admin auth and service helpers in SDK (#1059)

- `net/http` server middleware for "atproto admin auth" (which is just
Basic auth with user "admin), supporting multiple passwords for
operational flexibility (eg, new relay could use this)
- inter-service auth validation, including `net/http` middleware. fairly
complete and correct, though might have some performance issues
(purging/retrying identity resolution; and parsing keys on every
request)

The service auth code is loosely inspired by code in Discover (which is
not open source), which has been running in prod a long time now. For
example the test cases. But that code caches parsed keys much more
aggressively (with an in-process LRU).

There are some TODOs in here about XRPC error responses (aka, reply with
JSON). I'm not sure if we want to manage that here in middleware library
code, or leave it to service error handler to fill in.

The logic around LXM validation/enforcement could also use review, both
of the code and against the atproto XRPC specs.

Note that this package intentionally does not use "XRPC" in
method/variable names, as we are slowly deprecating that terminology.

atproto/auth/http.go

···
+package auth
+
+import (
+	"context"
+	"crypto/subtle"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strings"
+
+	"github.com/bluesky-social/indigo/atproto/syntax"
+)
+
+// HTTP Middleware for atproto admin auth, which is HTTP Basic auth with the username "admin".
+//
+// This supports multiple admin passwords, which makes it easier to rotate service secrets.
+//
+// This can be used with `echo.WrapMiddleware` (part of the echo web framework)
+func AdminAuthMiddleware(handler http.HandlerFunc, adminPasswords []string) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		username, password, ok := r.BasicAuth()
+		if ok && username == "admin" {
+			for _, pw := range adminPasswords {
+				if subtle.ConstantTimeCompare([]byte(pw), []byte(password)) == 1 {
+					handler(w, r)
+					return
+				}
+			}
+		}
+		w.Header().Set("WWW-Authenticate", `Basic realm="admin", charset="UTF-8"`)
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusUnauthorized)
+		json.NewEncoder(w).Encode(map[string]string{
+			"error":   "Unauthorized",
+			"message": "atproto admin auth required, but missing or incorrect password",
+		})
+	}
+}
+
+// HTTP Middleware for inter-service auth, which is HTTP Bearer with JWT.
+//
+// 'mandatory' indicates whether valid inter-service auth must be present, or just optional.
+func (v *ServiceAuthValidator) Middleware(handler http.HandlerFunc, mandatory bool) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+
+		if hdr := r.Header.Get("Authorization"); hdr != "" {
+			parts := strings.Split(hdr, " ")
+			if parts[0] != "Bearer" || len(parts) != 2 {
+				w.Header().Set("WWW-Authenticate", "Bearer")
+				w.Header().Set("Content-Type", "application/json")
+				w.WriteHeader(http.StatusUnauthorized)
+				json.NewEncoder(w).Encode(map[string]string{
+					"error":   "Unauthorized",
+					"message": "atproto service auth required, but missing or incorrect formatting",
+				})
+				return
+			}
+
+			var lxm *syntax.NSID
+			uparts := strings.Split(r.URL.Path, "/")
+			// TODO: should this "fail closed"? eg, reject if not a valid XRPC endpoint
+			if len(uparts) >= 3 && uparts[1] == "xrpc" {
+				nsid, err := syntax.ParseNSID(uparts[2])
+				if nil == err {
+					lxm = &nsid
+				}
+			}
+
+			did, err := v.Validate(r.Context(), parts[1], lxm)
+			if err != nil {
+				w.Header().Set("WWW-Authenticate", "Bearer")
+				w.Header().Set("Content-Type", "application/json")
+				w.WriteHeader(http.StatusUnauthorized)
+				json.NewEncoder(w).Encode(map[string]string{
+					"error":   "Unauthorized",
+					"message": fmt.Sprintf("invalid service auth: %s", err),
+				})
+				return
+			}
+			ctx := context.WithValue(r.Context(), "did", did)
+			handler(w, r.WithContext(ctx))
+			return
+		}
+
+		if mandatory {
+			w.Header().Set("WWW-Authenticate", "Bearer")
+			w.Header().Set("Content-Type", "application/json")
+			w.WriteHeader(http.StatusUnauthorized)
+			json.NewEncoder(w).Encode(map[string]string{
+				"error":   "Unauthorized",
+				"message": "atproto service auth required",
+			})
+			return
+		}
+		handler(w, r)
+	}
+}

atproto/auth/http_test.go

···
+package auth
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/bluesky-social/indigo/atproto/crypto"
+	"github.com/bluesky-social/indigo/atproto/identity"
+	"github.com/bluesky-social/indigo/atproto/syntax"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func webHome(w http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
+
+	w.WriteHeader(http.StatusOK)
+	did, ok := ctx.Value("did").(syntax.DID)
+	if ok {
+		w.Write([]byte(did.String()))
+	} else {
+		w.Write([]byte("hello world"))
+	}
+}
+
+func TestAdminAuthMiddleware(t *testing.T) {
+	assert := assert.New(t)
+
+	pw1 := "secret123"
+	pw2 := "secret789"
+
+	req := httptest.NewRequest(http.MethodGet, "/", nil)
+	middle := AdminAuthMiddleware(webHome, []string{pw1, pw2})
+
+	{
+		resp := httptest.NewRecorder()
+		middle(resp, req)
+		assert.Equal(http.StatusUnauthorized, resp.Code)
+	}
+
+	{
+		resp := httptest.NewRecorder()
+		req.SetBasicAuth("admin", pw1)
+		middle(resp, req)
+		assert.Equal(http.StatusOK, resp.Code)
+	}
+
+	{
+		resp := httptest.NewRecorder()
+		req.SetBasicAuth("admin", pw2)
+		middle(resp, req)
+		assert.Equal(http.StatusOK, resp.Code)
+	}
+
+	{
+		resp := httptest.NewRecorder()
+		req.SetBasicAuth("wrong", pw2)
+		middle(resp, req)
+		assert.Equal(http.StatusUnauthorized, resp.Code)
+	}
+
+	{
+		resp := httptest.NewRecorder()
+		req.SetBasicAuth("admin", "wrong")
+		middle(resp, req)
+		assert.Equal(http.StatusUnauthorized, resp.Code)
+	}
+}
+
+func TestServiceAuthMiddleware(t *testing.T) {
+	assert := assert.New(t)
+	require := require.New(t)
+
+	iss := syntax.DID("did:example:iss")
+	aud := "did:example:aud#svc"
+	lxm := syntax.NSID("com.example.api")
+
+	priv, err := crypto.GeneratePrivateKeyP256()
+	require.NoError(err)
+	pub, err := priv.PublicKey()
+	require.NoError(err)
+
+	dir := identity.NewMockDirectory()
+	dir.Insert(identity.Identity{
+		DID: iss,
+		Keys: map[string]identity.Key{
+			"atproto": identity.Key{
+				Type:               "Multikey",
+				PublicKeyMultibase: pub.Multibase(),
+			},
+		},
+	})
+
+	v := ServiceAuthValidator{
+		Audience: aud,
+		Dir:      &dir,
+	}
+
+	{
+		// optional middleware, no auth
+		req := httptest.NewRequest(http.MethodGet, "/xrpc/com.example.api", nil)
+		middle := v.Middleware(webHome, false)
+		resp := httptest.NewRecorder()
+		middle(resp, req)
+		assert.Equal(http.StatusOK, resp.Code)
+		assert.Equal("hello world", string(resp.Body.Bytes()))
+	}
+
+	{
+		// mandatory middleware, no auth
+		req := httptest.NewRequest(http.MethodGet, "/xrpc/com.example.api", nil)
+		middle := v.Middleware(webHome, true)
+		resp := httptest.NewRecorder()
+		middle(resp, req)
+		assert.Equal(http.StatusUnauthorized, resp.Code)
+	}
+
+	{
+		// mandatory middleware, valid auth
+		tok, err := SignServiceAuth(iss, aud, time.Minute, &lxm, priv)
+		require.NoError(err)
+		req := httptest.NewRequest(http.MethodGet, "/xrpc/com.example.api", nil)
+		req.Header.Set("Authorization", "Bearer "+tok)
+		middle := v.Middleware(webHome, true)
+		resp := httptest.NewRecorder()
+		middle(resp, req)
+		assert.Equal(http.StatusOK, resp.Code)
+		assert.Equal(iss.String(), string(resp.Body.Bytes()))
+	}
+
+	{
+		// mangled header
+		req := httptest.NewRequest(http.MethodGet, "/xrpc/com.example.api", nil)
+		req.Header.Set("Authorization", "Bearer dummy")
+		middle := v.Middleware(webHome, false)
+		resp := httptest.NewRecorder()
+		middle(resp, req)
+		assert.Equal(http.StatusUnauthorized, resp.Code)
+	}
+
+	{
+		// wrong path
+		tok, err := SignServiceAuth(iss, aud, time.Minute, &lxm, priv)
+		require.NoError(err)
+		req := httptest.NewRequest(http.MethodGet, "/xrpc/com.example.other.api", nil)
+		req.Header.Set("Authorization", "Bearer "+tok)
+		middle := v.Middleware(webHome, true)
+		resp := httptest.NewRecorder()
+		middle(resp, req)
+		assert.Equal(http.StatusUnauthorized, resp.Code)
+	}
+}

atproto/auth/jwt.go

···
+package auth
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"log/slog"
+	"time"
+
+	"github.com/bluesky-social/indigo/atproto/crypto"
+	"github.com/bluesky-social/indigo/atproto/identity"
+	"github.com/bluesky-social/indigo/atproto/syntax"
+
+	"github.com/golang-jwt/jwt/v5"
+)
+
+// TODO: check for uniqueness of JTI (random nonce) to prevent token replay
+
+type ServiceAuthValidator struct {
+	// Service DID reference for this validator: a DID with optional #-separated fragment
+	Audience        string
+	Dir             identity.Directory
+	TimestampLeeway time.Duration
+}
+
+type serviceAuthClaims struct {
+	jwt.RegisteredClaims
+
+	LexMethod string `json:"lxm,omitempty"`
+}
+
+func (s *ServiceAuthValidator) Validate(ctx context.Context, tokenString string, lexMethod *syntax.NSID) (syntax.DID, error) {
+
+	leeway := s.TimestampLeeway
+	if leeway == 0 {
+		leeway = 5 * time.Second
+	}
+
+	opts := []jwt.ParserOption{
+		jwt.WithValidMethods(supportedAlgs),
+		jwt.WithAudience(s.Audience),
+		jwt.WithExpirationRequired(),
+		jwt.WithIssuedAt(),
+		jwt.WithLeeway(leeway),
+	}
+
+	token, err := jwt.ParseWithClaims(tokenString, &serviceAuthClaims{}, s.fetchIssuerKeyFunc(ctx), opts...)
+	if err != nil && errors.Is(err, jwt.ErrTokenSignatureInvalid) {
+		// if signature validation fails, purge the directory and try again
+		// TODO: probably need to cache or rate-limit this?
+
+		// do an unvalidated extraction of 'iss' from JWT
+		insecure := jwt.NewParser(jwt.WithoutClaimsValidation())
+		t, _, err := insecure.ParseUnverified(tokenString, &jwt.MapClaims{})
+		claims, ok := t.Claims.(*jwt.MapClaims)
+		if !ok {
+			return "", jwt.ErrTokenInvalidClaims
+		}
+		iss, err := claims.GetIssuer()
+		if err != nil {
+			return "", err
+		}
+		did, err := syntax.ParseDID(iss)
+		if err != nil {
+			return "", fmt.Errorf("%w: invalid DID: %w", jwt.ErrTokenInvalidIssuer, err)
+		}
+
+		slog.Info("purging directory and retrying service auth signature validation", "did", did)
+		err = s.Dir.Purge(ctx, did.AtIdentifier())
+		if err != nil {
+			slog.Error("purging identity directory", "did", did, "err", err)
+		}
+		token, err = jwt.ParseWithClaims(tokenString, &serviceAuthClaims{}, s.fetchIssuerKeyFunc(ctx), opts...)
+	}
+	if err != nil {
+		return "", err
+	}
+	claims, ok := token.Claims.(*serviceAuthClaims)
+	if !ok {
+		// TODO: is the error message returned descriptive enough?
+		return "", jwt.ErrTokenInvalidClaims
+	}
+
+	if lexMethod != nil && claims.LexMethod != lexMethod.String() {
+		return "", fmt.Errorf("%w: Lexicon endpoint (LXM)", jwt.ErrTokenInvalidClaims)
+	}
+
+	// NOTE: KeyFunc has already parsed issuer, so we know it is a valid DID
+	did := syntax.DID(claims.Issuer)
+	return did, nil
+}
+
+// resolves public key from identity directory
+func (s *ServiceAuthValidator) fetchIssuerKeyFunc(ctx context.Context) func(token *jwt.Token) (any, error) {
+	return func(token *jwt.Token) (any, error) {
+		claims, ok := token.Claims.(*serviceAuthClaims)
+		if !ok {
+			return nil, jwt.ErrTokenInvalidClaims
+		}
+		iss, err := claims.GetIssuer()
+		if err != nil {
+			return nil, fmt.Errorf("%w: missing 'iss' claim", jwt.ErrTokenInvalidIssuer)
+		}
+		did, err := syntax.ParseDID(iss)
+		if err != nil {
+			return nil, fmt.Errorf("%w: invalid DID: %w", jwt.ErrTokenInvalidIssuer, err)
+		}
+		// NOTE: this will do handle resolution by default
+		ident, err := s.Dir.LookupDID(ctx, did)
+		if err != nil {
+			return nil, fmt.Errorf("%w: resolving DID (%s): %w", jwt.ErrTokenInvalidIssuer, did, err)
+		}
+		return ident.PublicKey()
+	}
+}
+
+func randomNonce() string {
+	buf := make([]byte, 16)
+	rand.Read(buf)
+	return base64.RawURLEncoding.EncodeToString(buf)
+}
+
+func SignServiceAuth(iss syntax.DID, aud string, ttl time.Duration, lexMethod *syntax.NSID, priv crypto.PrivateKey) (string, error) {
+	claims := serviceAuthClaims{
+		RegisteredClaims: jwt.RegisteredClaims{
+			ExpiresAt: jwt.NewNumericDate(time.Now().Add(ttl)),
+			IssuedAt:  jwt.NewNumericDate(time.Now()),
+			Issuer:    iss.String(),
+			Audience:  []string{aud},
+			ID:        randomNonce(),
+		},
+	}
+	if lexMethod != nil {
+		claims.LexMethod = lexMethod.String()
+	}
+
+	var sm *signingMethodAtproto
+
+	// NOTE: could also have a crypto.PrivateKey.Alg() method which returns a string
+	switch priv.(type) {
+	case *crypto.PrivateKeyP256:
+		sm = signingMethodES256
+	case *crypto.PrivateKeyK256:
+		sm = signingMethodES256K
+	default:
+		return "", fmt.Errorf("unknown signing key type: %T", priv)
+	}
+
+	token := jwt.NewWithClaims(sm, claims)
+	return token.SignedString(priv)
+}

atproto/auth/jwt_signing.go

···
+package auth
+
+import (
+	"crypto"
+
+	atcrypto "github.com/bluesky-social/indigo/atproto/crypto"
+	"github.com/golang-jwt/jwt/v5"
+)
+
+var (
+	signingMethodES256K *signingMethodAtproto
+	signingMethodES256  *signingMethodAtproto
+	supportedAlgs       []string
+)
+
+// Implementation of jwt.SigningMethod for the `atproto/crypto` types.
+type signingMethodAtproto struct {
+	alg      string
+	hash     crypto.Hash
+	toOutSig toOutSig
+	sigLen   int
+}
+
+type toOutSig func(sig []byte) []byte
+
+func init() {
+	// tells JWT library to serialize 'aud' as regular string, not array of strings (when signing)
+	jwt.MarshalSingleStringAsArray = false
+
+	signingMethodES256K = &signingMethodAtproto{
+		alg:      "ES256K",
+		hash:     crypto.SHA256,
+		toOutSig: toES256K,
+		sigLen:   64,
+	}
+	jwt.RegisterSigningMethod(signingMethodES256K.Alg(), func() jwt.SigningMethod {
+		return signingMethodES256K
+	})
+	signingMethodES256 = &signingMethodAtproto{
+		alg:      "ES256",
+		hash:     crypto.SHA256,
+		toOutSig: toES256,
+		sigLen:   64,
+	}
+	jwt.RegisterSigningMethod(signingMethodES256.Alg(), func() jwt.SigningMethod {
+		return signingMethodES256
+	})
+	supportedAlgs = []string{signingMethodES256K.Alg(), signingMethodES256.Alg()}
+}
+
+func (sm *signingMethodAtproto) Verify(signingString string, sig []byte, key interface{}) error {
+	pub, ok := key.(atcrypto.PublicKey)
+	if !ok {
+		return jwt.ErrInvalidKeyType
+	}
+
+	if !sm.hash.Available() {
+		return jwt.ErrHashUnavailable
+	}
+
+	if len(sig) != sm.sigLen {
+		return jwt.ErrTokenSignatureInvalid
+	}
+
+	// NOTE: important to use using "lenient" variant here
+	return pub.HashAndVerifyLenient([]byte(signingString), sig)
+}
+
+func (sm *signingMethodAtproto) Sign(signingString string, key interface{}) ([]byte, error) {
+	priv, ok := key.(atcrypto.PrivateKey)
+	if !ok {
+		return nil, jwt.ErrInvalidKeyType
+	}
+
+	return priv.HashAndSign([]byte(signingString))
+}
+
+func (sm *signingMethodAtproto) Alg() string {
+	return sm.alg
+}
+
+func toES256K(sig []byte) []byte {
+	return sig[:64]
+}
+
+func toES256(sig []byte) []byte {
+	return sig[:64]
+}

atproto/auth/jwt_test.go

···
+package auth
+
+import (
+	"context"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/bluesky-social/indigo/atproto/crypto"
+	"github.com/bluesky-social/indigo/atproto/identity"
+	"github.com/bluesky-social/indigo/atproto/syntax"
+
+	"github.com/golang-jwt/jwt/v5"
+	"github.com/stretchr/testify/assert"
+)
+
+// Returns an early-2024 timestamp as a point in time for validating known JWTs (which contain expires-at)
+func testTime() time.Time {
+	return time.Date(2024, 1, 1, 0, 0, 0, 0, time.UTC)
+}
+
+func validateMinimal(token string, iss, aud string, pub crypto.PublicKey) error {
+
+	p := jwt.NewParser(
+		jwt.WithValidMethods(supportedAlgs),
+		jwt.WithTimeFunc(testTime),
+		jwt.WithIssuer(iss),
+		jwt.WithAudience(aud),
+	)
+	_, err := p.Parse(token, func(tok *jwt.Token) (any, error) {
+		return pub, nil
+	})
+	if err != nil {
+		return fmt.Errorf("failed to parse auth header JWT: %w", err)
+	}
+	return nil
+}
+
+func TestSignatureMethods(t *testing.T) {
+	assert := assert.New(t)
+
+	jwtTestFixtures := []struct {
+		name   string
+		pubkey string
+		iss    string
+		aud    string
+		jwt    string
+	}{
+		{
+			name:   "secp256k1 (K-256)",
+			pubkey: "did:key:zQ3shscXNYZQZSPwegiv7uQZZV5kzATLBRtgJhs7uRY7pfSk4",
+			iss:    "did:example:iss",
+			aud:    "did:example:aud",
+			jwt:    "eyJ0eXAiOiJKV1QiLCJhbGciOiJFUzI1NksifQ.eyJpc3MiOiJkaWQ6ZXhhbXBsZTppc3MiLCJhdWQiOiJkaWQ6ZXhhbXBsZTphdWQiLCJleHAiOjE3MTM1NzEwMTJ9.J_In_PQCMjygeeoIKyjybORD89ZnEy1bZTd--sdq_78qv3KCO9181ZAh-2Pl0qlXZjfUlxgIa6wiak2NtsT98g",
+		},
+		{
+			name:   "secp256k1 (K-256)",
+			pubkey: "did:key:zQ3shqKrpHzQ5HDfhgcYMWaFcpBK3SS39wZLdTjA5GeakX8G5",
+			iss:    "did:example:iss",
+			aud:    "did:example:aud",
+			jwt:    "eyJ0eXAiOiJKV1QiLCJhbGciOiJFUzI1NksifQ.eyJhdWQiOiJkaWQ6ZXhhbXBsZTphdWQiLCJpc3MiOiJkaWQ6ZXhhbXBsZTppc3MiLCJleHAiOjE3MTM1NzExMzJ9.itNeYcF5oFMZIGxtnbJhE4McSniv_aR-Yk1Wj8uWk1K8YjlS2fzuJMo0-fILV3payETxn6r45f0FfpTaqY0EZQ",
+		},
+		{
+			name:   "P-256",
+			pubkey: "did:key:zDnaeXRDKRCEUoYxi8ZJS2pDsgfxUh3pZiu3SES9nbY4DoART",
+			iss:    "did:example:iss",
+			aud:    "did:example:aud",
+			jwt:    "eyJ0eXAiOiJKV1QiLCJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJkaWQ6ZXhhbXBsZTppc3MiLCJhdWQiOiJkaWQ6ZXhhbXBsZTphdWQiLCJleHAiOjE3MTM1NzE1NTR9.FFRLm7SGbDUp6cL0WoCs0L5oqNkjCXB963TqbgI-KxIjbiqMQATVCalcMJx17JGTjMmfVHJP6Op_V4Z0TTjqog",
+		},
+	}
+
+	for _, fix := range jwtTestFixtures {
+
+		pubk, err := crypto.ParsePublicDIDKey(fix.pubkey)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		assert.NoError(validateMinimal(fix.jwt, fix.iss, fix.aud, pubk))
+	}
+}
+
+func testSigningValidation(t *testing.T, priv crypto.PrivateKey) {
+	assert := assert.New(t)
+	ctx := context.Background()
+
+	iss := syntax.DID("did:example:iss")
+	aud := "did:example:aud#svc"
+	lxm := syntax.NSID("com.example.api")
+
+	priv, err := crypto.GeneratePrivateKeyP256()
+	if err != nil {
+		t.Fatal(err)
+	}
+	pub, err := priv.PublicKey()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	dir := identity.NewMockDirectory()
+	dir.Insert(identity.Identity{
+		DID: iss,
+		Keys: map[string]identity.Key{
+			"atproto": identity.Key{
+				Type:               "Multikey",
+				PublicKeyMultibase: pub.Multibase(),
+			},
+		},
+	})
+
+	v := ServiceAuthValidator{
+		Audience: aud,
+		Dir:      &dir,
+	}
+
+	t1, err := SignServiceAuth(iss, aud, time.Minute, nil, priv)
+	if err != nil {
+		t.Fatal(err)
+	}
+	d1, err := v.Validate(ctx, t1, nil)
+	assert.NoError(err)
+	assert.Equal(d1, iss)
+	_, err = v.Validate(ctx, t1, &lxm)
+	assert.Error(err)
+
+	t2, err := SignServiceAuth(iss, aud, time.Minute, &lxm, priv)
+	if err != nil {
+		t.Fatal(err)
+	}
+	d2, err := v.Validate(ctx, t2, nil)
+	assert.NoError(err)
+	assert.Equal(d2, iss)
+	_, err = v.Validate(ctx, t2, &lxm)
+	assert.NoError(err)
+
+	_, err = v.Validate(ctx, t2, nil)
+	assert.NoError(err)
+	_, err = v.Validate(ctx, t2, &lxm)
+	assert.NoError(err)
+}
+
+func TestP256SigningValidation(t *testing.T) {
+	priv, err := crypto.GeneratePrivateKeyP256()
+	if err != nil {
+		t.Fatal(err)
+	}
+	testSigningValidation(t, priv)
+}
+
+func TestK256SigningValidation(t *testing.T) {
+	priv, err := crypto.GeneratePrivateKeyK256()
+	if err != nil {
+		t.Fatal(err)
+	}
+	testSigningValidation(t, priv)
+}

go.mod

···
 	github.com/go-redis/cache/v9 v9.0.0
 	github.com/gocql/gocql v1.7.0
 	github.com/golang-jwt/jwt v3.2.2+incompatible
+	github.com/golang-jwt/jwt/v5 v5.2.2
 	github.com/gorilla/websocket v1.5.1
 	github.com/hashicorp/go-retryablehttp v0.7.5
 	github.com/hashicorp/golang-lru/arc/v2 v2.0.6

go.sum

···
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/golang-jwt/jwt v3.2.2+incompatible h1:IfV12K8xAKAnZqdXVzCZ+TOjboZ2keLg81eXfW3O+oY=
 github.com/golang-jwt/jwt v3.2.2+incompatible/go.mod h1:8pz2t5EyA70fFQQSrl6XZXzqecmYZeUEB8OUGHkxJ+I=
+github.com/golang-jwt/jwt/v5 v5.2.2 h1:Rl4B7itRWVtYIHFrSNd7vhTiz9UpLdi6gZhZ3wEeDy8=
+github.com/golang-jwt/jwt/v5 v5.2.2/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
 github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=