🌟 [Major]: JWT v2 overhaul delivers a new typed, standards-aligned interface - #26
Merged
Marius Storhaug (MariusStorhaug) merged 35 commits intoAug 3, 2026
Merged
Conversation
…t, Get-Jwt*, JwtKey converters
…JWK round-trip, and algorithm-confusion coverage
… claim handling on PowerShell
Marius Storhaug (MariusStorhaug)
changed the title
Marius Storhaug (MariusStorhaug)
added
the
Major
Super-linter summary
Super-linter detected linting errors For more information, see the GitHub Actions workflow run Powered by Super-linter MARKDOWNPOWERSHELL |
…WS surface with curve-OID enforcement
Marius Storhaug (MariusStorhaug)
changed the title
This was referenced May 12, 2026
Super-linter summary
Super-linter detected linting errors For more information, see the GitHub Actions workflow run Powered by Super-linter MARKDOWNNATURAL_LANGUAGEPOWERSHELL |
Super-linter summary
Super-linter detected linting errors For more information, see the GitHub Actions workflow run Powered by Super-linter MARKDOWNNATURAL_LANGUAGEPOWERSHELL |
…, add Base64Url tests - README.md: Fix MD060 table column alignment; correct 'end to end' to 'end-to-end' - JwtPayload.ps1: Extract $autoNull variable to shorten lines below 150 chars - New-Jwt.ps1: Break long if-condition into parenthesized $shouldDispose expression - Test-Jwt.ps1: Extract $supportedAlgs array; use $allowed for dynamic error message; break long lines and fix finally-block indentation - New-JwtHmac.ps1: Suppress PSUseShouldProcessForStateChangingFunctions, PSUseOutputTypeCorrectly - Resolve-JwtKey.ps1, Test-JwtClaim.ps1, ConvertFrom-Base64UrlString.ps1, ConvertFrom-JwtKey.ps1, Get-JwtClaim.ps1: Suppress PSUseOutputTypeCorrectly (polymorphic return types) - Jwt.Tests.ps1: Suppress PSAvoidUsingConvertToSecureStringWithPlainText and PSAvoidLongLines; add Base64Url helper tests (ConvertFrom-Base64UrlString coverage)
Super-linter summary
Super-linter detected linting errors For more information, see the GitHub Actions workflow run Powered by Super-linter MARKDOWNPOWERSHELL |
…Found false positives
Super-linter summary
Super-linter detected linting errors For more information, see the GitHub Actions workflow run Powered by Super-linter MARKDOWNPOWERSHELL |
Marius Storhaug (MariusStorhaug)
changed the title
Marius Storhaug (MariusStorhaug)
changed the title
Marius Storhaug (MariusStorhaug)
changed the title
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
This was referenced Jul 26, 2026
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
## Summary Targets `feat/13-implement-jwt-module` and adds production-level edge-case coverage to the JWT v2 integration suite. While adding tests, it also fixes a regression where `New-JwtSigningKey -Algorithm HS*` returned `[object[]]` instead of `[byte[]]`, breaking `New-Jwt -GenerateKey` for HMAC algorithms. ## What changed ### Tests (`tests/Integration.Jwt.Tests.ps1`) Added a new `Production-level edge cases` context covering: - `Test-Jwt -Detailed` reports failed signature and failed claim checks. - `New-Jwt -GenerateKey` produces valid tokens for HS256, RS256, and ES256. - `ConvertFrom-Jwt` accepts a `SecureString` token. - `Test-Jwt` returns `$false` for an empty signature segment on signed algorithms. - `New-Jwt` parameter validation rejects non-hashtable payloads. - `Test-Jwt` parameter validation rejects `$null` tokens. - Verbose output does not leak payload secrets or key material. ### Bug fix (`src/functions/public/Keys/New-JwtSigningKey.ps1`) PowerShell unwraps `[byte[]]` to `[object[]]` when returned through an untyped variable. The HS* branch now returns `,$bytes` so the byte-array type is preserved, allowing `New-Jwt -Algorithm HS256 -GenerateKey` to sign and verify correctly. ### CI Bumped the reusable workflow pin to Process-PSModule v6.1.15 while preserving the explicit `TestData` mapping required by the reusable workflow's secrets interface. ## Verification ```powershell Import-Module Pester -RequiredVersion 6.0.1 -Force $config = New-PesterConfiguration $config.Run.Path = 'tests' Invoke-Pester -Configuration $config ``` Result: **123 passed, 0 failed** (1 skipped: optional Azure Key Vault test). ## Related Contributes to #26 (JWT v2 overhaul). --- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
- Remove non-existent -NoEnumerateByteArray parameter from ConvertTo-Base64UrlString call. - Use the $AccessToken parameter in Authorization headers instead of a literal placeholder. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Wrap RSA/RSASSA-PSS and ECDSA VerifyData calls in try/catch so malformed signatures return $false instead of propagating CryptographicException. This closes a timing/exception oracle that could distinguish malformed signatures from well-formed-but-invalid ones. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
…failures Test-Jwt -Detailed previously threw terminating exceptions for invalid alg values and malformed/unsupported crit headers, which prevented callers from getting the documented structured report. Failures now populate the corresponding Checks entry and return the report; the non-Detailed path continues to throw for compatibility. Adds integration tests for unsupported-algorithm and failed-crit-header -Detailed output. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
When a SecureString is supplied for an HS* algorithm, decrypt it directly to a UTF-8 byte array instead of keeping a managed plaintext string in $Key. This lets the transient string be garbage-collected sooner and keeps the symmetric key in the canonical byte[] form. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Require a recognized EC curve OID or friendly name before accepting an ECDsa key for ES256/ES384/ES512 operations. Previously a null OID value bypassed the curve check; now such keys are rejected. Also ensures the ephemeral ECDsa instance created from a PEM string is disposed if ImportFromPem fails, and ConvertTo-JwtKey rejects curves it cannot map to a supported JWK crv value. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
…message Breaks the exception message string across multiple lines so it stays under the 150-character PSScriptAnalyzer limit. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Aligns the wrapped EC-curve exception message with the project's existing multi-line argument indentation style. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Marius Storhaug (MariusStorhaug)
marked this pull request as ready for review
August 3, 2026 03:15
Marius Storhaug (MariusStorhaug)
deleted the
feat/13-implement-jwt-module
branch
August 3, 2026 03:15
|
✅ New release: PowerShell Gallery - Jwt 2.0.0 |
|
✅ New release: GitHub - Jwt 2.0.0 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Jwt v2 is a full overhaul of token creation, parsing, validation, and key handling. The user-facing interface is now type-first, standards-aligned, and designed for safer default behavior and clearer composition in automation.
Breaking Changes
The v1 JWT surface has been replaced by the v2 typed interface.
Existing integrations that depended on legacy command signatures or output shapes must migrate to the v2 command contracts.
Generated-key bundle output from
New-Jwtwas removed in favor of a stable[Jwt]return shape; key ownership/export should useNew-JwtSigningKey.New: Typed, composable JWT object model
Commands now center on typed objects (
[Jwt],[JwtHeader],[JwtPayload],[JwtKey],[JwtKeySet]) so callers can work directly with structured data instead of string-only flows.This includes stable formatting/type metadata for better terminal output and safer default key display behavior.
Changed: Safer JOSE/JWT validation behavior
Test-Jwtnow enforces JOSE critical-header (crit) semantics when present.Tokens declaring
critrequire explicit allow-listing via-AllowedCriticalHeaderand fail closed on unsupported or malformed critical declarations.No
critheader is required for normal validation flows.Changed: Clearer key-conversion behavior
ConvertFrom-JwtKeynow returns rawbyte[]forkty=octby default.When an HMAC instance is needed, callers can explicitly request it with
-AsHmac -Algorithm HS256|HS384|HS512.Changed: CI/release safety alignment
Process-PSModule workflow secret forwarding now uses explicit secret mapping instead of
secrets: inherit.Technical Details
critenforcement inTest-Jwtand addedCriticalHeadersto-Detailedchecks.New-Jwtoutput contract to[Jwt]across parameter sets.New-JwtSigningKeyand aligned examples/docs around explicit key ownership.GenerateKeyusage) and UTF-8 BOM normalization on edited PowerShell files.113tests passed).Related issues