fix(authorization): inconsistent usage of DecodedJWT and Payload

slisson · slisson · commit 0d85f9f96443 · 2025-03-05T14:51:23.000+01:00
Some methods still expected a `DecodedJWT` where a `Payload` is sufficient.

BREAKING CHANGE: AccessTokenPrincipal was replaced by Ktors JWTPrincipal
diff --git a/authorization/src/main/kotlin/org/modelix/authorization/AccessTokenPrincipal.kt b/authorization/src/main/kotlin/org/modelix/authorization/AccessTokenPrincipal.kt
diff --git a/authorization/src/main/kotlin/org/modelix/authorization/AuthorizationPlugin.kt b/authorization/src/main/kotlin/org/modelix/authorization/AuthorizationPlugin.kt
@@ -22,6 +22,7 @@ import io.ktor.server.auth.AuthenticationContext
 import io.ktor.server.auth.AuthenticationProvider
 import io.ktor.server.auth.UnauthorizedResponse
 import io.ktor.server.auth.authenticate
+import io.ktor.server.auth.jwt.JWTPrincipal
 import io.ktor.server.auth.jwt.jwt
 import io.ktor.server.auth.parseAuthorizationHeader
 import io.ktor.server.auth.principal
@@ -75,20 +76,18 @@ object ModelixAuthorization : BaseRouteScopedPlugin<IModelixAuthorizationConfig,
                             .withIssuer("modelix")
                             .withAudience("modelix")
                             .withClaim(KeycloakTokenConstants.EMAIL, "unit-tests@example.com")
-                            .sign(Algorithm.HMAC256("unit-tests"))
-                        // The signing algorithm and key isn't relevant because the token is already considered valid
-                        // and the signature is never checked.
-                        context.principal(AccessTokenPrincipal(JWT.decode(token)))
+                            .sign(Algorithm.none())
+                        context.principal(JWTPrincipal(JWT.decode(token)))
                     }
                 })
             } else {
                 // "Authorization: Bearer ..." header is provided in the header by OAuth proxy
                 jwt(MODELIX_JWT_AUTH) {
                     realm = "modelix"
                     authHeader { call ->
-                        call.request.parseAuthorizationHeader()
-                            ?: call.request.headers["X-Forwarded-Access-Token"]
-                                ?.let { HttpAuthHeader.Single("Bearer", it) }
+                        call.request.headers["X-Forwarded-Access-Token"]
+                            ?.let { HttpAuthHeader.Single("Bearer", it) }
+                            ?: call.request.parseAuthorizationHeader()
                     }
 
                     verifier(config.getVerifier())
@@ -118,7 +117,7 @@ object ModelixAuthorization : BaseRouteScopedPlugin<IModelixAuthorizationConfig,
                             accessControlPersistence.recordKnownUser(authConfig.jwtUtil.extractUserId(jwt))
                             accessControlPersistence.recordKnownRoles(authConfig.jwtUtil.extractUserRoles(jwt))
                         }
-                        AccessTokenPrincipal(jwt)
+                        JWTPrincipal(jwt)
                     }
                 }
             }
@@ -153,7 +152,7 @@ object ModelixAuthorization : BaseRouteScopedPlugin<IModelixAuthorizationConfig,
                 (installedIntoRoute ?: this).apply {
                     if (config.debugEndpointsEnabled) {
                         get("/user") {
-                            val jwt = call.jwtFromHeaders()
+                            val jwt = call.getUnverifiedJwt()
                             if (jwt == null) {
                                 call.respondText("No JWT token available")
                             } else {
@@ -195,7 +194,7 @@ class ModelixAuthorizationPluginInstance(val config: ModelixAuthorizationConfig)
 
     private val permissionCache = CacheBuilder.newBuilder()
         .expireAfterWrite(5, TimeUnit.SECONDS)
-        .build<Pair<AccessTokenPrincipal, PermissionInstanceReference>, Boolean>()
+        .build<Pair<PayloadAsKey, PermissionInstanceReference>, Boolean>()
 
     fun hasPermission(call: ApplicationCall, permissionToCheck: PermissionParts): Boolean {
         return hasPermission(call, PermissionParser(config.permissionSchema).parse(permissionToCheck))
@@ -204,8 +203,8 @@ class ModelixAuthorizationPluginInstance(val config: ModelixAuthorizationConfig)
     fun hasPermission(call: ApplicationCall, permissionToCheck: PermissionInstanceReference): Boolean {
         if (!config.permissionCheckingEnabled()) return true
 
-        val principal = call.principal<AccessTokenPrincipal>() ?: throw NotLoggedInException()
-        return permissionCache.get(principal to permissionToCheck) {
+        val principal = call.principal<JWTPrincipal>() ?: throw NotLoggedInException()
+        return permissionCache.get(PayloadAsKey(principal.payload) to permissionToCheck) {
             getPermissionEvaluator(principal).hasPermission(permissionToCheck)
         }
     }
@@ -214,7 +213,7 @@ class ModelixAuthorizationPluginInstance(val config: ModelixAuthorizationConfig)
         return getPermissionEvaluator(call.principal())
     }
 
-    fun getPermissionEvaluator(principal: AccessTokenPrincipal?): PermissionEvaluator {
+    fun getPermissionEvaluator(principal: JWTPrincipal?): PermissionEvaluator {
         val evaluator = createPermissionEvaluator()
         if (principal != null) {
             loadGrantedPermissions(principal, evaluator)
@@ -228,8 +227,8 @@ class ModelixAuthorizationPluginInstance(val config: ModelixAuthorizationConfig)
 
     fun createSchemaInstance() = SchemaInstance(config.permissionSchema)
 
-    fun loadGrantedPermissions(principal: AccessTokenPrincipal, evaluator: PermissionEvaluator) {
-        config.jwtUtil.loadGrantedPermissions(principal.jwt, evaluator)
+    fun loadGrantedPermissions(principal: JWTPrincipal, evaluator: PermissionEvaluator) {
+        config.jwtUtil.loadGrantedPermissions(principal.payload, evaluator)
     }
 }
 
diff --git a/authorization/src/main/kotlin/org/modelix/authorization/KtorAuthUtils.kt b/authorization/src/main/kotlin/org/modelix/authorization/KtorAuthUtils.kt
@@ -7,10 +7,10 @@ import io.ktor.http.auth.AuthScheme
 import io.ktor.http.auth.HttpAuthHeader
 import io.ktor.server.application.Application
 import io.ktor.server.application.ApplicationCall
-import io.ktor.server.application.call
 import io.ktor.server.application.install
 import io.ktor.server.application.plugin
 import io.ktor.server.auth.authenticate
+import io.ktor.server.auth.jwt.JWTPrincipal
 import io.ktor.server.auth.parseAuthorizationHeader
 import io.ktor.server.auth.principal
 import io.ktor.server.request.header
@@ -41,7 +41,7 @@ fun RoutingContext.checkPermission(permissionParts: PermissionParts) {
 
 fun ApplicationCall.checkPermission(permissionToCheck: PermissionParts) {
     if (!hasPermission(permissionToCheck)) {
-        val principal = principal<AccessTokenPrincipal>()
+        val principal = principal<JWTPrincipal>()
         throw NoPermissionException(principal, null, null, "${principal?.getUserName()} has no permission '$permissionToCheck'")
     }
 }
@@ -76,19 +76,17 @@ fun ApplicationCall.getBearerToken(): String? {
     return tokenString
 }
 
-fun ApplicationCall.jwtFromHeaders(): DecodedJWT? {
+fun ApplicationCall.getUnverifiedJwt(): DecodedJWT? {
     // OAuth proxy passes the ID token as the bearer token, but we need the access token.
     return (request.header("X-Forwarded-Access-Token") ?: getBearerToken())?.let { JWT.decode(it) }
 }
 
-fun ApplicationCall.jwt() = principal<AccessTokenPrincipal>()?.jwt ?: jwtFromHeaders()
-
 fun RoutingContext.getUserName(): String? {
     return call.getUserName()
 }
 
 fun ApplicationCall.getUserName(): String? {
-    return principal<AccessTokenPrincipal>()?.getUserName()
+    return principal<JWTPrincipal>()?.getUserName()
 }
 
 @Deprecated("Use ModelixAuthorizationConfig.nullIfInvalid")
diff --git a/authorization/src/main/kotlin/org/modelix/authorization/ModelixJWTUtil.kt b/authorization/src/main/kotlin/org/modelix/authorization/ModelixJWTUtil.kt
@@ -1,6 +1,5 @@
 package org.modelix.authorization
 
-import com.auth0.jwt.interfaces.DecodedJWT
 import com.auth0.jwt.interfaces.Payload
 import com.nimbusds.jose.JWSAlgorithm
 import com.nimbusds.jose.JWSHeader
@@ -37,6 +36,7 @@ import io.ktor.client.HttpClient
 import io.ktor.client.request.get
 import io.ktor.client.statement.bodyAsText
 import io.ktor.http.contentType
+import io.ktor.server.auth.jwt.JWTPrincipal
 import kotlinx.coroutines.runBlocking
 import org.modelix.authorization.permissions.PermissionEvaluator
 import org.modelix.authorization.permissions.Schema
@@ -229,19 +229,19 @@ class ModelixJWTUtil {
         return JWSObject(header, payload).also { it.sign(signer) }.serialize()
     }
 
-    fun isAccessToken(token: DecodedJWT): Boolean {
+    fun isAccessToken(token: Payload): Boolean {
         return extractPermissions(token) != null
     }
 
-    fun isIdentityToken(token: DecodedJWT): Boolean {
+    fun isIdentityToken(token: Payload): Boolean {
         return !isAccessToken(token)
     }
 
-    fun createPermissionEvaluator(token: DecodedJWT, schema: Schema): PermissionEvaluator {
+    fun createPermissionEvaluator(token: Payload, schema: Schema): PermissionEvaluator {
         return createPermissionEvaluator(token, SchemaInstance(schema))
     }
 
-    fun createPermissionEvaluator(token: DecodedJWT, schema: SchemaInstance): PermissionEvaluator {
+    fun createPermissionEvaluator(token: Payload, schema: SchemaInstance): PermissionEvaluator {
         return PermissionEvaluator(schema).also { loadGrantedPermissions(token, it) }
     }
 
@@ -388,3 +388,5 @@ class KtorResourceRetriever(val client: HttpClient) : AbstractRestrictedResource
         }
     }
 }
+
+fun JWTPrincipal.getUserName(): String? = ModelixJWTUtil.extractUserId(payload)
diff --git a/authorization/src/main/kotlin/org/modelix/authorization/NoPermissionException.kt b/authorization/src/main/kotlin/org/modelix/authorization/NoPermissionException.kt
@@ -1,10 +1,12 @@
 package org.modelix.authorization
 
-class NoPermissionException(val user: AccessTokenPrincipal?, val resourceId: String?, val scope: String?, message: String) :
+import io.ktor.server.auth.jwt.JWTPrincipal
+
+class NoPermissionException(val user: JWTPrincipal?, val resourceId: String?, val scope: String?, message: String) :
     RuntimeException(message) {
 
     constructor(message: String) :
         this(null, null, null, message)
-    constructor(user: AccessTokenPrincipal, permissionId: String, type: String) :
+    constructor(user: JWTPrincipal, permissionId: String, type: String) :
         this(user, permissionId, type, "${user.getUserName()} has no $type permission on '$permissionId'")
 }
diff --git a/authorization/src/main/kotlin/org/modelix/authorization/PayloadAsKey.kt b/authorization/src/main/kotlin/org/modelix/authorization/PayloadAsKey.kt
@@ -0,0 +1,18 @@
+package org.modelix.authorization
+
+import com.auth0.jwt.interfaces.Payload
+
+/**
+ * Payload implementations usually don't implement equals/hashCode
+ */
+class PayloadAsKey(val payload: Payload) {
+
+    override fun equals(other: Any?): Boolean {
+        if (other !is PayloadAsKey) return false
+        return other.payload.claims == payload.claims
+    }
+
+    override fun hashCode(): Int {
+        return payload.claims.hashCode()
+    }
+}
diff --git a/authorization/src/main/kotlin/org/modelix/authorization/PermissionManagementPage.kt b/authorization/src/main/kotlin/org/modelix/authorization/PermissionManagementPage.kt
@@ -2,17 +2,15 @@ package org.modelix.authorization
 
 import io.ktor.http.encodeURLPathPart
 import io.ktor.server.application.ApplicationCall
-import io.ktor.server.application.application
-import io.ktor.server.application.call
 import io.ktor.server.application.plugin
+import io.ktor.server.auth.jwt.JWTPrincipal
 import io.ktor.server.auth.principal
 import io.ktor.server.html.respondHtml
 import io.ktor.server.request.receiveParameters
 import io.ktor.server.response.respond
 import io.ktor.server.response.respondRedirect
 import io.ktor.server.routing.Route
 import io.ktor.server.routing.RoutingContext
-import io.ktor.server.routing.application
 import io.ktor.server.routing.get
 import io.ktor.server.routing.post
 import io.ktor.server.routing.route
@@ -359,7 +357,7 @@ fun ApplicationCall.canManagePermissions(resourceRef: ResourceInstanceReference)
 
 fun ApplicationCall.checkCanGranPermission(id: String) {
     if (!canGrantPermission(id)) {
-        val principal = principal<AccessTokenPrincipal>()
+        val principal = principal<JWTPrincipal>()
         throw NoPermissionException(principal, null, null, "${principal?.getUserName()} has no permission '$id'")
     }
 }
diff --git a/authorization/src/main/kotlin/org/modelix/authorization/permissions/AccessControlData.kt b/authorization/src/main/kotlin/org/modelix/authorization/permissions/AccessControlData.kt
@@ -1,13 +1,11 @@
 package org.modelix.authorization.permissions
 
-import com.auth0.jwt.interfaces.DecodedJWT
+import com.auth0.jwt.interfaces.Payload
 import kotlinx.serialization.Serializable
-import kotlinx.serialization.encodeToString
 import kotlinx.serialization.json.Json
 import org.modelix.authorization.IAccessControlDataProvider
 import org.modelix.authorization.ModelixJWTUtil
 import java.io.File
-import kotlin.collections.get
 
 @Serializable
 data class AccessControlData(
@@ -30,7 +28,7 @@ data class AccessControlData(
      * Identity tokens, unlike access tokens, don't have any permissions encoded in the token.
      * The resource server then is expected to know which permissions the user has.
      */
-    fun load(jwt: DecodedJWT, permissionEvaluator: PermissionEvaluator) {
+    fun load(jwt: Payload, permissionEvaluator: PermissionEvaluator) {
         val util = ModelixJWTUtil()
         if (util.isAccessToken(jwt)) {
             // The purpose of an access token is to restrict the permissions to the ones specified in the token.

Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,5 @@`
`1`	`1`	`package org.modelix.authorization`
`2`	`2`
`3`		`-import com.auth0.jwt.interfaces.DecodedJWT`
`4`	`3`	`import com.auth0.jwt.interfaces.Payload`
`5`	`4`	`import com.nimbusds.jose.JWSAlgorithm`
`6`	`5`	`import com.nimbusds.jose.JWSHeader`
`@@ -37,6 +36,7 @@ import io.ktor.client.HttpClient`
`37`	`36`	`import io.ktor.client.request.get`
`38`	`37`	`import io.ktor.client.statement.bodyAsText`
`39`	`38`	`import io.ktor.http.contentType`
	`39`	`+import io.ktor.server.auth.jwt.JWTPrincipal`
`40`	`40`	`import kotlinx.coroutines.runBlocking`
`41`	`41`	`import org.modelix.authorization.permissions.PermissionEvaluator`
`42`	`42`	`import org.modelix.authorization.permissions.Schema`
`@@ -229,19 +229,19 @@ class ModelixJWTUtil {`
`229`	`229`	`return JWSObject(header, payload).also { it.sign(signer) }.serialize()`
`230`	`230`	`}`
`231`	`231`
`232`		`- fun isAccessToken(token: DecodedJWT): Boolean {`
	`232`	`+ fun isAccessToken(token: Payload): Boolean {`
`233`	`233`	`return extractPermissions(token) != null`
`234`	`234`	`}`
`235`	`235`
`236`		`- fun isIdentityToken(token: DecodedJWT): Boolean {`
	`236`	`+ fun isIdentityToken(token: Payload): Boolean {`
`237`	`237`	`return !isAccessToken(token)`
`238`	`238`	`}`
`239`	`239`
`240`		`- fun createPermissionEvaluator(token: DecodedJWT, schema: Schema): PermissionEvaluator {`
	`240`	`+ fun createPermissionEvaluator(token: Payload, schema: Schema): PermissionEvaluator {`
`241`	`241`	`return createPermissionEvaluator(token, SchemaInstance(schema))`
`242`	`242`	`}`
`243`	`243`
`244`		`- fun createPermissionEvaluator(token: DecodedJWT, schema: SchemaInstance): PermissionEvaluator {`
	`244`	`+ fun createPermissionEvaluator(token: Payload, schema: SchemaInstance): PermissionEvaluator {`
`245`	`245`	`return PermissionEvaluator(schema).also { loadGrantedPermissions(token, it) }`
`246`	`246`	`}`
`247`	`247`
`@@ -388,3 +388,5 @@ class KtorResourceRetriever(val client: HttpClient) : AbstractRestrictedResource`
`388`	`388`	`}`
`389`	`389`	`}`
`390`	`390`	`}`
	`391`	`+`
	`392`	`+fun JWTPrincipal.getUserName(): String? = ModelixJWTUtil.extractUserId(payload)`