feat: Keycloak jose 验签中间件（requireAuth/requireRealmRole/requireService）＋本地签发测试

test/support/token.ts

@@ -0,0 +1,42 @@
+import { SignJWT, exportJWK, generateKeyPair } from 'jose';
+import type { GenerateKeyPairResult } from 'jose';
+
+export interface TestIdentity {
+  sub?: string;
+  username?: string;
+  roles?: string[];
+  groups?: string[];
+  azp?: string;
+  aud?: string | string[];
+  expiresIn?: number; // 秒；负数＝已过期
+}
+
+let keys: GenerateKeyPairResult | null = null;
+
+/** 生成本地密钥对并写入 KEYCLOAK_TEST_JWKS（必须先于首次 verify 调用） */
+export async function setupTestJwks(): Promise<void> {
+  if (keys) return;
+  keys = await generateKeyPair('RS256');
+  const jwk = await exportJWK(keys.publicKey);
+  process.env.KEYCLOAK_TEST_JWKS = JSON.stringify({ keys: [{ ...jwk, alg: 'RS256', kid: 'test-key' }] });
+}
+
+export async function makeToken(id: TestIdentity = {}): Promise<string> {
+  await setupTestJwks();
+  const issuer = `${process.env.KEYCLOAK_URL}/realms/${process.env.KEYCLOAK_REALM}`;
+  const clientId = process.env.KEYCLOAK_CLIENT_ID ?? '';
+  if (!keys) throw new Error('test keys not ready');
+  return new SignJWT({
+    preferred_username: id.username ?? 'tester',
+    realm_access: { roles: id.roles ?? ['user'] },
+    groups: id.groups ?? [],
+    azp: id.azp ?? 'web-portal',
+  })
+    .setProtectedHeader({ alg: 'RS256', kid: 'test-key' })
+    .setSubject(id.sub ?? 'test-sub-1')
+    .setIssuer(issuer)
+    .setAudience(id.aud ?? clientId)
+    .setIssuedAt()
+    .setExpirationTime(Math.floor(Date.now() / 1000) + (id.expiresIn ?? 300))
+    .sign(keys.privateKey);
+}