mirror of
https://github.com/dredx/prole.git
synced 2026-09-27 07:14:29 +00:00
57886f9268
- Copy pg-knoe-auth/ wholesale from upstream/knoe-db/20260523 (Task 1 of docs/plans/junie/upstream-knoe-db-20260523-integration.md). - Extension: PG18 OAUTHBEARER JWT validator using libcurl + OpenSSL RS256. - knoe-db/Dockerfile: add libcurl4-openssl-dev to dev deps; COPY src/ and build with make USE_PGXS=1 install after tds_fdw. - NOT enabled in the default database build (absent from 20_create_extensions.sh). To enable: CREATE EXTENSION pg_knoe_auth; (requires pg_hba.conf oauth_issuer). Closes Task 1 of upstream-knoe-db-20260523-integration.md.
16 lines
803 B
SQL
16 lines
803 B
SQL
-- right_aud_array: verify pg_knoe_auth accepts a token with aud as a JSON array
|
|
-- containing the expected audience value.
|
|
--
|
|
-- This is the positive counterpart to wrong_aud_array.sql.
|
|
-- The token is issued by mock_jwks.py /token/right_aud_array with
|
|
-- "aud": ["pg.0.knoe.dev"] — the array form of the correct audience.
|
|
--
|
|
-- This test catches the §2.2.4-FIX bug: before the fix, json_get_string
|
|
-- returned NULL for array-form aud, causing valid tokens to be rejected.
|
|
--
|
|
-- Full end-to-end test requires the test harness to attempt a connection
|
|
-- with the token from mock_jwks.py /token/right_aud_array and verify
|
|
-- the connection is accepted.
|
|
-- This SQL file validates the server-side GUC state is correct.
|
|
SELECT 'right_aud_array' AS test_case, 'requires_harness_connection_test' AS note;
|