=fooKP.PublicKey()
fooAC:=jwt.NewAccountClaims(fooPub)
streamExport:=&jwt.Export{Subject: "foo", Type: jwt.Stream}

fooAC.Exports.Add(streamExport)
fooJWT, err:=fooAC.Encode(okp)
iferr!=nil {
t.Fatalf("Error generating account JWT: %v", err)
 }
addAccountToMemResolver(s, fooPub, fooJWT)

barKP, _:=nkeys.CreateAccount()
barPub, _:=barKP.PublicKey()
barAC:=jwt.NewAccountClaims(barPub)
streamImport:=&jwt.Import{Account: fooPub, Subject: "foo", To: "import", Type: jwt.Stream}

barAC.Imports.Add(streamImport)
barJWT, err:=barAC.Encode(okp)
iferr!=nil {
t.Fatalf("Error generating account JWT: %v", err)
 }
addAccountToMemResolver(s, barPub, barJWT)

// Create a client.
c, cr, cs:=createClient(t, s, barKP)
deferc.close()

c.parseAsync(cs)
expectPong(t, cr)

c.parseAsync("SUB import.foo 1\r\nPING\r\n")
expectPong(t, cr)

checkShadow:=func(expectedint) {
t.Helper()
c.mu.Lock()
deferc.mu.Unlock()
sub:=c.subs["1"]
ifls:=len(sub.shadow); ls!=expected {
t.Fatalf("Expected shadows to be %d, got %d", expected, ls)
 }
 }

// We created a SUB on foo which should create a shadow subscription.
checkShadow(1)

// Now update bar and remove the import which should make the shadow go away.
barAC=jwt.NewAccountClaims(barPub)
barJWT, _=barAC.Encode(okp)
addAccountToMemResolver(s, barPub, barJWT)
acc, _:=s.LookupAccount(barPub)
s.UpdateAccountClaims(acc, barAC)

checkShadow(0)

// Now add it back and make sure the shadow comes back.
streamImport=&jwt.Import{Account: string(fooPub), Subject: "foo", To: "import", Type: jwt.Stream}
barAC.Imports.Add(streamImport)
barJWT, _=barAC.Encode(okp)
addAccountToMemResolver(s, barPub, barJWT)
s.UpdateAccountClaims(acc, barAC)

checkShadow(1)

// Now change export and make sure it goes away as well. So no exports anymore.
fooAC=jwt.NewAccountClaims(fooPub)
fooJWT, _=fooAC.Encode(okp)
addAccountToMemResolver(s, fooPub, fooJWT)
acc, _=s.LookupAccount(fooPub)
s.UpdateAccountClaims(acc, fooAC)
checkShadow(0)

// Now add it in but with permission required.
streamExport=&jwt.Export{Subject: "foo", Type: jwt.Stream, TokenReq: true}
fooAC.Exports.Add(streamExport)
fooJWT, _=fooAC.Encode(okp)
addAccountToMemResolver(s, fooPub, fooJWT)
s.UpdateAccountClaims(acc, fooAC)

checkShadow(0)

// Now put it back as normal.
fooAC=jwt.NewAccountClaims(fooPub)
streamExport=&jwt.Export{Subject: "foo", Type: jwt.Stream}
fooAC.Exports.Add(streamExport)
fooJWT, _=fooAC.Encode(okp)
addAccountToMemResolver(s, fooPub, fooJWT)
s.UpdateAccountClaims(acc, fooAC)