m-lab / locate / 1651

push

travis-pro

feat: improve support for local testing (#230)

* feat(auth): add multi-backend JWT verification

Implement three JWT verification modes:
- ESPv1 (production default, with defense-in-depth)
- Direct (JWKS validation for integration testing)
- Insecure (dev/test only, requires ALLOW_INSECURE_JWT=true)

Enables deployment without ESP and simplifies local testing.

* fix: extract remote IP address correctly when running locally

* Use flagx.URL and url.URL instead of strings + simplify verifiers

* fix: use mlab1-lga0t in the example heartbeat command

mlab2-lga1t has 0.5 probability in siteinfo, annoying for local testing.

* Add scripts/create-dev-jwt.sh

* Support externally-provided JWT tokens in heartbeat client

* Update script

* update DEVELOPMENT.md with the new local testing flow.

* update jwt verifiers

* Address code review comments

* Fix XFF vulnerability

* Update DEVELOPMENT.md

* Do not log twice.

* simplify espv1 ExtractClaims

* update insecure.go

* Split jwtverifier package tests into 3 files

* Add TODO in handler.go

188 of 232 new or added lines in 7 files covered. (81.03%)

2249 of 2463 relevant lines covered (91.31%)

1.02 hits per line