Adding CF claims and HMAC signing verification.4

Signed-off-by: Dawid Nowak <nowakd@gmail.com>

Author: dawid-nowak

crates/contextforge-gateway-rs-lib/src/layers/claims_id.rs

@@ -74,31 +74,117 @@ pub async fn claims_layer(
 #[cfg(test)]
 mod test {
 
+    use std::sync::{Arc, Once};
+
+    use async_trait::async_trait;
+    use axum::{Router, body::Body, middleware, response::Response, routing::get};
+    use contextforge_gateway_rs_apis::{User, user_store::UserConfig};
+    use http::{HeaderMap, Request, StatusCode};
     use jsonwebtoken::{DecodingKey, Validation};
+    use tower::ServiceExt;
 
     use crate::{
-        common::ContextForgeClaims,
+        Config,
+        common::{ContextForgeClaims, ContextForgeGatewayAppState, JwtTokenDecoders},
         const_values::{CONTEXT_FORGE_GATEWAY_AUDIENCE, CONTEXT_FORGE_GATEWAY_ISSUER},
+        layers::claims_id::claims_layer,
+        tests,
+        user_config_store::{ConfigStoreError, UserConfigStore},
     };
 
-    #[test]
-    fn claim_test() {
-        rustls::crypto::ring::default_provider().install_default().expect("Failed to install rustls crypto provider");
+    static CRYPTO: Once = Once::new();
+
+    struct MockedUserConfigStore;
+    #[async_trait]
+    impl UserConfigStore for MockedUserConfigStore {
+        async fn get_config<'a>(&self, _: &'a User) -> Result<UserConfig, ConfigStoreError> {
+            Err(ConfigStoreError::InvalidConnection)
+        }
+
+        async fn set_config<'a>(&self, _: &'a User, _: &'a UserConfig) -> Result<(), ConfigStoreError> {
+            Err(ConfigStoreError::InvalidConnection)
+        }
+    }
+
+    #[tokio::test(flavor = "multi_thread", worker_threads = 1)]
+    #[allow(clippy::items_after_statements)]
+    async fn claim_test_valid_hmac() {
+        CRYPTO.call_once(|| {
+            rustls::crypto::ring::default_provider()
+                .install_default()
+                .expect("Failed to install rustls crypto provider");
+        });
+
+        async fn handle(_: HeaderMap) -> Response {
+            Response::builder().status(StatusCode::OK).body(Body::empty()).expect("Expecting this to work")
+        }
 
         let token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJhZG1pbkBleGFtcGxlLmNvbSIsImp0aSI6Ijc1ZWYwZTZjLTZkZWMtNGExNy1hNzU3LWFlYmYzZjk1N2Q1NSIsInRva2VuX3VzZSI6ImFwaSIsImlhdCI6MTc3ODg2NTE2OCwiaXNzIjoibWNwZ2F0ZXdheSIsImF1ZCI6Im1jcGdhdGV3YXktYXBpIiwidXNlciI6eyJlbWFpbCI6ImFkbWluQGV4YW1wbGUuY29tIiwiZnVsbF9uYW1lIjoiQVBJIFRva2VuIFVzZXIiLCJpc19hZG1pbiI6dHJ1ZSwiYXV0aF9wcm92aWRlciI6ImFwaV90b2tlbiJ9LCJ0ZWFtcyI6bnVsbCwic2NvcGVzIjp7InNlcnZlcl9pZCI6bnVsbCwicGVybWlzc2lvbnMiOltdLCJpcF9yZXN0cmljdGlvbnMiOltdLCJ0aW1lX3Jlc3RyaWN0aW9ucyI6e319LCJleHAiOjE3ODE0NTcxNjh9.9d2-iLOHL2dJRFTSbOxHzuD6zLxupqK0ZkCG-3GZABU";
 
-        let Ok(header) = jsonwebtoken::decode_header(token) else {
-            panic!();
+        let mut validation = Validation::new(jsonwebtoken::Algorithm::HS256);
+        validation.set_audience(&[CONTEXT_FORGE_GATEWAY_AUDIENCE]);
+        validation.set_issuer(&[CONTEXT_FORGE_GATEWAY_ISSUER]);
+        validation.validate_exp = false;
+
+        let decoding_key = DecodingKey::from_secret("my-test-key-but-now-longer-than-32-bytes".as_bytes());
+
+        let state = ContextForgeGatewayAppState {
+            jwt_token_decoding_keys: JwtTokenDecoders { rs: None, hmac_sha: Some(decoding_key) },
+            config_store: Arc::new(MockedUserConfigStore {}),
+            config: Config::default(),
         };
+        let http_requst = Request::builder()
+            .header("Authorization", format!("Bearer {token}"))
+            .method("GET")
+            .body(Body::empty())
+            .expect("This should work");
+
+        let app =
+            Router::new().route("/", get(handle)).layer(middleware::from_fn_with_state(state.clone(), claims_layer));
+
+        let res = app.oneshot(http_requst).await.unwrap();
+        assert_eq!(res.status(), StatusCode::OK);
+    }
+
+    #[tokio::test(flavor = "multi_thread", worker_threads = 1)]
+    #[allow(clippy::items_after_statements)]
+    async fn claim_test_expired_token() {
+        CRYPTO.call_once(|| {
+            rustls::crypto::ring::default_provider()
+                .install_default()
+                .expect("Failed to install rustls crypto provider");
+        });
+
+        async fn handle(_: HeaderMap) -> Response {
+            Response::builder().status(StatusCode::OK).body(Body::empty()).expect("Expecting this to work")
+        }
 
-        let mut validation = Validation::new(header.alg);
+        let mut claims = ContextForgeClaims::new("blah@blah.com");
+        claims.exp = 0;
+        let token = tests::gateway_end_to_end::get_token_for_claims(&claims);
+
+        let mut validation = Validation::new(jsonwebtoken::Algorithm::RS256);
         validation.set_audience(&[CONTEXT_FORGE_GATEWAY_AUDIENCE]);
         validation.set_issuer(&[CONTEXT_FORGE_GATEWAY_ISSUER]);
-        validation.validate_exp = false;
+        validation.validate_exp = true;
 
         let decoding_key = DecodingKey::from_secret("my-test-key-but-now-longer-than-32-bytes".as_bytes());
 
-        let maybe_valid = jsonwebtoken::decode::<ContextForgeClaims>(token, &decoding_key, &validation);
-        maybe_valid.expect("token invalid");
+        let state = ContextForgeGatewayAppState {
+            jwt_token_decoding_keys: JwtTokenDecoders { rs: None, hmac_sha: Some(decoding_key) },
+            config_store: Arc::new(MockedUserConfigStore {}),
+            config: Config::default(),
+        };
+        let http_requst = Request::builder()
+            .header("Authorization", format!("Bearer {token}"))
+            .method("GET")
+            .body(Body::empty())
+            .expect("This should work");
+
+        let app =
+            Router::new().route("/", get(handle)).layer(middleware::from_fn_with_state(state.clone(), claims_layer));
+
+        let res = app.oneshot(http_requst).await.unwrap();
+        assert_eq!(res.status(), StatusCode::UNAUTHORIZED);
     }
 }

crates/contextforge-gateway-rs-lib/src/tests/gateway_end_to_end.rs

@@ -104,15 +104,17 @@ async fn create_axum_tls_servers(ports: &[u16], router: axum::Router) -> Vec<Box
         .collect()
 }
 
-pub fn get_token(user_id: &str) -> String {
+pub fn get_token_for_claims(claims: &ContextForgeClaims) -> String {
     let key = EncodingKey::from_rsa_pem(&fs::read("../../assets/jwt.key").expect("Expecting this to work"))
         .expect("Expecting this to work");
     let mut header = Header::new(Algorithm::RS256);
     header.kid = Some("test".to_owned());
 
-    let claims = ContextForgeClaims::new(user_id);
+    encode::<ContextForgeClaims>(&header, claims, &key).expect("Expecting this to work")
+}
 
-    encode::<ContextForgeClaims>(&header, &claims, &key).expect("Expecting this to work")
+pub fn get_token(user_id: &str) -> String {
+    get_token_for_claims(&ContextForgeClaims::new(user_id))
 }
 
 struct TestSettings {
@@ -161,7 +163,6 @@ async fn create_gateway_with_four_counters(user: &str, config: Config) -> crate:
 
     let gateway = Gateway::builder()
         .with_config(config.clone())
-        //.with_user_config_store(Arc::new(mocked_user_config_store))
         .with_session_manager(Arc::new(LocalSessionManager::default()))
         .with_user_config_store_type(crate::UserConfigStoreType::Test(Arc::new(mocked_user_config_store)))
         .build();

crates/contextforge-gateway-rs-lib/src/tests/mod.rs

@@ -1,3 +1,3 @@
-mod gateway_end_to_end;
+pub mod gateway_end_to_end;
 mod mock_counter;
 mod mocked_user_config_store;