test(06-14): regression coverage for surf and bouncer gap closure

bouncer/jwt_test.go

@@ -252,3 +252,43 @@ func TestVerifyRejectsFractionalSubject(t *testing.T) {
 		t.Fatalf("whole sub: %q %v", sub, err)
 	}
 }
+
+func TestVerifySubjectMatrix(t *testing.T) {
+	exp := time.Now().Add(time.Hour).Unix()
+	cases := []struct {
+		name string
+		sub  any
+		want string
+	}{
+		{"fractional", 12.5, ""},
+		{"huge float", 1e300, ""},
+		{"2^60 float", float64(1 << 60), ""},
+		{"negative", -1, ""},
+		{"zero", 0, ""},
+		{"whole number", 12, "12"},
+		{"string", "12", "12"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			tok := sign(t, jwt.SigningMethodHS256, jwt.MapClaims{"sub": tc.sub, "exp": exp}, []byte(secret))
+			sub, err := Verify(tok, secret)
+			if tc.want == "" {
+				if err == nil || sub != "" {
+					t.Fatalf("sub %v accepted: %q", tc.sub, sub)
+				}
+				return
+			}
+			if err != nil || sub != tc.want {
+				t.Fatalf("sub %v: %q %v", tc.sub, sub, err)
+			}
+		})
+	}
+}
+
+func TestSubjectJSONNumber(t *testing.T) {
+	for in, want := range map[string]string{"1.5": "", "-3": "", "0": "", "12": "12"} {
+		if got := subject(jwt.MapClaims{"sub": json.Number(in)}); got != want {
+			t.Errorf("json.Number(%q) = %q, want %q", in, got, want)
+		}
+	}
+}