[
{"fn": "signJwt", "name": "a typical access token's claims", "args": [{"sub": "42", "name": "Ada Lovelace", "iat": 1790424000, "exp": 1790427600, "jti": "c3VwZXItdW5pcXVl", "ver": 1}, [97, 45, 115, 116, 114, 105, 110, 103, 45, 115, 101, 99, 114, 101, 116, 45, 97, 116, 45, 108, 101, 97, 115, 116, 45, 50, 53, 54, 45, 98, 105, 116, 115, 45, 108, 111, 110, 103]], "expect": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3OTA0Mjc2MDAsImlhdCI6MTc5MDQyNDAwMCwianRpIjoiYzNWd1pYSXRkVzVwY1hWbCIsIm5hbWUiOiJBZGEgTG92ZWxhY2UiLCJzdWIiOiI0MiIsInZlciI6MX0.Ohi2VySpSMFwlM-7lTI51a2O-0PfhwjlVb5jmoS5yeU"},
{"fn": "signJwt", "name": "keys given in any order are written sorted, so equal claims make equal tokens", "args": [{"z": 1, "a": 2, "m": 3}, [97, 45, 115, 116, 114, 105, 110, 103, 45, 115, 101, 99, 114, 101, 116, 45, 97, 116, 45, 108, 101, 97, 115, 116, 45, 50, 53, 54, 45, 98, 105, 116, 115, 45, 108, 111, 110, 103]], "expect": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhIjoyLCJtIjozLCJ6IjoxfQ.2d-Ui9ktahBOXMUFlTIJz8Qj9znIFP5P2B8_L_zT3d0"},
{"fn": "signJwt", "name": "an empty claims object", "args": [{}, [97, 45, 115, 116, 114, 105, 110, 103, 45, 115, 101, 99, 114, 101, 116, 45, 97, 116, 45, 108, 101, 97, 115, 116, 45, 50, 53, 54, 45, 98, 105, 116, 115, 45, 108, 111, 110, 103]], "expect": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.e30.8VKCTiBegJPuPIZlp0wbV0Sbdn5BS6TE5DCx6oYNc5o"},
{"fn": "signJwt", "name": "nested objects and arrays, sorted at every level", "args": [{"roles": ["admin", "user"], "profile": {"theme": "dark", "lang": "en"}, "active": true, "deleted": null}, [97, 45, 115, 116, 114, 105, 110, 103, 45, 115, 101, 99, 114, 101, 116, 45, 97, 116, 45, 108, 101, 97, 115, 116, 45, 50, 53, 54, 45, 98, 105, 116, 115, 45, 108, 111, 110, 103]], "expect": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhY3RpdmUiOnRydWUsImRlbGV0ZWQiOm51bGwsInByb2ZpbGUiOnsibGFuZyI6ImVuIiwidGhlbWUiOiJkYXJrIn0sInJvbGVzIjpbImFkbWluIiwidXNlciJdfQ.4fLvEPiIqWWX2bOzUYV4mRkGgBXE5JOChEo8Ve8ZHss"},
{"fn": "signJwt", "name": "non-ASCII is written as UTF-8, not \\u escapes", "args": [{"name": "Zoë Łukasz 日本"}, [97, 45, 115, 116, 114, 105, 110, 103, 45, 115, 101, 99, 114, 101, 116, 45, 97, 116, 45, 108, 101, 97, 115, 116, 45, 50, 53, 54, 45, 98, 105, 116, 115, 45, 108, 111, 110, 103]], "expect": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoiWm_DqyDFgXVrYXN6IOaXpeacrCJ9.iTNgXXEa7vzonTGJwFoDU9FeF39moGS4sOxy4vtfQvY"},
{"fn": "signJwt", "name": "quotes, backslashes and control characters are escaped the JSON way", "args": [{"note": "say \"hi\"\\\n\t\u0001"}, [97, 45, 115, 116, 114, 105, 110, 103, 45, 115, 101, 99, 114, 101, 116, 45, 97, 116, 45, 108, 101, 97, 115, 116, 45, 50, 53, 54, 45, 98, 105, 116, 115, 45, 108, 111, 110, 103]], "expect": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJub3RlIjoic2F5IFwiaGlcIlxcXG5cdFx1MDAwMSJ9.0facH1f7Xt_3FZvr7KfVCvJhnGlzvayMbBrIk9UUN2o"},
{"fn": "signJwt", "name": "keys sort by code point: U+FF01 before an emoji, which UTF-16 order gets backwards", "args": [{"😀": 1, "！": 2}, [97, 45, 115, 116, 114, 105, 110, 103, 45, 115, 101, 99, 114, 101, 116, 45, 97, 116, 45, 108, 101, 97, 115, 116, 45, 50, 53, 54, 45, 98, 105, 116, 115, 45, 108, 111, 110, 103]], "expect": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyLvvIEiOjIsIvCfmIAiOjF9.Y3s5mOsOg8DcrEgACfh9lcX3WJQ1k1jJNxA_GqDoV0Q"},
{"fn": "signJwt", "name": "the RFC 7515 key signs the RFC's claims to a different, canonical token", "args": [{"iss": "joe", "exp": 1300819380, "http://example.com/is_root": true}, [3, 35, 53, 75, 43, 15, 165, 188, 131, 126, 6, 101, 119, 123, 166, 143, 90, 179, 40, 230, 240, 84, 201, 40, 169, 15, 132, 178, 210, 80, 46, 191, 211, 251, 90, 146, 210, 6, 71, 239, 150, 138, 180, 195, 119, 98, 61, 34, 61, 46, 33, 114, 5, 46, 79, 8, 192, 205, 154, 245, 103, 208, 128, 163]], "expect": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjEzMDA4MTkzODAsImh0dHA6Ly9leGFtcGxlLmNvbS9pc19yb290Ijp0cnVlLCJpc3MiOiJqb2UifQ.tu77b1J0ZCHMDd3tWZm36iolxZtBRaArSrtayOBDO34"},
{"fn": "signJwt", "name": "negative and zero numbers", "args": [{"a": -5, "b": 0}, [97, 45, 115, 116, 114, 105, 110, 103, 45, 115, 101, 99, 114, 101, 116, 45, 97, 116, 45, 108, 101, 97, 115, 116, 45, 50, 53, 54, 45, 98, 105, 116, 115, 45, 108, 111, 110, 103]], "expect": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhIjotNSwiYiI6MH0.F2dwrxljP90TApwtxG2T4ArY1T2xO0NOyN8UWpXCtKg"},
{"fn": "signJwt", "name": "a secret shorter than 32 bytes is refused", "args": [{"sub": "1"}, [116, 111, 111, 45, 115, 104, 111, 114, 116, 45, 115, 101, 99, 114, 101, 116]], "expectError": "secret must be at least 32 bytes (RFC 7518 section 3.2), received 16"},
{"fn": "signJwt", "name": "claims must be an object, not a list", "args": [[1, 2], [97, 45, 115, 116, 114, 105, 110, 103, 45, 115, 101, 99, 114, 101, 116, 45, 97, 116, 45, 108, 101, 97, 115, 116, 45, 50, 53, 54, 45, 98, 105, 116, 115, 45, 108, 111, 110, 103]], "expectError": "claims must be a JSON object"},
{"fn": "signJwt", "name": "a fractional number", "args": [{"exp": 1790427600.5}, [97, 45, 115, 116, 114, 105, 110, 103, 45, 115, 101, 99, 114, 101, 116, 45, 97, 116, 45, 108, 101, 97, 115, 116, 45, 50, 53, 54, 45, 98, 105, 116, 115, 45, 108, 111, 110, 103]], "expectError": "claims may only hold whole numbers"},
{"fn": "signJwt", "name": "an integer beyond 2^53, which JavaScript cannot hold exactly", "args": [{"id": 9007199254740993}, [97, 45, 115, 116, 114, 105, 110, 103, 45, 115, 101, 99, 114, 101, 116, 45, 97, 116, 45, 108, 101, 97, 115, 116, 45, 50, 53, 54, 45, 98, 105, 116, 115, 45, 108, 111, 110, 103]], "expectError": "claims may only hold whole numbers"},
{"fn": "signJwt", "name": "a secret byte out of range", "args": [{"a": 1}, [256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256]], "expectError": "secret must be a list of integers from 0 to 255"},
{"fn": "verifyJwt", "name": "RFC 7515 appendix A.1: the example token, one second before exp", "args": ["eyJ0eXAiOiJKV1QiLA0KICJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGFtcGxlLmNvbS9pc19yb290Ijp0cnVlfQ.dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk", [3, 35, 53, 75, 43, 15, 165, 188, 131, 126, 6, 101, 119, 123, 166, 143, 90, 179, 40, 230, 240, 84, 201, 40, 169, 15, 132, 178, 210, 80, 46, 191, 211, 251, 90, 146, 210, 6, 71, 239, 150, 138, 180, 195, 119, 98, 61, 34, 61, 46, 33, 114, 5, 46, 79, 8, 192, 205, 154, 245, 103, 208, 128, 163], 1300819379, 0], "expect": {"valid": true, "claims": {"iss": "joe", "exp": 1300819380, "http://example.com/is_root": true}, "error": null, "message": null}},
{"fn": "verifyJwt", "name": "RFC 7515 appendix A.1: at exp exactly the token has expired (now must be before exp)", "args": ["eyJ0eXAiOiJKV1QiLA0KICJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGFtcGxlLmNvbS9pc19yb290Ijp0cnVlfQ.dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk", [3, 35, 53, 75, 43, 15, 165, 188, 131, 126, 6, 101, 119, 123, 166, 143, 90, 179, 40, 230, 240, 84, 201, 40, 169, 15, 132, 178, 210, 80, 46, 191, 211, 251, 90, 146, 210, 6, 71, 239, 150, 138, 180, 195, 119, 98, 61, 34, 61, 46, 33, 114, 5, 46, 79, 8, 192, 205, 154, 245, 103, 208, 128, 163], 1300819380, 0], "expect": {"valid": false, "claims": null, "error": "token_expired", "message": "the token has expired"}},
{"fn": "verifyJwt", "name": "RFC 7515 appendix A.1: 60 seconds of leeway still accepts it at exp + 59", "args": ["eyJ0eXAiOiJKV1QiLA0KICJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGFtcGxlLmNvbS9pc19yb290Ijp0cnVlfQ.dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk", [3, 35, 53, 75, 43, 15, 165, 188, 131, 126, 6, 101, 119, 123, 166, 143, 90, 179, 40, 230, 240, 84, 201, 40, 169, 15, 132, 178, 210, 80, 46, 191, 211, 251, 90, 146, 210, 6, 71, 239, 150, 138, 180, 195, 119, 98, 61, 34, 61, 46, 33, 114, 5, 46, 79, 8, 192, 205, 154, 245, 103, 208, 128, 163], 1300819439, 60], "expect": {"valid": true, "claims": {"iss": "joe", "exp": 1300819380, "http://example.com/is_root": true}, "error": null, "message": null}},
{"fn": "verifyJwt", "name": "RFC 7515 appendix A.1: under the wrong key the signature does not match", "args": ["eyJ0eXAiOiJKV1QiLA0KICJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGFtcGxlLmNvbS9pc19yb290Ijp0cnVlfQ.dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk", [97, 45, 115, 116, 114, 105, 110, 103, 45, 115, 101, 99, 114, 101, 116, 45, 97, 116, 45, 108, 101, 97, 115, 116, 45, 50, 53, 54, 45, 98, 105, 116, 115, 45, 108, 111, 110, 103], 1300819379, 0], "expect": {"valid": false, "claims": null, "error": "invalid_signature", "message": "the token's signature does not match"}},
{"fn": "verifyJwt", "name": "a token signJwt made, halfway through its hour", "args": ["eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3OTA0Mjc2MDAsImlhdCI6MTc5MDQyNDAwMCwianRpIjoiYzNWd1pYSXRkVzVwY1hWbCIsIm5hbWUiOiJBZGEgTG92ZWxhY2UiLCJzdWIiOiI0MiIsInZlciI6MX0.Ohi2VySpSMFwlM-7lTI51a2O-0PfhwjlVb5jmoS5yeU", [97, 45, 115, 116, 114, 105, 110, 103, 45, 115, 101, 99, 114, 101, 116, 45, 97, 116, 45, 108, 101, 97, 115, 116, 45, 50, 53, 54, 45, 98, 105, 116, 115, 45, 108, 111, 110, 103], 1790425800, 30], "expect": {"valid": true, "claims": {"sub": "42", "name": "Ada Lovelace", "iat": 1790424000, "exp": 1790427600, "jti": "c3VwZXItdW5pcXVl", "ver": 1}, "error": null, "message": null}},
{"fn": "verifyJwt", "name": "claims changed after signing (sub 42 made 1) fail the signature", "args": ["eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3OTA0Mjc2MDAsImlhdCI6MTc5MDQyNDAwMCwianRpIjoiYzNWd1pYSXRkVzVwY1hWbCIsIm5hbWUiOiJBZGEgTG92ZWxhY2UiLCJzdWIiOiIxIiwidmVyIjoxfQ.Ohi2VySpSMFwlM-7lTI51a2O-0PfhwjlVb5jmoS5yeU", [97, 45, 115, 116, 114, 105, 110, 103, 45, 115, 101, 99, 114, 101, 116, 45, 97, 116, 45, 108, 101, 97, 115, 116, 45, 50, 53, 54, 45, 98, 105, 116, 115, 45, 108, 111, 110, 103], 1790425800, 30], "expect": {"valid": false, "claims": null, "error": "invalid_signature", "message": "the token's signature does not match"}},
{"fn": "verifyJwt", "name": "alg none with no signature is refused before any key is used", "args": ["eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJleHAiOjE3OTA0Mjc2MDAsImlhdCI6MTc5MDQyNDAwMCwianRpIjoiYzNWd1pYSXRkVzVwY1hWbCIsIm5hbWUiOiJBZGEgTG92ZWxhY2UiLCJzdWIiOiI0MiIsInZlciI6MX0.", [97, 45, 115, 116, 114, 105, 110, 103, 45, 115, 101, 99, 114, 101, 116, 45, 97, 116, 45, 108, 101, 97, 115, 116, 45, 50, 53, 54, 45, 98, 105, 116, 115, 45, 108, 111, 110, 103], 1790425800, 30], "expect": {"valid": false, "claims": null, "error": "unsupported_algorithm", "message": "only HS256 tokens are accepted"}},
{"fn": "verifyJwt", "name": "an RS256 header is refused, whatever the signature", "args": ["eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3OTA0Mjc2MDAsImlhdCI6MTc5MDQyNDAwMCwianRpIjoiYzNWd1pYSXRkVzVwY1hWbCIsIm5hbWUiOiJBZGEgTG92ZWxhY2UiLCJzdWIiOiI0MiIsInZlciI6MX0.fOeyYKCyW3E8wRE4J5QMTw_AU8YgAZBWct5wAFUI7TM", [97, 45, 115, 116, 114, 105, 110, 103, 45, 115, 101, 99, 114, 101, 116, 45, 97, 116, 45, 108, 101, 97, 115, 116, 45, 50, 53, 54, 45, 98, 105, 116, 115, 45, 108, 111, 110, 103], 1790425800, 30], "expect": {"valid": false, "claims": null, "error": "unsupported_algorithm", "message": "only HS256 tokens are accepted"}},
{"fn": "verifyJwt", "name": "a crit header naming extensions this verifier does not know", "args": ["eyJhbGciOiJIUzI1NiIsImNyaXQiOlsiZXhwIl19.eyJleHAiOjE3OTA0Mjc2MDAsImlhdCI6MTc5MDQyNDAwMCwianRpIjoiYzNWd1pYSXRkVzVwY1hWbCIsIm5hbWUiOiJBZGEgTG92ZWxhY2UiLCJzdWIiOiI0MiIsInZlciI6MX0.wk9mcrUmQbhPSIysjD3XNdAKDCk-iQqx3vpLxPYB2U0", [97, 45, 115, 116, 114, 105, 110, 103, 45, 115, 101, 99, 114, 101, 116, 45, 97, 116, 45, 108, 101, 97, 115, 116, 45, 50, 53, 54, 45, 98, 105, 116, 115, 45, 108, 111, 110, 103], 1790425800, 30], "expect": {"valid": false, "claims": null, "error": "unsupported_algorithm", "message": "the token requires header extensions (crit) this verifier does not support"}},
{"fn": "verifyJwt", "name": "nbf in the future beyond the leeway", "args": ["eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYmYiOjE3OTA0MjYwMDAsInN1YiI6IjQyIn0.iv6Duh1mux_SO9e9idddbgeIJZpp1brgaBmgJWgKFHk", [97, 45, 115, 116, 114, 105, 110, 103, 45, 115, 101, 99, 114, 101, 116, 45, 97, 116, 45, 108, 101, 97, 115, 116, 45, 50, 53, 54, 45, 98, 105, 116, 115, 45, 108, 111, 110, 103], 1790425800, 30], "expect": {"valid": false, "claims": null, "error": "token_not_yet_valid", "message": "the token is not valid yet"}},
{"fn": "verifyJwt", "name": "nbf in the future but within the leeway", "args": ["eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYmYiOjE3OTA0MjU4MjAsInN1YiI6IjQyIn0.0SnbadIZHfgVQvAskhVMs5VYJxgCIVMvRvGjZWn6R6U", [97, 45, 115, 116, 114, 105, 110, 103, 45, 115, 101, 99, 114, 101, 116, 45, 97, 116, 45, 108, 101, 97, 115, 116, 45, 50, 53, 54, 45, 98, 105, 116, 115, 45, 108, 111, 110, 103], 1790425800, 30], "expect": {"valid": true, "claims": {"sub": "42", "nbf": 1790425820}, "error": null, "message": null}},
{"fn": "verifyJwt", "name": "iat in the future beyond the leeway", "args": ["eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3OTA0MjYwMDAsInN1YiI6IjQyIn0.qGztfRKO451NyNWZ2MjSGgKVkbB5vPDURwY_J4rbxaw", [97, 45, 115, 116, 114, 105, 110, 103, 45, 115, 101, 99, 114, 101, 116, 45, 97, 116, 45, 108, 101, 97, 115, 116, 45, 50, 53, 54, 45, 98, 105, 116, 115, 45, 108, 111, 110, 103], 1790425800, 30], "expect": {"valid": false, "claims": null, "error": "token_issued_in_future", "message": "the token was issued in the future"}},
{"fn": "verifyJwt", "name": "exp as a string is not a NumericDate", "args": ["eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOiIxNzkwNDI3NjAwIiwic3ViIjoiNDIifQ.OYcP5eZGvaHjXOXC9u_luKmy2P0Ga8Qwf3DpVbu4YQ0", [97, 45, 115, 116, 114, 105, 110, 103, 45, 115, 101, 99, 114, 101, 116, 45, 97, 116, 45, 108, 101, 97, 115, 116, 45, 50, 53, 54, 45, 98, 105, 116, 115, 45, 108, 111, 110, 103], 1790425800, 30], "expect": {"valid": false, "claims": null, "error": "invalid_claims", "message": "the token's exp claim is not a number"}},
{"fn": "verifyJwt", "name": "only two parts", "args": ["eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3OTA0Mjc2MDAsImlhdCI6MTc5MDQyNDAwMCwianRpIjoiYzNWd1pYSXRkVzVwY1hWbCIsIm5hbWUiOiJBZGEgTG92ZWxhY2UiLCJzdWIiOiI0MiIsInZlciI6MX0", [97, 45, 115, 116, 114, 105, 110, 103, 45, 115, 101, 99, 114, 101, 116, 45, 97, 116, 45, 108, 101, 97, 115, 116, 45, 50, 53, 54, 45, 98, 105, 116, 115, 45, 108, 111, 110, 103], 1790425800, 30], "expect": {"valid": false, "claims": null, "error": "malformed_token", "message": "the token is not a well-formed JWT"}},
{"fn": "verifyJwt", "name": "the empty string", "args": ["", [97, 45, 115, 116, 114, 105, 110, 103, 45, 115, 101, 99, 114, 101, 116, 45, 97, 116, 45, 108, 101, 97, 115, 116, 45, 50, 53, 54, 45, 98, 105, 116, 115, 45, 108, 111, 110, 103], 1790425800, 30], "expect": {"valid": false, "claims": null, "error": "malformed_token", "message": "the token is not a well-formed JWT"}},
{"fn": "verifyJwt", "name": "a payload that is JSON but not an object", "args": ["eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.WzEsMiwzXQ.awvlufPKfBwu7aTZYEZMDJ6ryhHw48sgLbPzQcBTFwU", [97, 45, 115, 116, 114, 105, 110, 103, 45, 115, 101, 99, 114, 101, 116, 45, 97, 116, 45, 108, 101, 97, 115, 116, 45, 50, 53, 54, 45, 98, 105, 116, 115, 45, 108, 111, 110, 103], 1790425800, 30], "expect": {"valid": false, "claims": null, "error": "malformed_token", "message": "the token is not a well-formed JWT"}},
{"fn": "verifyJwt", "name": "base64 padding in a segment is not the compact form", "args": ["eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3OTA0Mjc2MDAsImlhdCI6MTc5MDQyNDAwMCwianRpIjoiYzNWd1pYSXRkVzVwY1hWbCIsIm5hbWUiOiJBZGEgTG92ZWxhY2UiLCJzdWIiOiI0MiIsInZlciI6MX0.Ohi2VySpSMFwlM-7lTI51a2O-0PfhwjlVb5jmoS5yeU=", [97, 45, 115, 116, 114, 105, 110, 103, 45, 115, 101, 99, 114, 101, 116, 45, 97, 116, 45, 108, 101, 97, 115, 116, 45, 50, 53, 54, 45, 98, 105, 116, 115, 45, 108, 111, 110, 103], 1790425800, 30], "expect": {"valid": false, "claims": null, "error": "malformed_token", "message": "the token is not a well-formed JWT"}},
{"fn": "verifyJwt", "name": "a payload that is not UTF-8", "args": ["eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhIjoi_yJ9.Ohi2VySpSMFwlM-7lTI51a2O-0PfhwjlVb5jmoS5yeU", [97, 45, 115, 116, 114, 105, 110, 103, 45, 115, 101, 99, 114, 101, 116, 45, 97, 116, 45, 108, 101, 97, 115, 116, 45, 50, 53, 54, 45, 98, 105, 116, 115, 45, 108, 111, 110, 103], 1790425800, 30], "expect": {"valid": false, "claims": null, "error": "malformed_token", "message": "the token is not a well-formed JWT"}},
{"fn": "verifyJwt", "name": "NaN in the payload, which Python's parser would otherwise accept", "args": ["eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOk5hTn0.Z3VEeJ4ChV9SwwVk9QRNNuHKucV7V2MeeGcLjD7QlPw", [97, 45, 115, 116, 114, 105, 110, 103, 45, 115, 101, 99, 114, 101, 116, 45, 97, 116, 45, 108, 101, 97, 115, 116, 45, 50, 53, 54, 45, 98, 105, 116, 115, 45, 108, 111, 110, 103], 1790425800, 30], "expect": {"valid": false, "claims": null, "error": "malformed_token", "message": "the token is not a well-formed JWT"}},
{"fn": "verifyJwt", "name": "a secret shorter than 32 bytes is the caller's error, not a token answer", "args": ["eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3OTA0Mjc2MDAsImlhdCI6MTc5MDQyNDAwMCwianRpIjoiYzNWd1pYSXRkVzVwY1hWbCIsIm5hbWUiOiJBZGEgTG92ZWxhY2UiLCJzdWIiOiI0MiIsInZlciI6MX0.Ohi2VySpSMFwlM-7lTI51a2O-0PfhwjlVb5jmoS5yeU", [115, 104, 111, 114, 116], 1790425800, 30], "expectError": "secret must be at least 32 bytes (RFC 7518 section 3.2), received 5"},
{"fn": "verifyJwt", "name": "negative leeway", "args": ["eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3OTA0Mjc2MDAsImlhdCI6MTc5MDQyNDAwMCwianRpIjoiYzNWd1pYSXRkVzVwY1hWbCIsIm5hbWUiOiJBZGEgTG92ZWxhY2UiLCJzdWIiOiI0MiIsInZlciI6MX0.Ohi2VySpSMFwlM-7lTI51a2O-0PfhwjlVb5jmoS5yeU", [97, 45, 115, 116, 114, 105, 110, 103, 45, 115, 101, 99, 114, 101, 116, 45, 97, 116, 45, 108, 101, 97, 115, 116, 45, 50, 53, 54, 45, 98, 105, 116, 115, 45, 108, 111, 110, 103], 1790425800, -1], "expectError": "leewaySeconds must be a whole number, 0 or more"},
{"fn": "verifyJwt", "name": "now given in fractional seconds", "args": ["eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3OTA0Mjc2MDAsImlhdCI6MTc5MDQyNDAwMCwianRpIjoiYzNWd1pYSXRkVzVwY1hWbCIsIm5hbWUiOiJBZGEgTG92ZWxhY2UiLCJzdWIiOiI0MiIsInZlciI6MX0.Ohi2VySpSMFwlM-7lTI51a2O-0PfhwjlVb5jmoS5yeU", [97, 45, 115, 116, 114, 105, 110, 103, 45, 115, 101, 99, 114, 101, 116, 45, 97, 116, 45, 108, 101, 97, 115, 116, 45, 50, 53, 54, 45, 98, 105, 116, 115, 45, 108, 111, 110, 103], 1790425800.5, 30], "expectError": "now must be a whole number of Unix seconds"},
{"fn": "decodeJwt", "name": "RFC 7515 appendix A.1: the example token's claims", "args": ["eyJ0eXAiOiJKV1QiLA0KICJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGFtcGxlLmNvbS9pc19yb290Ijp0cnVlfQ.dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk"], "expect": {"iss": "joe", "exp": 1300819380, "http://example.com/is_root": true}},
{"fn": "decodeJwt", "name": "a token signJwt made", "args": ["eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3OTA0Mjc2MDAsImlhdCI6MTc5MDQyNDAwMCwianRpIjoiYzNWd1pYSXRkVzVwY1hWbCIsIm5hbWUiOiJBZGEgTG92ZWxhY2UiLCJzdWIiOiI0MiIsInZlciI6MX0.Ohi2VySpSMFwlM-7lTI51a2O-0PfhwjlVb5jmoS5yeU"], "expect": {"sub": "42", "name": "Ada Lovelace", "iat": 1790424000, "exp": 1790427600, "jti": "c3VwZXItdW5pcXVl", "ver": 1}},
{"fn": "decodeJwt", "name": "the signature is not checked: tampered claims still decode", "args": ["eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3OTA0Mjc2MDAsImlhdCI6MTc5MDQyNDAwMCwianRpIjoiYzNWd1pYSXRkVzVwY1hWbCIsIm5hbWUiOiJBZGEgTG92ZWxhY2UiLCJzdWIiOiIxIiwidmVyIjoxfQ.Ohi2VySpSMFwlM-7lTI51a2O-0PfhwjlVb5jmoS5yeU"], "expect": {"sub": "1", "name": "Ada Lovelace", "iat": 1790424000, "exp": 1790427600, "jti": "c3VwZXItdW5pcXVl", "ver": 1}},
{"fn": "decodeJwt", "name": "an alg none token decodes (and verifyJwt would refuse it)", "args": ["eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJleHAiOjE3OTA0Mjc2MDAsImlhdCI6MTc5MDQyNDAwMCwianRpIjoiYzNWd1pYSXRkVzVwY1hWbCIsIm5hbWUiOiJBZGEgTG92ZWxhY2UiLCJzdWIiOiI0MiIsInZlciI6MX0."], "expect": {"sub": "42", "name": "Ada Lovelace", "iat": 1790424000, "exp": 1790427600, "jti": "c3VwZXItdW5pcXVl", "ver": 1}},
{"fn": "decodeJwt", "name": "an expired token still decodes; reading exp is the point", "args": ["eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjF9.kM3H33Lrr02vuN2nyW3tLvAeOhxBDnjRcdmnSsE3stM"], "expect": {"exp": 1}},
{"fn": "decodeJwt", "name": "not a JWT at all", "args": ["hello"], "expect": null},
{"fn": "decodeJwt", "name": "the empty string", "args": [""], "expect": null},
{"fn": "decodeJwt", "name": "four parts", "args": ["eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3OTA0Mjc2MDAsImlhdCI6MTc5MDQyNDAwMCwianRpIjoiYzNWd1pYSXRkVzVwY1hWbCIsIm5hbWUiOiJBZGEgTG92ZWxhY2UiLCJzdWIiOiI0MiIsInZlciI6MX0.Ohi2VySpSMFwlM-7lTI51a2O-0PfhwjlVb5jmoS5yeU.x"], "expect": null},
{"fn": "decodeJwt", "name": "a header that is not JSON", "args": ["bm90IGpzb24.eyJleHAiOjE3OTA0Mjc2MDAsImlhdCI6MTc5MDQyNDAwMCwianRpIjoiYzNWd1pYSXRkVzVwY1hWbCIsIm5hbWUiOiJBZGEgTG92ZWxhY2UiLCJzdWIiOiI0MiIsInZlciI6MX0.Ohi2VySpSMFwlM-7lTI51a2O-0PfhwjlVb5jmoS5yeU"], "expect": null},
{"fn": "decodeJwt", "name": "a payload that is a JSON string, not an object", "args": ["eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.ImhlbGxvIg.xlSnpdTxzJP-c6aHtil6OidO18-O1_dnQGbk9JlHDUw"], "expect": null},
{"fn": "decodeJwt", "name": "an integer beyond 2^53 is refused, since JavaScript would round it", "args": ["eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6OTAwNzE5OTI1NDc0MDk5M30.wnSgywnzmbeCIbzKicr_mYOSWTR6c1tibW2tPZU1SLc"], "expect": null},
{"fn": "decodeJwt", "name": "an escaped lone surrogate is refused", "args": ["eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoiXHVkODAwIn0.NbmV3UAJ6BUq9zpwOTy6lPV1YFGXZhgkSGggtfVQHxE"], "expect": null},
{"fn": "decodeJwt", "name": "an escaped surrogate pair is one character", "args": ["eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoiXHVkODNkXHVkZTAwIn0.lbtCXl2nVVxdtXDvCaPTzf2kGfd_x0_dIJLFBGXEh60"], "expect": {"name": "😀"}},
{"fn": "decodeJwt", "name": "the canonical form of the same small token decodes", "args": ["eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhIjoxfQ.pHz1uz9qdaLadovi6pLeKPvCegaT6WHF2YnrA-eT7qw"], "expect": {"a": 1}},
{"fn": "decodeJwt", "name": "non-canonical base64url: the payload's last character carries non-zero spare bits (a lenient decoder reads the same claims)", "args": ["eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhIjoxfR.pHz1uz9qdaLadovi6pLeKPvCegaT6WHF2YnrA-eT7qw"], "expect": null},
{"fn": "decodeJwt", "name": "32 levels of nesting are accepted", "args": ["eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhIjp7ImEiOnsiYSI6eyJhIjp7ImEiOnsiYSI6eyJhIjp7ImEiOnsiYSI6eyJhIjp7ImEiOnsiYSI6eyJhIjp7ImEiOnsiYSI6eyJhIjp7ImEiOnsiYSI6eyJhIjp7ImEiOnsiYSI6eyJhIjp7ImEiOnsiYSI6eyJhIjp7ImEiOnsiYSI6eyJhIjp7ImEiOnsiYSI6eyJhIjp7fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX0.P28AKRVzBNnJz0iipR72i5oznUIA9jiREfmE4xx9I5U"], "expect": {"a": {"a": {"a": {"a": {"a": {"a": {"a": {"a": {"a": {"a": {"a": {"a": {"a": {"a": {"a": {"a": {"a": {"a": {"a": {"a": {"a": {"a": {"a": {"a": {"a": {"a": {"a": {"a": {"a": {"a": {"a": {}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}},
{"fn": "decodeJwt", "name": "33 levels of nesting are refused", "args": ["eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhIjp7ImEiOnsiYSI6eyJhIjp7ImEiOnsiYSI6eyJhIjp7ImEiOnsiYSI6eyJhIjp7ImEiOnsiYSI6eyJhIjp7ImEiOnsiYSI6eyJhIjp7ImEiOnsiYSI6eyJhIjp7ImEiOnsiYSI6eyJhIjp7ImEiOnsiYSI6eyJhIjp7ImEiOnsiYSI6eyJhIjp7ImEiOnsiYSI6eyJhIjp7ImEiOnsiYSI6MX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fQ.EVW24kCI1kgbpDKJQYaoa_eo0G_o07jdjohuS0eLW9M"], "expect": null},
{"fn": "decodeJwt", "name": "duplicate keys: the last value wins, as in JavaScript and Python", "args": ["eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhIjoxLCJhIjoyfQ.N4pPAo5By0BC3mh_2DkTecjzkZxl4nZ9cuzyxtuJqwI"], "expect": {"a": 2}}
]