--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/spec/util_jwt_spec.lua	Thu Nov 05 22:31:25 2020 +0100
@@ -0,0 +1,20 @@
+local jwt = require "util.jwt";
+
+describe("util.jwt", function ()
+	it("validates", function ()
+		local key = "secret";
+		local token = jwt.sign(key, { payload = "this" });
+		assert.string(token);
+		local ok, parsed = jwt.verify(key, token);
+		assert.truthy(ok)
+		assert.same({ payload = "this" }, parsed);
+	end);
+	it("rejects invalid", function ()
+		local key = "secret";
+		local token = jwt.sign("wrong", { payload = "this" });
+		assert.string(token);
+		local ok = jwt.verify(key, token);
+		assert.falsy(ok)
+	end);
+end);
+