Skip to content

Removing @ignore and running #919

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
utkrishtsahu merged 4 commits into from
Feb 26, 2026
Merged

Removing @ignore and running #919

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
222f6a2
Removing @ignore and running
utkrishtsahu Feb 26, 2026
f6446f6
Fix CI failure: avoid RSA key operations that crash under Conscrypt
utkrishtsahu Feb 26, 2026
b6dd38c
removing comments
utkrishtsahu Feb 26, 2026
e2ed040
Fix NPE in SignatureVerifier when JWKS key is not found
utkrishtsahu Feb 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions auth0/src/main/java/com/auth0/android/provider/SignatureVerifier.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,6 +57,10 @@ static void forAsymmetricAlgorithm(@Nullable final String keyId, @NonNull Authen
@Override
public void onSuccess(@Nullable Map<String, PublicKey> result) {
PublicKey publicKey = result.get(keyId);
if (publicKey == null) {
callback.onFailure(new PublicKeyNotFoundException(keyId));
return;
}
Comment on lines 58 to +63
Copy link

Copilot AI Feb 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

onSuccess receives a @Nullable Map<String, PublicKey> result, but the code dereferences result.get(keyId) without a null check. If the request ever calls onSuccess(null), this will throw a NullPointerException instead of failing with a TokenValidationException. Add a result == null guard (and treat it the same as a missing key) before calling get.

Copilot uses AI. Check for mistakes.
try {
callback.onSuccess(new AsymmetricSignatureVerifier(publicKey));
} catch (InvalidKeyException e) {
Expand Down
13 changes: 3 additions & 10 deletions auth0/src/test/java/com/auth0/android/provider/WebAuthProviderTest.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,6 @@ import org.mockito.Mock
import org.mockito.Mockito
import org.mockito.Mockito.`when`
import org.mockito.MockitoAnnotations
import org.junit.Ignore
import org.robolectric.Robolectric
import org.robolectric.RobolectricTestRunner
import org.robolectric.annotation.Config
Expand Down Expand Up @@ -1539,7 +1538,6 @@ public class WebAuthProviderTest {
}


@Ignore("Requires security provider fix - see SDK-7752")
@Test
@Throws(Exception::class)
public fun shouldFailToResumeLoginWhenRSAKeyIsMissingFromJWKSet() {
Expand All @@ -1557,9 +1555,7 @@ public class WebAuthProviderTest {
.start(activity, authCallback)
val managerInstance = WebAuthProvider.managerInstance as OAuthManager
managerInstance.currentTimeInMillis = JwtTestUtils.FIXED_CLOCK_CURRENT_TIME_MS
val jwtBody = JwtTestUtils.createJWTBody()
jwtBody["iss"] = proxyAccount.getDomainUrl()
val expectedIdToken = JwtTestUtils.createTestJWT("RS256", jwtBody)
val expectedIdToken = "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImtleTEyMyJ9.eyJzdWIiOiJ0ZXN0In0.fakesignature"
val intent = createAuthIntent(
createHash(
null,
Expand All @@ -1582,7 +1578,6 @@ public class WebAuthProviderTest {
Date(),
"codeScope"
)
// Mock JWKS response with empty keys (no matching RSA key for kid)
val emptyJwksJson = """{"keys": []}"""
val jwksInputStream: InputStream = ByteArrayInputStream(emptyJwksJson.toByteArray())
val jwksResponse = ServerResponse(200, jwksInputStream, emptyMap())
Expand Down Expand Up @@ -1679,7 +1674,6 @@ public class WebAuthProviderTest {
}


@Ignore("Requires security provider fix - see SDK-7752")
@Test
@Throws(Exception::class)
public fun shouldFailToResumeLoginWhenKeyIdIsMissingFromIdTokenHeader() {
Expand Down Expand Up @@ -1721,9 +1715,8 @@ public class WebAuthProviderTest {
Date(),
"codeScope"
)
// Mock JWKS response with valid keys
val encoded = Files.readAllBytes(Paths.get("src/test/resources/rsa_jwks.json"))
val jwksInputStream: InputStream = ByteArrayInputStream(encoded)
val emptyJwksJson = """{"keys": []}"""
val jwksInputStream: InputStream = ByteArrayInputStream(emptyJwksJson.toByteArray())
val jwksResponse = ServerResponse(200, jwksInputStream, emptyMap())
Comment on lines +1718 to 1720
Copy link

Copilot AI Feb 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

After removing the file-based JWKS loading, the java.nio.file.Files / java.nio.file.Paths imports at the top of this test file appear to be unused. If lint/ktlint is enabled, this can fail the build; remove those imports.

Copilot uses AI. Check for mistakes.
Copy link
Contributor

@pmathew92 pmathew92 Feb 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Remove unwanted imports

Mockito.doReturn(jwksResponse).`when`(networkingClient).load(
eq(proxyAccount.getDomainUrl() + ".well-known/jwks.json"),
Expand Down
Loading