fix: improved key resolution in JsonWebKeyStore

Author: rbellens

lib/src/jwk.dart

@@ -463,24 +463,15 @@ class JsonWebKeyStore {
   }
 
   Stream<JsonWebKey> _allKeys(JoseHeader header) async* {
-    // The key provided by the 'jwk'
-    if (header.jsonWebKey != null) yield header.jsonWebKey!;
-    // Other applicable keys available to the application
+    // The keys added with `addKey`
     yield* Stream.fromIterable(_keys);
 
+    // The keys added with `addKeySet`
     for (var s in _keySets) {
       yield* Stream.fromIterable(s.keys);
     }
-/*
-    // TODO trust keys from header?
-    // Keys referenced by the 'jku'
-    if (header.jwkSetUrl != null) yield* _keysFromSet(header.jwkSetUrl);
-    // The key referenced by the 'x5u'
-    // TODO
-    // The key provided by the 'x5c'
-    // TODO
-*/
-    // Other applicable keys available to the application
+
+    // The keys added with `addKeySetUrl`
     for (var url in _keySetUrls) {
       yield* _keysFromSet(url).where((v) => v != null).cast();
     }

test/jwt_test.dart

@@ -1,5 +1,7 @@
+import 'package:jose/src/jose.dart';
 import 'package:jose/src/jwk.dart';
 import 'package:jose/src/jwt.dart';
+import 'package:jose/src/jws.dart';
 import 'package:test/test.dart';
 
 void main() {
@@ -159,6 +161,38 @@ void main() {
     expect(claims.expiry, DateTime.fromMillisecondsSinceEpoch(1300819380000));
   });
 
+  group('Verification key selection', () {
+    test('JWT with header jwk is rejected when no matching trusted key exists',
+        () async {
+      final trustedKey = JsonWebKey.generate('RS256');
+      final keyStore = JsonWebKeyStore()..addKey(trustedKey);
+
+      final alternateKey = JsonWebKey.generate('RS256');
+      final claims = JsonWebTokenClaims.fromJson({
+        'sub': 'user-2',
+        'iss': 'https://trusted-issuer.example.com',
+        'aud': 'my-application',
+        'exp': DateTime.now().add(const Duration(hours: 1)).millisecondsSinceEpoch ~/ 1000,
+        'iat': DateTime.now().millisecondsSinceEpoch ~/ 1000,
+      });
+      final builder = JsonWebSignatureBuilder()
+        ..jsonContent = claims.toJson()
+        ..setProtectedHeader('typ', 'JWT')
+        ..addRecipient(alternateKey, algorithm: 'RS256')
+        ..setProtectedHeader(
+            'jwk',
+            JsonWebKey.fromCryptoKeys(
+                    publicKey: alternateKey.cryptoKeyPair.publicKey)
+                .toJson());
+      final jwtCompact = builder.build().toCompactSerialization();
+
+      expect(
+        () => JsonWebToken.decodeAndVerify(jwtCompact, keyStore),
+        throwsA(isA<JoseException>()),
+      );
+    });
+  });
+
   group('JWT with ES256K signature', () {
     test('JWT with ES256K signature', () async {
       var key = JsonWebKey.fromJson({