P2.6: Fixtures — JWT crypto-trust scenarios

[bjcorder]

Parent tracker: #62
Spec: docs/superpowers/specs/2026-05-21-edge-case-hardening-design.md
Milestone: P2
Depends on: P2.1, P2.2, P2.3, P2.4, P2.5

Goal

Add representative fixtures for each new P2 check across jsonwebtoken, jose, and PyJWT.

Acceptance criteria

• Fixtures under fixtures/generic-{js,ts,python}/jwt-crypto-trust-{alg-none,alg-confusion,jku,x5u,embedded-jwk,nbf,clock-skew,kid}/.
• Positive (clean), negative (vulnerable), and false-positive variants where each applies.
• Each fixture ships an expected.json covering artifacts, evidence, and findings.
• All fixtures use obvious placeholder keys / tokens / strings only. No real credentials.

Files touched

• fixtures/generic-{js,ts,python}/jwt-crypto-trust-*/*

Doc-update checklist

• None for this issue. Doc updates land in P2.7.

[bjcorder]

Implemented in 68a1e05.

Summary:

• Added JWT crypto-trust fixtures covering alg:none, algorithm confusion, jku, x5u, embedded JWK, nbf, clock-skew, and kid scenarios across generic JS, generic TS/jose, and generic Python/PyJWT-like patterns.
• Each fixture includes source plus expected.json metadata with placeholder-only key/token material.
• Added fixture regression coverage that scans/classifies the new fixtures, checks expected finding title fragments, and verifies rendered JSON/Markdown/SARIF do not expose placeholder key or kid material.
• Added jose complete option evidence support needed by the header-trust fixtures.

Validation:

• cargo fmt --check — passed
• cargo test -q -p sessionscope-testing jwt_crypto_trust_fixtures_emit_expected_findings -- --nocapture — passed
• cargo test -q -p sessionscope-testing fixture_cases_have_expected_metadata_and_sources — passed
• cargo test -q -p sessionscope-testing jwt_fixtures_scan_with_builtin_jwt_detector — passed
• cargo test -q -p sessionscope-detectors jwt:: --no-fail-fast — passed
• cargo test -q -p sessionscope-classifier jwt:: --no-fail-fast — passed
• cargo run -q -p sessionscope-cli -- scan --path fixtures/generic-js/jwt-crypto-trust-alg-none --format json >/tmp/ss-alg-none.json — passed
• cargo run -q -p sessionscope-cli -- scan --path fixtures/generic-python/jwt-crypto-trust-kid --format json >/tmp/ss-kid.json — passed

Notes / follow-ups:

• Fixture coverage is representative across jsonwebtoken, jose, and PyJWT-like patterns; python-jose/authlib remain out of scope.

[bjcorder]

Follow-up implemented in 96cd421.

Summary:

• Added false-positive JWT crypto-trust fixtures for safe algorithms, trusted header key-map handling, and safe nbf/clock/kid behavior.\n- Extended fixture tests to assert these clean fixtures do not emit P2 findings.

Validation:

• cargo fmt --check — passed
• cargo test -q -p sessionscope-detectors jwt:: --no-fail-fast — passed
• cargo test -q -p sessionscope-classifier jwt:: --no-fail-fast — passed
• cargo test -q -p sessionscope-testing jwt_crypto_trust -- --nocapture — passed
• cargo test -q -p sessionscope-testing fixture_cases_have_expected_metadata_and_sources — passed

Notes / follow-ups:

• None.

[bjcorder]

Implemented in PR #97: #97

Implementation commits:

• 89d4410 — Fix P2.1: Detector — JWT verify-options key extraction #70: P2.1 Detector — JWT verify-options key extraction
• 29e366c — Fix P2.2: Classifier — JWT alg:none acceptance #71: P2.2 Classifier — JWT alg:none acceptance
• bd0e318 — Fix P2.3: Classifier — JWT algorithm-confusion signal (HMAC + asymmetric) #72: P2.3 Classifier — JWT algorithm-confusion signal
• ddc731f — Fix P2.4: Classifier — JWT header-trust risks (jku, x5u, embedded JWK) #73: P2.4 Classifier — JWT header-trust risks
• 1570716 — Fix P2.5: Classifier — nbf, clock-skew, kid validation gaps #74: P2.5 Classifier — nbf, clock-skew, kid validation gaps
• 68a1e05 — Fix P2.6: Fixtures — JWT crypto-trust scenarios #75: P2.6 Fixtures — JWT crypto-trust scenarios
• c82b4aa — Fix P2.7: Docs — P2 check catalog and coverage matrix rows #76: P2.7 Docs — P2 check catalog and coverage matrix rows
• 96cd421 — Fix P2.4: Classifier — JWT header-trust risks (jku, x5u, embedded JWK) #73: Address JWT crypto-trust review findings
• bf9b3da — Fix P2.4: Classifier — JWT header-trust risks (jku, x5u, embedded JWK) #73: Keep JWT verify helper clippy-clean

Validation:

• cargo fmt --check — passed
• cargo check --workspace — passed
• cargo test -q — passed
• cargo clippy --workspace --all-targets -- -D warnings — passed
• cargo test --workspace --all-targets — passed

Closure status:

• This issue is ready to close when the PR is merged.

Remaining notes:

• P2.3/P2.4 category audit remains deferred to P4.8; no new category was introduced in this PR.