Mint your own test JWTs

mint-test-jwts.py Keypair + JWKS + every variant

#!/usr/bin/env python3
# mint-test-jwts.py
#
# Mints a fresh RS256 keypair, writes the matching JWKS, and emits
# every JWT variant referenced by the JWT labs on this site.
#
# Usage:
#   $ pip install pyjwt cryptography
#   $ python mint-test-jwts.py > tokens.env
#   $ source tokens.env
#   $ python -m http.server 8080      # serve jwks.json for the gateway

import base64, json, time
import jwt
from cryptography.hazmat.primitives.asymmetric import rsa
from cryptography.hazmat.primitives import serialization

# 1. Fresh RS256 signing key
key  = rsa.generate_private_key(public_exponent=65537, key_size=2048)
priv = key.private_bytes(
    encoding=serialization.Encoding.PEM,
    format=serialization.PrivateFormat.PKCS8,
    encryption_algorithm=serialization.NoEncryption())
open("private.pem", "wb").write(priv)

# 2. Matching JWKS — point the gateway's remoteJwks/jwksUri at this
def b64u_int(i):
    return base64.urlsafe_b64encode(
        i.to_bytes((i.bit_length() + 7) // 8, "big")).rstrip(b"=").decode()
n = key.public_key().public_numbers()
open("jwks.json", "w").write(json.dumps({"keys": [{
    "kty": "RSA", "use": "sig", "alg": "RS256", "kid": "test-1",
    "n": b64u_int(n.n), "e": b64u_int(n.e)}]}, indent=2))

# 3. Base payload — every variant below is a one-field mutation of this
now  = int(time.time())
base = {
    "iss": "https://test-idp.example.com",
    "aud": "api.example.com",
    "sub": "alice",
    "tenantId": "tnt_acme",
    "groups": ["orders-readonly"],
    "scope": "invoke.orchestrator",
    "iat": now,
    "exp": now + 3600,
}
sign = lambda p: jwt.encode(p, priv, algorithm="RS256",
                            headers={"kid": "test-1"})

# 4. Variants — name : payload-mutation
variants = {
    "VALID":          base,
    "VALID_READONLY": base,
    "VALID_ADMIN":    {**base, "groups": ["orders-readonly", "orders-admin"]},
    "EXPIRED":        {**base, "iat": now - 7200, "exp": now - 3600},
    "WRONG_AUD":      {**base, "aud": "api.other.com"},
    "WRONG_ISS":      {**base, "iss": "https://other-idp.example.com"},
    "NO_TENANT":      {k: v for k, v in base.items() if k != "tenantId"},
}

out = {name: sign(payload) for name, payload in variants.items()}

# Tampered: take VALID, flip one byte in the signature segment
parts = out["VALID"].split(".")
parts[2] = parts[2][:-2] + ("B" if parts[2][-2] == "A" else "A") + parts[2][-1]
out["TAMPERED"] = ".".join(parts)

for name, tok in out.items():
    print(f"export {name}_JWT={tok}")