box: update github.com/golang-jwt/jwt from v4 to v5

jwt v5 removes StandardClaims so use RegisteredClaims instead. v5
sends a single audience as an array of strings, so the audience is
overridden in boxCustomClaims to keep sending it as a string as
before.

This adds a test which checks the JWT assertion sent to the token
endpoint is identical to the one sent with jwt v4.

backend/box/box.go

@@ -27,7 +27,7 @@ import (
 	"sync/atomic"
 	"time"
 
-	"github.com/golang-jwt/jwt/v4"
+	"github.com/golang-jwt/jwt/v5"
 	"github.com/rclone/rclone/backend/box/api"
 	"github.com/rclone/rclone/fs"
 	"github.com/rclone/rclone/fs/config"
@@ -77,7 +77,10 @@ var (
 )
 
 type boxCustomClaims struct {
-	jwt.StandardClaims
+	jwt.RegisteredClaims
+	// Audience overrides RegisteredClaims.Audience so it is sent as
+	// a single string rather than an array of strings
+	Audience   string `json:"aud,omitempty"`
 	BoxSubType string `json:"box_sub_type,omitempty"`
 }
 
@@ -243,15 +246,13 @@ func getClaims(boxConfig *api.ConfigJSON, boxSubType string) (claims *boxCustomC
 	}
 
 	claims = &boxCustomClaims{
-		//lint:ignore SA1019 since we need to use jwt.StandardClaims even if deprecated in jwt-go v4 until a more permanent solution is ready in time before jwt-go v5 where it is removed entirely
-		//nolint:staticcheck // Don't include staticcheck when running golangci-lint to avoid SA1019
-		StandardClaims: jwt.StandardClaims{
-			Id:        val,
+		RegisteredClaims: jwt.RegisteredClaims{
+			ID:        val,
 			Issuer:    boxConfig.BoxAppSettings.ClientID,
 			Subject:   boxConfig.EnterpriseID,
-			Audience:  tokenURL,
-			ExpiresAt: time.Now().Add(time.Second * 45).Unix(),
+			ExpiresAt: jwt.NewNumericDate(time.Now().Add(time.Second * 45)),
 		},
+		Audience:   tokenURL,
 		BoxSubType: boxSubType,
 	}
 	return claims, nil

backend/box/box_internal_test.go

@@ -1,15 +1,109 @@
 package box
 
 import (
+	"crypto"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
+	"time"
 
+	"github.com/rclone/rclone/backend/box/api"
 	"github.com/rclone/rclone/fs/config/configmap"
+	"github.com/rclone/rclone/lib/jwtutil"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
+// decodeJWTPart decodes one base64url encoded part of a JWT into a map
+func decodeJWTPart(t *testing.T, part string) map[string]any {
+	data, err := base64.RawURLEncoding.DecodeString(part)
+	require.NoError(t, err)
+	var result map[string]any
+	require.NoError(t, json.Unmarshal(data, &result))
+	return result
+}
+
+// Test the JWT assertion sent to the token endpoint is in the format Box expects
+func TestJWTAssertion(t *testing.T) {
+	privateKey, err := rsa.GenerateKey(rand.Reader, 2048)
+	require.NoError(t, err)
+	boxConfig := &api.ConfigJSON{
+		BoxAppSettings: api.AppSettings{
+			ClientID:     "client-id",
+			ClientSecret: "client-secret",
+			AppAuth: api.AppAuth{
+				PublicKeyID: "public-key-id",
+			},
+		},
+		EnterpriseID: "enterprise-id",
+	}
+
+	var form map[string][]string
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, "POST", r.Method)
+		assert.NoError(t, r.ParseForm())
+		form = r.PostForm
+		_, _ = w.Write([]byte(`{"access_token":"access-token","token_type":"bearer","expires_in":3600}`))
+	}))
+	defer ts.Close()
+
+	claims, err := getClaims(boxConfig, "enterprise")
+	require.NoError(t, err)
+	m := configmap.Simple{}
+	start := time.Now()
+	err = jwtutil.Config("box", "test", ts.URL, *claims, getSigningHeaders(boxConfig), getQueryParams(boxConfig), privateKey, m, ts.Client())
+	require.NoError(t, err)
+
+	// Check the token was stored
+	assert.Contains(t, m["token"], `"access_token":"access-token"`)
+
+	// Check the form parameters
+	assert.Equal(t, []string{"urn:ietf:params:oauth:grant-type:jwt-bearer"}, form["grant_type"])
+	assert.Equal(t, []string{"client-id"}, form["client_id"])
+	assert.Equal(t, []string{"client-secret"}, form["client_secret"])
+	require.Len(t, form["assertion"], 1)
+	parts := strings.Split(form["assertion"][0], ".")
+	require.Len(t, parts, 3)
+
+	// Check the signature independently of the JWT library
+	signature, err := base64.RawURLEncoding.DecodeString(parts[2])
+	require.NoError(t, err)
+	hash := sha256.Sum256([]byte(parts[0] + "." + parts[1]))
+	require.NoError(t, rsa.VerifyPKCS1v15(&privateKey.PublicKey, crypto.SHA256, hash[:], signature))
+
+	// Check the header
+	assert.Equal(t, map[string]any{
+		"alg": "RS256",
+		"typ": "JWT",
+		"kid": "public-key-id",
+	}, decodeJWTPart(t, parts[0]))
+
+	// Check the claims - aud must be a string, not an array
+	payload := decodeJWTPart(t, parts[1])
+	exp, ok := payload["exp"].(float64)
+	require.True(t, ok, "exp should be a number")
+	assert.InDelta(t, float64(start.Add(45*time.Second).Unix()), exp, 5)
+	jti, ok := payload["jti"].(string)
+	require.True(t, ok, "jti should be a string")
+	assert.Len(t, jti, 40)
+	delete(payload, "exp")
+	delete(payload, "jti")
+	assert.Equal(t, map[string]any{
+		"aud":          tokenURL,
+		"iss":          "client-id",
+		"sub":          "enterprise-id",
+		"box_sub_type": "enterprise",
+	}, payload)
+}
+
 // Test box_config_file has ~ and environment variables expanded
 func TestGetBoxConfigShellExpand(t *testing.T) {
 	dir := t.TempDir()

go.mod

@@ -277,7 +277,6 @@ require (
 	github.com/IBM/go-sdk-core/v5 v5.25.1
 	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/ProtonMail/go-crypto v1.5.2
-	github.com/golang-jwt/jwt/v4 v4.5.2
 	github.com/pkg/xattr v0.4.12
 	github.com/pquerna/otp v1.5.0
 	golang.org/x/mobile v0.0.0-20261011034528-197770444867

go.sum

@@ -276,8 +276,6 @@ github.com/gofrs/flock v0.13.1 h1:jjREztyBeSKBZYAC+mgc1laB+xsgy4kYMf3FbKF2UBo=
 github.com/gofrs/flock v0.13.1/go.mod h1:sf4BFiHwnvgxa25DlQoDqXQnwRMEOwqxRq37P6MzzmE=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
-github.com/golang-jwt/jwt/v4 v4.5.2 h1:YtQM7lnr8iZ+j5q71MGKkNw9Mn7AjHM68uc9g5fXeUI=
-github.com/golang-jwt/jwt/v4 v4.5.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
 github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=
 github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=

lib/jwtutil/jwtutil.go

@@ -14,7 +14,7 @@ import (
 	"strings"
 	"time"
 
-	"github.com/golang-jwt/jwt/v4"
+	"github.com/golang-jwt/jwt/v5"
 	"github.com/rclone/rclone/fs"
 	"github.com/rclone/rclone/fs/config/configmap"
 	"github.com/rclone/rclone/lib/oauthutil"