fix(httpauth-jwt): WithJSONNumber in Verify, JSON errors in AuthMiddleware, bump httpauth v1.0.2 (#1)

Pass jwt.WithJSONNumber() to jwt.Parse in hmacSigner.Verify, rsaSigner.Verify, and
rsaPublicVerifier.Verify. JWT numbers (including permission bitmasks) are now decoded
as json.Number instead of float64 — exact parsing for all integers including
math.MaxInt64 (the ADMIN wildcard mask). Float64 would round MaxInt64 to 2^63 and
overflow back to math.MinInt64 on cast to int64.

AuthMiddleware now calls httpauth.WriteJSONError for all 401 responses instead of
http.Error. Standardizes the error format across the full httpauth-* middleware stack:
AuthMiddleware (httpauth-jwt), EnrichmentMiddleware, and AuthzMiddleware (httpauth)
all produce {"code":"UNAUTHENTICATED"|"PERMISSION_DENIED"|"INTERNAL","message":"..."}.

Update two existing tests (TestIssueTokenPair_CustomClaims,
TestRefreshTokenPair_CustomClaimsInNewToken) to assert json.Number instead of float64
— they were correct before WithJSONNumber, now reflect the actual decoded type.

Add TestVerify_JSONNumberPreservesMaxInt64: issues a token with math.MaxInt64 as a
bitmask, verifies it, and asserts the decoded value is exactly math.MaxInt64 via
json.Number.Int64() — proving no float64 round-trip occurs.

Add TestAuthMiddleware_UnauthorizedJSON: asserts the 401 response is
Content-Type: application/json with body {"code":"UNAUTHENTICATED","message":"..."}.

Bump httpauth dependency to v1.0.2.

Reviewed-on: #1
Co-authored-by: Rene Nochebuena Guerrero <rene@nochebuena.dev>
Co-committed-by: Rene Nochebuena Guerrero <rene@nochebuena.dev>

CHANGELOG.md

@@ -3,6 +3,23 @@
 All notable changes to `code.nochebuena.dev/go/httpauth-jwt` are documented here.
 Format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
+## [1.0.2] — 2026-05-18
+
+### Changed
+
+- All three `Verify` implementations (`hmacSigner`, `rsaSigner`, `rsaPublicVerifier`)
+  now pass `jwt.WithJSONNumber()` to `jwt.Parse`. JWT numeric claims — including
+  permission mask bitmasks — are decoded as `json.Number` instead of `float64`,
+  preserving exact bit patterns for values up to and including `math.MaxInt64`.
+- `AuthMiddleware` now returns JSON error bodies instead of plain-text `http.Error`
+  for missing/invalid/expired Bearer tokens. Uses `httpauth.WriteJSONError` — the
+  same helper as `EnrichmentMiddleware` and `AuthzMiddleware` — ensuring a consistent
+  `{"code":"UNAUTHENTICATED","message":"unauthorized"}` response across the full
+  middleware stack.
+- Dependency `code.nochebuena.dev/go/httpauth` bumped to v1.0.2.
+
+[1.0.2]: https://code.nochebuena.dev/go/httpauth-jwt/releases/tag/v1.0.2
+
 ## [1.0.0] — 2026-05-08
 
 ### Changed

auth.go

@@ -32,26 +32,26 @@ func AuthMiddleware(verifier Verifier, publicPaths []string) func(http.Handler)
 
 			authHeader := r.Header.Get("Authorization")
 			if !strings.HasPrefix(authHeader, "Bearer ") {
-				http.Error(w, "unauthorized", http.StatusUnauthorized)
+				httpauthmw.WriteJSONError(w, http.StatusUnauthorized, "UNAUTHENTICATED", "unauthorized")
 				return
 			}
 			tokenStr := strings.TrimPrefix(authHeader, "Bearer ")
 
 			token, err := verifier.Verify(tokenStr)
 			if err != nil {
-				http.Error(w, "unauthorized", http.StatusUnauthorized)
+				httpauthmw.WriteJSONError(w, http.StatusUnauthorized, "UNAUTHENTICATED", "unauthorized")
 				return
 			}
 
 			claims, ok := token.Claims.(jwt.MapClaims)
 			if !ok {
-				http.Error(w, "unauthorized", http.StatusUnauthorized)
+				httpauthmw.WriteJSONError(w, http.StatusUnauthorized, "UNAUTHENTICATED", "unauthorized")
 				return
 			}
 
 			uid, _ := claims["sub"].(string)
 			if uid == "" {
-				http.Error(w, "unauthorized", http.StatusUnauthorized)
+				httpauthmw.WriteJSONError(w, http.StatusUnauthorized, "UNAUTHENTICATED", "unauthorized")
 				return
 			}
 

go.mod

@@ -3,8 +3,11 @@ module code.nochebuena.dev/go/httpauth-jwt
 go 1.26
 
 require (
-	code.nochebuena.dev/go/httpauth v1.0.0
+	code.nochebuena.dev/go/httpauth v1.0.2
 	github.com/golang-jwt/jwt/v5 v5.2.1
 )
 
-require code.nochebuena.dev/go/rbac v1.0.0 // indirect
+require (
+	code.nochebuena.dev/go/rbac v1.0.0 // indirect
+	code.nochebuena.dev/go/xerrors v1.0.1 // indirect
+)

go.sum

@@ -1,6 +1,8 @@
-code.nochebuena.dev/go/httpauth v1.0.0 h1:B2ypnlL7yQkePHC3EKo4LPgJbd5lWZ6RuA1o6sx84so=
+code.nochebuena.dev/go/httpauth v1.0.2 h1:BegLr1nHk/i/RbhEf2Xh9FZZ9psUqjFyQ+hvFJR4Ro4=
-code.nochebuena.dev/go/httpauth v1.0.0/go.mod h1:rGaQDInGkavpk8nbiG7azPqcyYsrwo0+E+ZNocRW2MY=
+code.nochebuena.dev/go/httpauth v1.0.2/go.mod h1:vVyYhdgHBpOJc9uih6bMtrXBPmvPRgTJrI8cfErXojk=
 code.nochebuena.dev/go/rbac v1.0.0 h1:FnsU1HU6vvwchKuZNxDa9RPIFeNwJi0vShWvHKABMws=
 code.nochebuena.dev/go/rbac v1.0.0/go.mod h1:LzW8tTJmdbu6HHN26NZZ3HzzdlZAd1sp6aml25Cfz5c=
+code.nochebuena.dev/go/xerrors v1.0.1 h1:fgXoabY/ZwxAzaM1sKFf3sbL7ZHWyDxItB/rdbnl0mo=
+code.nochebuena.dev/go/xerrors v1.0.1/go.mod h1:03MMVfrhaf4XmTMgMrEUFCmuZPGHUCKDitiQvwCuwvY=
 github.com/golang-jwt/jwt/v5 v5.2.1 h1:OuVbFODueb089Lh128TAcimifWaLhJwVflnrgM17wHk=
 github.com/golang-jwt/jwt/v5 v5.2.1/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=

jwtauth_test.go

@@ -4,7 +4,9 @@ import (
 	"context"
 	"crypto/rand"
 	"crypto/rsa"
+	"encoding/json"
 	"errors"
+	"math"
 	"net/http"
 	"net/http/httptest"
 	"testing"
@@ -152,7 +154,7 @@ func TestIssueTokenPair_StandardClaims(t *testing.T) {
 
 func TestIssueTokenPair_CustomClaims(t *testing.T) {
 	custom := map[string]any{
-		"permisos": map[string]any{"usuarios": float64(515)},
+		"permisos": map[string]any{"usuarios": int64(515)},
 	}
 	pair, err := IssueTokenPair(testHMAC, "uid1", custom, testCfg)
 	if err != nil {
@@ -164,8 +166,13 @@ func TestIssueTokenPair_CustomClaims(t *testing.T) {
 	if !ok {
 		t.Fatalf("permisos claim missing or wrong type: %T", mc["permisos"])
 	}
-	if permisos["usuarios"] != float64(515) {
+	// Verify uses jwt.WithJSONNumber — numeric claims come back as json.Number.
-		t.Errorf("want usuarios=515, got %v", permisos["usuarios"])
+	n, ok := permisos["usuarios"].(json.Number)
+	if !ok {
+		t.Fatalf("want json.Number, got %T", permisos["usuarios"])
+	}
+	if v, _ := n.Int64(); v != 515 {
+		t.Errorf("want usuarios=515, got %d", v)
 	}
 }
 
@@ -277,8 +284,48 @@ func TestRefreshTokenPair_CustomClaimsInNewToken(t *testing.T) {
 	if !ok {
 		t.Fatalf("permisos missing from new access token")
 	}
-	if permisos["usuarios"] != float64(7) {
+	// Verify uses jwt.WithJSONNumber — numeric claims come back as json.Number.
-		t.Errorf("want 7, got %v", permisos["usuarios"])
+	n, ok := permisos["usuarios"].(json.Number)
+	if !ok {
+		t.Fatalf("want json.Number, got %T", permisos["usuarios"])
+	}
+	if v, _ := n.Int64(); v != 7 {
+		t.Errorf("want 7, got %d", v)
+	}
+}
+
+// --- json.Number precision ---
+
+func TestVerify_JSONNumberPreservesMaxInt64(t *testing.T) {
+	// math.MaxInt64 cannot be represented exactly as float64 — it would round to 2^63
+	// and overflow back to math.MinInt64 on cast. WithJSONNumber keeps it as a decimal
+	// string and json.Number.Int64() parses it exactly.
+	custom := map[string]any{
+		"masks": map[string]any{"*": int64(math.MaxInt64)},
+	}
+	pair, err := IssueTokenPair(testHMAC, "uid1", custom, testCfg)
+	if err != nil {
+		t.Fatalf("IssueTokenPair: %v", err)
+	}
+	tok, err := testHMAC.Verify(pair.AccessToken)
+	if err != nil {
+		t.Fatalf("Verify: %v", err)
+	}
+	mc, _ := tok.Claims.(jwt.MapClaims)
+	masks, ok := mc["masks"].(map[string]any)
+	if !ok {
+		t.Fatalf("masks claim missing or wrong type: %T", mc["masks"])
+	}
+	n, ok := masks["*"].(json.Number)
+	if !ok {
+		t.Fatalf("want json.Number, got %T — WithJSONNumber() may not be set", masks["*"])
+	}
+	got, err := n.Int64()
+	if err != nil {
+		t.Fatalf("Int64(): %v", err)
+	}
+	if got != math.MaxInt64 {
+		t.Errorf("want MaxInt64 (%d), got %d — precision lost in float64 round-trip", int64(math.MaxInt64), got)
 	}
 }
 
@@ -364,6 +411,27 @@ func TestAuthMiddleware_PublicPathWildcard(t *testing.T) {
 	}
 }
 
+func TestAuthMiddleware_UnauthorizedJSON(t *testing.T) {
+	h := AuthMiddleware(testHMAC, nil)(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/api", nil))
+	if rec.Code != http.StatusUnauthorized {
+		t.Errorf("want 401, got %d", rec.Code)
+	}
+	if ct := rec.Header().Get("Content-Type"); ct != "application/json" {
+		t.Errorf("want Content-Type application/json, got %q", ct)
+	}
+	var body map[string]any
+	if err := json.NewDecoder(rec.Body).Decode(&body); err != nil {
+		t.Fatalf("response body is not valid JSON: %v", err)
+	}
+	if body["code"] != "UNAUTHENTICATED" {
+		t.Errorf("want code UNAUTHENTICATED, got %q", body["code"])
+	}
+}
+
 func TestAuthMiddleware_RSAPublicKeyVerifier(t *testing.T) {
 	verifier := NewRSAPublicKeyVerifier(&testRSAKey.PublicKey)
 	pair, _ := IssueTokenPair(testRSA, "uid1", nil, testCfg)

signer.go

@@ -42,7 +42,7 @@ func (s *hmacSigner) Verify(tokenString string) (*jwt.Token, error) {
 			return nil, fmt.Errorf("unexpected signing method %q", t.Header["alg"])
 		}
 		return s.secret, nil
-	})
+	}, jwt.WithJSONNumber())
 }
 
 // --- RSA (RS256) ---
@@ -89,7 +89,7 @@ func (s *rsaSigner) Verify(tokenString string) (*jwt.Token, error) {
 			return nil, fmt.Errorf("unexpected signing method %q", t.Header["alg"])
 		}
 		return s.public, nil
-	})
+	}, jwt.WithJSONNumber())
 }
 
 // --- RSA public-key-only verifier ---
@@ -129,5 +129,5 @@ func (v *rsaPublicVerifier) Verify(tokenString string) (*jwt.Token, error) {
 			return nil, fmt.Errorf("unexpected signing method %q", t.Header["alg"])
 		}
 		return v.public, nil
-	})
+	}, jwt.WithJSONNumber())
 }