fix(jwt): require string values for jti claims

Author: lepture

src/joserfc/_rfc7519/claims.py

@@ -143,6 +143,14 @@ def validate_sub(self, value: str) -> None:
             raise InvalidClaimError("sub", "Claim 'sub' must be a StringOrURI value")
         self.check_value("sub", value)
 
+    def validate_jti(self, value: str) -> None:
+        """The "jti" (JWT ID) claim provides a unique identifier for the JWT.
+        Its value MUST be a case-sensitive string. Use of this claim is OPTIONAL.
+        """
+        if not isinstance(value, str):
+            raise InvalidClaimError("jti", "Claim 'jti' must be a string")
+        self.check_value("jti", value)
+
     def validate_aud(self, value: str | list[str]) -> None:
         """The "aud" (audience) claim identifies the recipients that the JWT is
         intended for.  Each principal intended to process the JWT MUST

tests/jwt/test_claims.py

@@ -68,6 +68,34 @@ def test_claim_sub(self):
         self.assertRaises(InvalidClaimError, claims_requests.validate, {"sub": ["a"]})
         self.assertRaises(InvalidClaimError, claims_requests.validate, {"sub": {"a": "b"}})
 
+    def test_claim_jti(self):
+        claims_requests = jwt.JWTClaimsRegistry()
+        claims_requests.validate({"jti": "expected"})
+        self.assertRaises(InvalidClaimError, claims_requests.validate, {"jti": ["expected"]})
+        self.assertRaises(InvalidClaimError, claims_requests.validate, {"jti": 1})
+
+        for options in ({}, {"value": "expected"}, {"values": ["expected", "other"]}):
+            claims_requests = jwt.JWTClaimsRegistry(jti=options)
+            claims_requests.validate({})
+            claims_requests.validate({"jti": "expected"})
+            for value in (None, 1, True, ["other", "expected"], {"jti": "expected"}):
+                with self.subTest(options=options, value=value):
+                    with self.assertRaises(InvalidClaimError) as cm:
+                        claims_requests.validate({"jti": value})
+                    self.assertEqual(cm.exception.claim, "jti")
+                    self.assertIn("'jti'", cm.exception.description)
+
+        for options in ({"value": "expected"}, {"values": ["expected", "other"]}):
+            claims_requests = jwt.JWTClaimsRegistry(jti=options)
+            self.assertRaises(InvalidClaimError, claims_requests.validate, {"jti": "wrong"})
+
+        claims_requests = jwt.JWTClaimsRegistry(jti={"essential": True})
+        self.assertRaises(MissingClaimError, claims_requests.validate, {})
+        self.assertRaises(InvalidClaimError, claims_requests.validate, {"jti": ""})
+        claims_requests = jwt.JWTClaimsRegistry(jti={"allow_blank": True})
+        claims_requests.validate({"jti": ""})
+        self.assertRaises(InvalidClaimError, claims_requests.validate, {"jti": []})
+
     def test_claim_aud(self):
         claims_requests = jwt.JWTClaimsRegistry(aud={"essential": True})
         claims_requests.validate({"aud": "a"})