Add ES384 support

[sdrsdr]

Taste case plus I've verified to be correctly working against ES384 token from NodeJS system

[google-cla]

Thanks for your pull request. It looks like this may be your first contribution to a Google open source project (if not, look below for help). Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

📝 Please visit https://cla.developers.google.com/ to sign.

Once you've signed (or fixed any issues), please reply here with @googlebot I signed it! and we'll verify it.

---

What to do if you already signed the CLA

Individual signers

• It's possible we don't have your GitHub username or you're using a different email address on your commit. Check your existing CLA data and verify that your email is set on your git commits.

Corporate signers

• Your company has a Point of Contact who decides which employees are authorized to participate. Ask your POC to be added to the group of authorized contributors. If you don't know who your Point of Contact is, direct the Google project maintainer to go/cla#troubleshoot (Public version).
• The email used to register you as an authorized contributor must be the email used for the Git commit. Check your existing CLA data and verify that your email is set on your git commits.
• The email used to register you as an authorized contributor must also be attached to your GitHub account.

ℹ️ Googlers: Go here for more info.

[googlebot]

Thanks for your pull request. It looks like this may be your first contribution to a Google open source project (if not, look below for help). Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

📝 Please visit https://cla.developers.google.com/ to sign.

Once you've signed (or fixed any issues), please reply here with @googlebot I signed it! and we'll verify it.

---

What to do if you already signed the CLA

Individual signers

• It's possible we don't have your GitHub username or you're using a different email address on your commit. Check your existing CLA data and verify that your email is set on your git commits.

Corporate signers

• Your company has a Point of Contact who decides which employees are authorized to participate. Ask your POC to be added to the group of authorized contributors. If you don't know who your Point of Contact is, direct the Google project maintainer to go/cla#troubleshoot (Public version).
• The email used to register you as an authorized contributor must be the email used for the Git commit. Check your existing CLA data and verify that your email is set on your git commits.
• The email used to register you as an authorized contributor must also be attached to your GitHub account.

ℹ️ Googlers: Go here for more info.

[sdrsdr]

@googlebot I signed it!

[google-cla]

CLAs look good, thanks!

ℹ️ Googlers: Go here for more info.

[googlebot]

CLAs look good, thanks!

ℹ️ Googlers: Go here for more info.

[google-cla]

CLAs look good, thanks!

ℹ️ Googlers: Go here for more info.

[BramRoets]

@googlebot Is this blocked by anyhing? What can we do to get this merged? Thanks!

[sdrsdr]

I guess we need a review but this repo is quite dead IMHO

[BramRoets]

That's too bad .. I think it's the most used PHP JWT library at the moment...

[bshaffer]

@BramRoets @sdrsdr it's not dead yet!!

Sorry for the late reply, I missed this PR. This is a fantastic addition, I'll review / merge today!

[bshaffer]

When I switch both occurences of ES384 above to ES256, and likewise if I switch ES256 to ES384 in the test function testEncodeAndDecodeEcdsaToken, the tests still pass. Can we use test-cases which are not interchangeable?

Also, since these two tests are so similar, it would be better to use a data provider:

    /**
     * @runInSeparateProcess
     * @dataProvider provideEncodeAndDecodeToken
     */
    public function testEncodeAndDecodeToken($privateKeyFile, $publicKeyFile, $alg)
    {
        $privateKey = file_get_contents($privateKey);
        $payload = array('foo' => 'bar');
        $encoded = JWT::encode($payload, $privateKeyFile, $alg);

        // Verify decoding succeeds
        $publicKey = file_get_contents($publicKeyFile);
        $decoded = JWT::decode($encoded, $publicKey, array($alg));

        $this->assertEquals('bar', $decoded->foo);
    }

    public function provideEncodeAndDecodeToken()
    {
        return [
            [__DIR__ . '/ecdsa-private.pem', __DIR__ . '/ecdsa-public.pem', 'ES256'],
            [__DIR__ . '/ecdsa384-private.pem', __DIR__ . '/ecdsa384-public.pem', 'ES384'],
        ];
    }

[sdrsdr]

ES384 and ES256 are meant to be interchangeable the test should and will fail if you try to have only one place changed. I'm not really familiar with PHP code testing. PHP is not in my daily workset, I've long ago removed the setup on my pc needed for testing php code. Can you please merge it as is and then fix it to you liking?

[bshaffer]

will submit test refactor in another PR

[BramRoets]

@bshaffer Could you make a release including these changes? is there anything we can do to help this process?

Many thanks!

[bshaffer]

@BramRoets tagged in v5.3.0

[BramRoets]

Wow that was quick! Thanks for the help.