|
| 1 | +use std::collections::{BTreeMap, HashSet}; |
| 2 | +use std::sync::Arc; |
| 3 | + |
| 4 | +use jsonwebtoken::{Algorithm, EncodingKey, Header, encode, get_current_timestamp}; |
| 5 | +use objectstore_types::Permission; |
| 6 | +use serde::{Deserialize, Serialize}; |
| 7 | + |
| 8 | +use crate::ScopeInner; |
| 9 | + |
| 10 | +const DEFAULT_EXPIRY_SECONDS: u64 = 60; |
| 11 | +const DEFAULT_PERMISSIONS: [Permission; 3] = [ |
| 12 | + Permission::ObjectRead, |
| 13 | + Permission::ObjectWrite, |
| 14 | + Permission::ObjectDelete, |
| 15 | +]; |
| 16 | + |
| 17 | +/// Key configuration that will be used to sign tokens in Objectstore requests. |
| 18 | +pub struct SecretKey { |
| 19 | + /// A key ID that Objectstore must use to load the corresponding public key. |
| 20 | + pub kid: String, |
| 21 | + |
| 22 | + /// An EdDSA private key. |
| 23 | + pub secret_key: String, |
| 24 | +} |
| 25 | + |
| 26 | +impl std::fmt::Debug for SecretKey { |
| 27 | + fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result { |
| 28 | + f.debug_struct("SecretKey") |
| 29 | + .field("kid", &self.kid) |
| 30 | + .field("secret_key", &"[redacted]") |
| 31 | + .finish() |
| 32 | + } |
| 33 | +} |
| 34 | + |
| 35 | +/// A utility to generate auth tokens to be used in Objectstore requests. |
| 36 | +/// |
| 37 | +/// Tokens are signed with an EdDSA private key and have certain permissions and expiry timeouts |
| 38 | +/// applied. |
| 39 | +#[derive(Debug)] |
| 40 | +pub struct TokenGenerator { |
| 41 | + kid: String, |
| 42 | + encoding_key: EncodingKey, |
| 43 | + expiry_seconds: u64, |
| 44 | + permissions: HashSet<Permission>, |
| 45 | +} |
| 46 | + |
| 47 | +#[derive(Serialize, Deserialize)] |
| 48 | +struct JwtRes { |
| 49 | + #[serde(rename = "os:usecase")] |
| 50 | + usecase: String, |
| 51 | + |
| 52 | + #[serde(flatten)] |
| 53 | + scopes: BTreeMap<String, String>, |
| 54 | +} |
| 55 | + |
| 56 | +#[derive(Serialize, Deserialize)] |
| 57 | +struct JwtClaims { |
| 58 | + exp: u64, |
| 59 | + permissions: HashSet<Permission>, |
| 60 | + res: JwtRes, |
| 61 | +} |
| 62 | + |
| 63 | +impl TokenGenerator { |
| 64 | + /// Create a new [`TokenGenerator`] for a given key configuration. |
| 65 | + pub fn new(secret_key: SecretKey) -> crate::Result<TokenGenerator> { |
| 66 | + let encoding_key = EncodingKey::from_ed_pem(secret_key.secret_key.as_bytes())?; |
| 67 | + Ok(TokenGenerator { |
| 68 | + kid: secret_key.kid, |
| 69 | + encoding_key, |
| 70 | + expiry_seconds: DEFAULT_EXPIRY_SECONDS, |
| 71 | + permissions: HashSet::from(DEFAULT_PERMISSIONS), |
| 72 | + }) |
| 73 | + } |
| 74 | + |
| 75 | + /// Set the expiry duration for tokens signed by this generator. |
| 76 | + pub fn expiry_seconds(mut self, expiry_seconds: u64) -> Self { |
| 77 | + self.expiry_seconds = expiry_seconds; |
| 78 | + self |
| 79 | + } |
| 80 | + |
| 81 | + /// Set the permissions that will be granted to tokens signed by this generator. |
| 82 | + pub fn permissions(mut self, permissions: &[Permission]) -> Self { |
| 83 | + self.permissions = HashSet::from_iter(permissions.iter().cloned()); |
| 84 | + self |
| 85 | + } |
| 86 | + |
| 87 | + /// Sign a new token for the passed-in scope using the configured expiry and permissions. |
| 88 | + pub(crate) fn sign_for_scope(&self, scope: Arc<ScopeInner>) -> crate::Result<String> { |
| 89 | + let claims = JwtClaims { |
| 90 | + exp: get_current_timestamp() + self.expiry_seconds, |
| 91 | + permissions: self.permissions.clone(), |
| 92 | + res: JwtRes { |
| 93 | + usecase: scope.usecase().name().into(), |
| 94 | + scopes: scope |
| 95 | + .scopes() |
| 96 | + .iter() |
| 97 | + .map(|scope| (scope.name().to_string(), scope.value().to_string())) |
| 98 | + .collect(), |
| 99 | + }, |
| 100 | + }; |
| 101 | + |
| 102 | + let mut header = Header::new(Algorithm::EdDSA); |
| 103 | + header.kid = Some(self.kid.clone()); |
| 104 | + |
| 105 | + Ok(encode(&header, &claims, &self.encoding_key)?) |
| 106 | + } |
| 107 | +} |
0 commit comments