[FIX] added api to list the scoped signing keys

account_signingkeys.go

@@ -9,6 +9,12 @@ type accountSigningKeys struct {
 	data *AccountData
 }
 
+func (as *accountSigningKeys) List() []string {
+	v := make([]string, len(as.data.Claim.SigningKeys))
+	copy(v, as.data.Claim.SigningKeys.Keys())
+	return v
+}
+
 func (as *accountSigningKeys) Add() (string, error) {
 	k, err := KeyFor(nkeys.PrefixByteAccount)
 	if err != nil {
@@ -24,6 +30,20 @@ func (as *accountSigningKeys) Add() (string, error) {
 	return k.Public, nil
 }
 
+func (as *accountSigningKeys) ListRoles() []string {
+	var roles []string
+	for _, k := range as.data.Claim.SigningKeys.Keys() {
+		scope, ok := as.data.Claim.SigningKeys.GetScope(k)
+		if ok && scope != nil {
+			us, uok := scope.(*jwt.UserScope)
+			if uok {
+				roles = append(roles, us.Role)
+			}
+		}
+	}
+	return roles
+}
+
 func (as *accountSigningKeys) AddScope(role string) (ScopeLimits, error) {
 	k, err := KeyFor(nkeys.PrefixByteAccount)
 	if err != nil {
@@ -53,8 +73,8 @@ func (as *accountSigningKeys) GetScope(key string) (ScopeLimits, bool) {
 func (as *accountSigningKeys) GetScopeByRole(role string) ScopeLimits {
 	for _, v := range as.data.Claim.SigningKeys {
 		if v != nil {
-			scope := v.(*jwt.UserScope)
-			if scope.Role == role {
+			scope, ok := v.(*jwt.UserScope)
+			if ok && scope.Role == role {
 				return toScopeLimits(as.data, scope)
 			}
 		}

tests/accounts_test.go

@@ -592,3 +592,41 @@ func (suite *ProviderSuite) Test_AccountSkUpdate() {
 	require.Nil(t, scope)
 	require.True(t, ok)
 }
+
+func (suite *ProviderSuite) Test_AccountSigningKeys() {
+	t := suite.T()
+	auth, err := authb.NewAuth(suite.Provider)
+	require.NoError(t, err)
+
+	operators := auth.Operators()
+	require.Empty(t, operators.List())
+
+	o, err := operators.Add("O")
+	require.NoError(t, err)
+	require.NotNil(t, o)
+
+	a, err := o.Accounts().Add("A")
+	require.NoError(t, err)
+	require.NotNil(t, a)
+
+	var keys []string
+	k, err := a.ScopedSigningKeys().Add()
+	require.NoError(t, err)
+	require.NotEmpty(t, k)
+	keys = append(keys, k)
+
+	sl, err := a.ScopedSigningKeys().AddScope("admin")
+	require.NoError(t, err)
+	require.NotNil(t, sl)
+	keys = append(keys, sl.Key())
+	keys2 := a.ScopedSigningKeys().List()
+	for _, k := range keys {
+		require.Contains(t, keys2, k)
+	}
+
+	roles := a.ScopedSigningKeys().ListRoles()
+	t.Log(roles)
+	require.NotNil(t, roles)
+	require.Len(t, roles, 1)
+	require.Contains(t, roles, "admin")
+}

types.go

@@ -531,4 +531,8 @@ type ScopedKeys interface {
 	// GetScopeByRole returns the first scope that matches the specified role.
 	// Note that the search must be an exact match
 	GetScopeByRole(string) ScopeLimits
+	// List returns a list of signing keys
+	List() []string
+	// ListRoles returns the names of roles associated with the account
+	ListRoles() []string
 }