castrum 0.9.3 → 0.9.6

package/rust/crypto/jwt/api.rs

@@ -0,0 +1,286 @@
+// rust/crypto/jwt/api.rs — napi entry points for JWT signing/verification.
+//
+// Thin napi boundary over the pure token core in `token.rs`: scalar sign/
+// verify, the precompiled-key `JwtSigner` instance, the C-ABI `_core` helpers
+// consumed by `rust/ffi.rs`, and the packed sign/verify batches.
+
+use napi::bindgen_prelude::*;
+use napi_derive::napi;
+
+use crate::crypto::base64::base64url_encode_bytes;
+
+use super::{
+    build_token, build_token_with_key, inject_and_payload_b64, inject_and_payload_b64_sonic,
+    inject_ttl_claims, jwt_header_b64, sign_eddsa, verify_token, verify_token_eddsa,
+    verify_token_with_key,
+};
+
+/// Sign a JWT (HS256). `claims` is any JSON value; when it is an object and a
+/// positive `ttlSeconds` is given, `iat`/`exp` are injected (unless present).
+/// `nowSeconds` is the caller-supplied current epoch seconds (keeps the core
+/// time-free and testable). Returns the compact token bytes.
+#[napi]
+pub fn jwt_sign(
+    claims: serde_json::Value,
+    secret: Uint8Array,
+    ttl_seconds: Option<i64>,
+    now_seconds: i64,
+) -> Result<Buffer> {
+    let mut claims = claims;
+    let payload_b64 = inject_and_payload_b64(&mut claims, ttl_seconds, now_seconds)?;
+    Ok(Buffer::from(build_token(
+        jwt_header_b64(),
+        &payload_b64,
+        secret.as_ref(),
+    )))
+}
+
+/// Sign a JWT (HS256) from pre-serialized claim JSON bytes. Avoids the napi
+/// `serde_json::Value` DOM marshal of `jwt_sign` for callers that already hold
+/// the claim bytes (e.g. JSON.stringify'd on the JS side). The claims are
+/// parsed straight into a `sonic_rs::Value` (compact, no per-key heap
+/// `String`). Semantics are identical to `jwt_sign` (incl. `iat`/`exp`
+/// injection).
+#[napi]
+pub fn jwt_sign_bytes(
+    claims_json: Uint8Array,
+    secret: Uint8Array,
+    ttl_seconds: Option<i64>,
+    now_seconds: i64,
+) -> Result<Buffer> {
+    let mut claims: sonic_rs::Value =
+        sonic_rs::from_slice(claims_json.as_ref()).map_err(napi_err)?;
+    let payload_b64 = inject_and_payload_b64_sonic(&mut claims, ttl_seconds, now_seconds)?;
+    Ok(Buffer::from(build_token(
+        jwt_header_b64(),
+        &payload_b64,
+        secret.as_ref(),
+    )))
+}
+
+/// Verify a JWT (HS256 signature + time claims). Returns the decoded claims
+/// object (marshaled from the compact sonic Value), or `null` on any failure
+/// (malformed, bad signature, wrong `alg`, expired, not-yet-valid `nbf`/`iat`,
+/// non-JSON payload).
+#[napi]
+pub fn jwt_verify(
+    env: Env,
+    token: Uint8Array,
+    secret: Uint8Array,
+    now_seconds: i64,
+) -> Result<Unknown<'static>> {
+    let Some(payload) = verify_token(token.as_ref(), secret.as_ref(), now_seconds) else {
+        return crate::json::napi_marshal::sonic_value_to_js(&env, &sonic_rs::Value::new());
+    };
+    match sonic_rs::from_slice::<sonic_rs::Value>(&payload) {
+        Ok(v) => crate::json::napi_marshal::sonic_value_to_js(&env, &v),
+        // The payload already parsed for the time-claim check — unreachable.
+        Err(_) => crate::json::napi_marshal::sonic_value_to_js(&env, &sonic_rs::Value::new()),
+    }
+}
+
+/// Sign an EdDSA (Ed25519) JWT from pre-serialized claim JSON bytes. Semantics
+/// identical to `jwt_sign_bytes` (incl. `iat`/`exp` injection); the signature
+/// is Ed25519 (RFC 8032) under the `EdDSA` alg.
+#[napi]
+pub fn jwt_sign_eddsa(
+    claims_json: Uint8Array,
+    private_key: Uint8Array,
+    ttl_seconds: Option<i64>,
+    now_seconds: i64,
+) -> Result<Buffer> {
+    match sign_eddsa(
+        claims_json.as_ref(),
+        private_key.as_ref(),
+        ttl_seconds,
+        now_seconds,
+    ) {
+        Some(token) => Ok(Buffer::from(token)),
+        None => Err(Error::from_reason(
+            "EdDSA sign failed (invalid claims or private key)",
+        )),
+    }
+}
+
+/// Verify an EdDSA (Ed25519) JWT (signature + time claims). Returns the decoded
+/// claims object, or `null` on any failure.
+#[napi]
+pub fn jwt_verify_eddsa(
+    env: Env,
+    token: Uint8Array,
+    public_key: Uint8Array,
+    now_seconds: i64,
+) -> Result<Unknown<'static>> {
+    let Some(payload) = verify_token_eddsa(token.as_ref(), public_key.as_ref(), now_seconds) else {
+        return crate::json::napi_marshal::sonic_value_to_js(&env, &sonic_rs::Value::new());
+    };
+    match sonic_rs::from_slice::<sonic_rs::Value>(&payload) {
+        Ok(v) => crate::json::napi_marshal::sonic_value_to_js(&env, &v),
+        // The payload already parsed for the time-claim check — unreachable.
+        Err(_) => crate::json::napi_marshal::sonic_value_to_js(&env, &sonic_rs::Value::new()),
+    }
+}
+
+/// Higher-order instance: precompiles the HMAC-SHA256 key once from `secret`,
+/// so `sign`/`verify` never re-derive the key on the per-call path. `ttl` is
+/// fixed at construction (0/absent → no `iat`/`exp` injection).
+#[napi]
+pub struct JwtSigner {
+    pub(crate) key: aws_lc_rs::hmac::Key,
+    ttl_seconds: Option<i64>,
+}
+
+#[napi]
+impl JwtSigner {
+    #[napi(constructor)]
+    pub fn new(secret: Uint8Array, ttl_seconds: Option<i64>) -> Self {
+        Self {
+            key: aws_lc_rs::hmac::Key::new(aws_lc_rs::hmac::HMAC_SHA256, secret.as_ref()),
+            ttl_seconds,
+        }
+    }
+
+    /// Opaque handle to the precompiled key + ttl, for the `bun:ffi` C-ABI
+    /// fast path (`castrum_jwt_signer_*` in rust/ffi.rs). Only valid while THIS
+    /// instance is alive; the JS wrapper holds the instance.
+    #[napi]
+    pub fn inner_ptr(&self) -> u64 {
+        self as *const JwtSigner as u64
+    }
+
+    /// Sign a JWT with the precompiled key. When `ttl` was set at construction,
+    /// `iat`/`exp` are injected into object claims (unless already present).
+    #[napi]
+    pub fn sign(&self, claims: serde_json::Value, now_seconds: i64) -> Result<Buffer> {
+        let mut claims = claims;
+        let payload_b64 = inject_and_payload_b64(&mut claims, self.ttl_seconds, now_seconds)?;
+        Ok(Buffer::from(build_token_with_key(
+            jwt_header_b64(),
+            &payload_b64,
+            &self.key,
+        )))
+    }
+
+    /// Sign a JWT from pre-serialized claim JSON bytes with the precompiled
+    /// key — no napi `serde_json::Value` marshal, no per-call key derivation.
+    #[napi]
+    pub fn sign_bytes(&self, claims_json: Uint8Array, now_seconds: i64) -> Result<Buffer> {
+        let mut claims: sonic_rs::Value =
+            sonic_rs::from_slice(claims_json.as_ref()).map_err(napi_err)?;
+        let payload_b64 = inject_and_payload_b64_sonic(&mut claims, self.ttl_seconds, now_seconds)?;
+        Ok(Buffer::from(build_token_with_key(
+            jwt_header_b64(),
+            &payload_b64,
+            &self.key,
+        )))
+    }
+
+    /// Verify a JWT with the precompiled key (signature + `alg` + time claims).
+    /// Returns the decoded claims object, or `null` on any failure.
+    #[napi]
+    pub fn verify(
+        &self,
+        env: Env,
+        token: Uint8Array,
+        now_seconds: i64,
+    ) -> Result<Unknown<'static>> {
+        let Some(payload) = verify_token_with_key(token.as_ref(), &self.key, now_seconds) else {
+            return crate::json::napi_marshal::sonic_value_to_js(&env, &sonic_rs::Value::new());
+        };
+        match sonic_rs::from_slice::<sonic_rs::Value>(&payload) {
+            Ok(v) => crate::json::napi_marshal::sonic_value_to_js(&env, &v),
+            // The payload already parsed for the time-claim check — unreachable.
+            Err(_) => crate::json::napi_marshal::sonic_value_to_js(&env, &sonic_rs::Value::new()),
+        }
+    }
+}
+
+/// C-ABI support: sign pre-serialized claim JSON with the precompiled key.
+/// `Err(())` on invalid claims JSON (napi parity: throws).
+///
+/// # Safety
+/// `p` must be a valid `*const JwtSigner` from `inner_ptr`, alive for the call.
+pub(crate) unsafe fn jwt_signer_sign_bytes_core(
+    p: *const JwtSigner,
+    claims_json: &[u8],
+    now_seconds: i64,
+) -> std::result::Result<Vec<u8>, ()> {
+    let this = &*p;
+    let mut claims: sonic_rs::Value = sonic_rs::from_slice(claims_json).map_err(|_| ())?;
+    let payload_b64 =
+        inject_and_payload_b64_sonic(&mut claims, this.ttl_seconds, now_seconds).map_err(|_| ())?;
+    Ok(build_token_with_key(
+        jwt_header_b64(),
+        &payload_b64,
+        &this.key,
+    ))
+}
+
+/// C-ABI support: verify a JWT with the precompiled key → the decoded payload
+/// BYTES (valid JSON claims), or None on invalid signature / expired /
+/// malformed. No `serde_json::Value` DOM, no re-serialize.
+///
+/// # Safety
+/// `p` must be a valid `*const JwtSigner` from `inner_ptr`, alive for the call.
+pub(crate) unsafe fn jwt_signer_verify_core(
+    p: *const JwtSigner,
+    token: &[u8],
+    now_seconds: i64,
+) -> Option<Vec<u8>> {
+    let this = &*p;
+    verify_token_with_key(token, &this.key, now_seconds)
+}
+
+fn napi_err(e: impl std::fmt::Display) -> Error {
+    Error::from_reason(e.to_string())
+}
+
+/// Parallel sign batch: packed `[u32 count]{[u32 len][claims-json]}` in →
+/// packed `[u32 count]{[u32 len][token]}` out (same secret/ttl/now for all).
+#[napi]
+pub fn jwt_sign_batch_packed(
+    data: Uint8Array,
+    secret: Uint8Array,
+    ttl_seconds: Option<i64>,
+    now_seconds: i64,
+) -> Result<Buffer> {
+    // Derive the HMAC key ONCE for the whole batch (build_token derives a
+    // fresh key per call), then route through the shared packed batch helper
+    // (zero-alloc serial PackedIter path; rayon direct-write when justified).
+    let key = aws_lc_rs::hmac::Key::new(aws_lc_rs::hmac::HMAC_SHA256, secret.as_ref());
+
+    let sign_one = |claims_json: &[u8]| -> Vec<u8> {
+        let Ok(mut claims) = sonic_rs::from_slice::<sonic_rs::Value>(claims_json) else {
+            return Vec::new();
+        };
+        inject_ttl_claims(&mut claims, ttl_seconds, now_seconds);
+        let header_b64 = jwt_header_b64();
+        let Ok(payload_bytes) = sonic_rs::to_vec(&claims) else {
+            return Vec::new();
+        };
+        let payload_b64 = base64url_encode_bytes(&payload_bytes);
+        build_token_with_key(header_b64, &payload_b64, &key)
+    };
+
+    crate::util::run_packed_batch(data.as_ref(), sign_one).map(Buffer::from)
+}
+
+/// Parallel verify batch: packed `[u32 count]{[u32 len][token]}` in → bitset
+/// (`[u32 count][ceil(n/8) bytes]`) of valid tokens.
+#[napi]
+pub fn jwt_verify_batch_packed(
+    data: Uint8Array,
+    secret: Uint8Array,
+    now_seconds: i64,
+) -> Result<Buffer> {
+    // Derive the HMAC key ONCE for the whole batch (verify_token derives a
+    // fresh key per call), then route through the shared bitset batch helper
+    // (zero-alloc serial PackedIter path; rayon direct-write when justified).
+    let key = aws_lc_rs::hmac::Key::new(aws_lc_rs::hmac::HMAC_SHA256, secret.as_ref());
+    crate::util::run_bitset_batch(
+        data.as_ref(),
+        |token| verify_token_with_key(token, &key, now_seconds).is_some(),
+        4096,
+    )
+    .map(Buffer::from)
+}

package/rust/crypto/jwt/mod.rs

@@ -0,0 +1,22 @@
+//! HS256 / EdDSA JSON Web Tokens.
+//!
+//! Split into a small folder so the token machinery is navigable:
+//!   - `token.rs` — pure token core (headers, HMAC, split/build/verify, zero-DOM
+//!     time-claim checks, `iat`/`exp` injection). Reused by the napi boundary,
+//!     the C-ABI fast paths in `rust/ffi.rs`, and `crate::crypto::ed25519`.
+//!   - `api.rs` — napi entry points (scalar sign/verify, precompiled-key
+//!     `JwtSigner` instance, C-ABI `_core` helpers, packed sign/verify batches).
+//!   - `tests.rs` — unit tests.
+//!
+//! All items are re-exported at this module root (`pub use self::token::*` +
+//! `pub use self::api::*`) so existing `crate::crypto::jwt::*` call sites keep
+//! working unchanged.
+
+mod api;
+mod token;
+
+#[cfg(test)]
+mod tests;
+
+pub use self::api::*;
+pub use self::token::*;

package/rust/crypto/jwt/tests.rs

@@ -0,0 +1,312 @@
+// rust/crypto/jwt/tests.rs — unit tests for the JWT core + napi entry points.
+//
+// Exercises the token core in `token.rs` and the napi boundary in `napi.rs`.
+// The old local base64url helpers were consolidated into
+// `crate::crypto::base64`; the tests import them under their former `b64url_*`
+// names so the assertions read the same.
+
+use super::*;
+use crate::crypto::base64::{
+    base64url_decode_bytes as b64url_decode, base64url_encode_bytes as b64url_encode,
+};
+use napi::bindgen_prelude::*;
+use sonic_rs::JsonValueTrait;
+
+const SECRET: &[u8] = b"test-secret-key";
+
+fn token(claims: &serde_json::Value, secret: &[u8]) -> Vec<u8> {
+    token_with_header(
+        &serde_json::json!({ "alg": "HS256", "typ": "JWT" }),
+        claims,
+        secret,
+    )
+}
+
+fn token_with_header(
+    header: &serde_json::Value,
+    claims: &serde_json::Value,
+    secret: &[u8],
+) -> Vec<u8> {
+    let header_b64 = b64url_encode(&serde_json::to_vec(header).unwrap());
+    let payload_b64 = b64url_encode(&serde_json::to_vec(claims).unwrap());
+    build_token(&header_b64, &payload_b64, secret)
+}
+
+#[test]
+fn verify_token_rejects_wrong_alg() {
+    // Regression: `alg` must be allowlisted. A token with a VALID HS256
+    // signature but header `alg: "none"` (or any non-HS256) must be
+    // rejected — otherwise alg-confusion attacks become possible later.
+    let claims = serde_json::json!({ "sub": "1" });
+    let none = token_with_header(
+        &serde_json::json!({ "alg": "none", "typ": "JWT" }),
+        &claims,
+        SECRET,
+    );
+    assert!(verify_token(&none, SECRET, 1_000_000).is_none());
+
+    let rs256 = token_with_header(
+        &serde_json::json!({ "alg": "RS256", "typ": "JWT" }),
+        &claims,
+        SECRET,
+    );
+    assert!(verify_token(&rs256, SECRET, 1_000_000).is_none());
+}
+
+#[test]
+fn verify_token_enforces_nbf() {
+    let claims = serde_json::json!({ "sub": "1", "nbf": 2_000_000 });
+    let t = token(&claims, SECRET);
+    // Before nbf -> rejected; at/after nbf -> accepted.
+    assert!(verify_token(&t, SECRET, 1_999_999).is_none());
+    assert!(verify_token(&t, SECRET, 2_000_000).is_some());
+}
+
+#[test]
+fn verify_token_enforces_iat_leeway() {
+    let now = 1_000_000;
+    // iat in the far future -> rejected (beyond 60s skew leeway).
+    let far = token(
+        &serde_json::json!({ "sub": "1", "iat": now + 10_000 }),
+        SECRET,
+    );
+    assert!(verify_token(&far, SECRET, now).is_none());
+    // iat within leeway -> accepted.
+    let near = token(&serde_json::json!({ "sub": "1", "iat": now + 30 }), SECRET);
+    assert!(verify_token(&near, SECRET, now).is_some());
+}
+
+#[test]
+fn verify_token_accepts_valid_claims() {
+    let claims = serde_json::json!({ "sub": "123", "role": "admin" });
+    let t = token(&claims, SECRET);
+    let payload = verify_token(&t, SECRET, 1_000_000).expect("valid token verifies");
+    let v: sonic_rs::Value = sonic_rs::from_slice(&payload).unwrap();
+    assert_eq!(v["sub"], "123");
+}
+
+#[test]
+fn sign_then_verify_roundtrip() {
+    let claims = serde_json::json!({ "sub": "123", "name": "John", "role": "admin" });
+    let t = token(&claims, SECRET);
+    assert!(verify_signature(&t, SECRET));
+}
+
+#[test]
+fn verify_rejects_wrong_secret() {
+    let claims = serde_json::json!({ "sub": "1" });
+    let t = token(&claims, SECRET);
+    assert!(!verify_signature(&t, b"wrong-secret"));
+}
+
+#[test]
+fn verify_rejects_tampered_payload() {
+    let claims = serde_json::json!({ "sub": "1", "role": "user" });
+    let t = token(&claims, SECRET);
+    let first_dot = memchr::memchr(b'.', &t).unwrap();
+    let second_rel = memchr::memchr(b'.', &t[first_dot + 1..]).unwrap();
+    let payload_start = first_dot + 1;
+    let payload_end = payload_start + second_rel;
+    let mid = (payload_start + payload_end) / 2;
+
+    let mut tampered = t.clone();
+    tampered[mid] ^= 0x01;
+    assert!(!verify_signature(&tampered, SECRET));
+}
+
+#[test]
+fn verify_rejects_malformed() {
+    assert!(!verify_signature(b"no-dots-here", SECRET));
+    assert!(!verify_signature(b"a.b.c.d", SECRET));
+    assert!(!verify_signature(b".", SECRET));
+    assert!(!verify_signature(b"", SECRET));
+}
+
+#[test]
+fn base64url_roundtrip() {
+    let data = b"hello world \x00\xff binary";
+    let enc = b64url_encode(data);
+    assert_eq!(b64url_decode(&enc).unwrap(), data);
+    assert!(!enc.contains(&b'='));
+}
+
+#[test]
+fn base64url_uses_urlsafe_alphabet() {
+    // Bytes 0xfb 0xff encode to base64url "-_8" (no +/ or /).
+    assert_eq!(b64url_encode(b"\xfb\xff"), b"-_8");
+}
+
+#[test]
+fn split_handles_three_segments() {
+    let t = b"aaa.bbb.ccc";
+    let parts = split_token(t).unwrap();
+    assert_eq!(parts.header_b64, b"aaa");
+    assert_eq!(parts.payload_b64, b"bbb");
+    assert_eq!(parts.sig_b64, b"ccc");
+}
+
+#[test]
+fn jwt_signer_instance_roundtrips_and_injects_claims() {
+    // Precompiled-key instance: sign+verify with no per-call key derivation.
+    let signer = JwtSigner::new(Uint8Array::new(SECRET.to_vec()), Some(3600));
+    let now = 1_000_000i64;
+
+    let claims = serde_json::json!({ "sub": "123" });
+    let token = signer.sign(claims.clone(), now).unwrap();
+
+    // ttl injected iat/exp at construction time.
+    let verified_payload = verify_token_with_key(&token, &signer.key, now).expect("token verifies");
+    let verified: sonic_rs::Value = sonic_rs::from_slice(&verified_payload).unwrap();
+    assert_eq!(verified["sub"], "123");
+    assert_eq!(verified["iat"], now);
+    assert_eq!(verified["exp"], now + 3600);
+
+    // Same instance verifies, wrong key instance rejects.
+    let other = JwtSigner::new(Uint8Array::new(b"other-secret".to_vec()), None);
+    assert!(verify_token_with_key(&token, &other.key, now).is_none());
+
+    // No ttl -> no iat/exp injected.
+    let no_ttl = JwtSigner::new(Uint8Array::new(SECRET.to_vec()), None);
+    let t2 = no_ttl.sign(claims.clone(), now).unwrap();
+    let v2_payload = verify_token_with_key(&t2, &no_ttl.key, now).unwrap();
+    let v2: sonic_rs::Value = sonic_rs::from_slice(&v2_payload).unwrap();
+    assert!(v2.get("iat").is_none());
+    assert!(v2.get("exp").is_none());
+}
+
+#[test]
+fn jwt_sign_bytes_matches_value_sign_and_verifies() {
+    let claims_json = br#"{"sub":"123","name":"John"}"#.to_vec();
+    let secret = Uint8Array::new(SECRET.to_vec());
+
+    // Byte-JSON sign (no napi Value marshal) matches the Value sign
+    // semantically. Key ORDER differs between the two serializers — sonic
+    // (`sort_keys` → BTreeMap) emits sorted keys, serde_json
+    // (`preserve_order` → IndexMap) emits insertion order — so compare the
+    // decoded claims, not the raw token bytes.
+    let from_bytes = jwt_sign_bytes(
+        Uint8Array::new(claims_json.clone()),
+        secret,
+        None,
+        1_000_000,
+    )
+    .unwrap();
+    let claims: serde_json::Value = serde_json::from_slice(&claims_json).unwrap();
+    let from_value = jwt_sign(claims, Uint8Array::new(SECRET.to_vec()), None, 1_000_000).unwrap();
+    let claims_from_bytes: sonic_rs::Value = sonic_rs::from_slice(
+        &b64url_decode(split_token(&from_bytes).unwrap().payload_b64).unwrap(),
+    )
+    .unwrap();
+    let claims_from_value: sonic_rs::Value = sonic_rs::from_slice(
+        &b64url_decode(split_token(&from_value).unwrap().payload_b64).unwrap(),
+    )
+    .unwrap();
+    assert_eq!(claims_from_bytes, claims_from_value);
+
+    // The bytes-signed token verifies and carries the claims.
+    let verified_payload = verify_token(from_bytes.as_ref(), SECRET, 1_000_000).unwrap();
+    let verified: sonic_rs::Value = sonic_rs::from_slice(&verified_payload).unwrap();
+    assert_eq!(verified["sub"], "123");
+    assert_eq!(verified["name"], "John");
+}
+
+#[test]
+fn jwt_sign_bytes_injects_ttl_and_instance_sign_bytes_works() {
+    let claims_json = br#"{"sub":"123"}"#.to_vec();
+    let token = jwt_sign_bytes(
+        Uint8Array::new(claims_json.clone()),
+        Uint8Array::new(SECRET.to_vec()),
+        Some(3600),
+        1_000_000,
+    )
+    .unwrap();
+    let payload = verify_token(&token, SECRET, 1_000_000).unwrap();
+    let v: sonic_rs::Value = sonic_rs::from_slice(&payload).unwrap();
+    assert_eq!(v["iat"], 1_000_000);
+    assert_eq!(v["exp"], 1_000_000 + 3600);
+
+    // Precompiled-key instance: sign_bytes injects its construction ttl.
+    let signer = JwtSigner::new(Uint8Array::new(SECRET.to_vec()), Some(3600));
+    let t2 = signer
+        .sign_bytes(Uint8Array::new(claims_json), 2_000_000)
+        .unwrap();
+    let v2_payload = verify_token_with_key(&t2, &signer.key, 2_000_000).unwrap();
+    let v2: sonic_rs::Value = sonic_rs::from_slice(&v2_payload).unwrap();
+    assert_eq!(v2["iat"], 2_000_000);
+    assert_eq!(v2["exp"], 2_000_000 + 3600);
+}
+
+#[test]
+fn eddsa_sign_verify_round_trip() {
+    let (private_der, public_der) = crate::crypto::ed25519::generate_keypair().unwrap();
+    let claims_json = br#"{"sub":"user-1","roles":["admin"]}"#.to_vec();
+
+    let token = sign_eddsa(&claims_json, &private_der, None, 1_000_000).unwrap();
+    // Compact token: exactly two dots, EdDSA header.
+    let parts = split_token(&token).unwrap();
+    assert_eq!(
+        b64url_decode(parts.header_b64).unwrap(),
+        br#"{"alg":"EdDSA","typ":"JWT"}"#
+    );
+
+    // Verifies with the matching public key.
+    let payload = verify_token_eddsa(&token, &public_der, 1_000_000).unwrap();
+    let v: sonic_rs::Value = sonic_rs::from_slice(&payload).unwrap();
+    assert_eq!(v["sub"], "user-1");
+    assert_eq!(v["roles"][0], "admin");
+
+    // Wrong public key (a different keypair) fails.
+    let (_, other_pub) = crate::crypto::ed25519::generate_keypair().unwrap();
+    assert!(verify_token_eddsa(&token, &other_pub, 1_000_000).is_none());
+
+    // Tampered payload fails (signature over header.payload is invalid).
+    let mut bad = token.clone();
+    let n = bad.len();
+    bad[n - 2] ^= 0x01;
+    assert!(verify_token_eddsa(&bad, &public_der, 1_000_000).is_none());
+}
+
+#[test]
+fn eddsa_injects_ttl_and_enforces_time_claims() {
+    let (private_der, public_der) = crate::crypto::ed25519::generate_keypair().unwrap();
+    let claims_json = br#"{"sub":"user-1"}"#.to_vec();
+
+    let token = sign_eddsa(&claims_json, &private_der, Some(3600), 1_000_000).unwrap();
+    let v: sonic_rs::Value =
+        sonic_rs::from_slice(&verify_token_eddsa(&token, &public_der, 1_000_000).unwrap()).unwrap();
+    assert_eq!(v["iat"], 1_000_000);
+    assert_eq!(v["exp"], 1_000_000 + 3600);
+
+    // Expired token rejected.
+    assert!(verify_token_eddsa(&token, &public_der, 1_000_000 + 3600).is_none());
+    // Not-yet-valid (future iat beyond leeway) rejected.
+    let future = sign_eddsa(&claims_json, &private_der, Some(3600), 1_000_000).unwrap();
+    assert!(verify_token_eddsa(&future, &public_der, 1_000_000 - 61).is_none());
+    assert!(verify_token_eddsa(&future, &public_der, 1_000_000).is_some());
+}
+
+#[test]
+fn eddsa_rejects_wrong_alg_and_malformed() {
+    let (private_der, public_der) = crate::crypto::ed25519::generate_keypair().unwrap();
+    let claims_json = br#"{"sub":"x"}"#.to_vec();
+    let token = sign_eddsa(&claims_json, &private_der, None, 1_000_000).unwrap();
+
+    // Swap the header alg to HS256 while keeping a valid Ed25519 signature
+    // over the new header.payload — the alg allowlist must reject it.
+    let header_b64 = b64url_encode(br#"{"alg":"HS256","typ":"JWT"}"#);
+    let parts = split_token(&token).unwrap();
+    let mut forged_input = Vec::new();
+    forged_input.extend_from_slice(&header_b64);
+    forged_input.push(b'.');
+    forged_input.extend_from_slice(parts.payload_b64);
+    let sig = crate::crypto::ed25519::sign(&private_der, &forged_input).unwrap();
+    let mut forged = forged_input;
+    forged.push(b'.');
+    forged.extend_from_slice(&b64url_encode(&sig));
+    assert!(verify_token_eddsa(&forged, &public_der, 1_000_000).is_none());
+
+    // Malformed tokens.
+    assert!(verify_token_eddsa(b"not-a-token", &public_der, 1_000_000).is_none());
+    assert!(verify_token_eddsa(b"a.b.c.d", &public_der, 1_000_000).is_none());
+    assert!(verify_token_eddsa(&token, &[], 1_000_000).is_none());
+}