123 lines
3.4 KiB
Rust
123 lines
3.4 KiB
Rust
pub mod middleware;
|
|
|
|
use anyhow::Result;
|
|
use chrono::Utc;
|
|
use jsonwebtoken::{decode, encode, DecodingKey, EncodingKey, Header, Validation};
|
|
use serde::{Deserialize, Serialize};
|
|
use sha2::{Digest, Sha256};
|
|
use uuid::Uuid;
|
|
|
|
#[allow(dead_code)]
|
|
pub mod permissions {
|
|
pub const READ: u128 = 1;
|
|
pub const WRITE: u128 = 2;
|
|
pub const DELETE: u128 = 4;
|
|
pub const ADMIN_QUERY: u128 = 8;
|
|
pub const ADMIN_CACHE: u128 = 16;
|
|
pub const SUPER_ADMIN: u128 = 32;
|
|
}
|
|
|
|
#[derive(Debug, Clone, Serialize, Deserialize)]
|
|
pub struct Claims {
|
|
pub sub: String,
|
|
pub permissions: String, // u128 stored as decimal string
|
|
pub exp: usize,
|
|
}
|
|
|
|
impl Claims {
|
|
pub fn permissions_mask(&self) -> u128 {
|
|
self.permissions.parse().unwrap_or(0)
|
|
}
|
|
|
|
pub fn has_permission(&self, bit: u128) -> bool {
|
|
self.permissions_mask() & bit != 0
|
|
}
|
|
}
|
|
|
|
pub fn encode_jwt(username: &str, mask: u128, secret: &str, expiry_secs: u64) -> Result<String> {
|
|
let exp = (Utc::now().timestamp() as u64 + expiry_secs) as usize;
|
|
let claims = Claims {
|
|
sub: username.to_string(),
|
|
permissions: mask.to_string(),
|
|
exp,
|
|
};
|
|
let token = encode(
|
|
&Header::default(),
|
|
&claims,
|
|
&EncodingKey::from_secret(secret.as_bytes()),
|
|
)?;
|
|
Ok(token)
|
|
}
|
|
|
|
/// Generates a new API key: `mrc_<32 random hex chars>`.
|
|
/// Returns `(plain_key, key_prefix, key_hash)`.
|
|
pub fn generate_api_key() -> (String, String, String) {
|
|
let raw = format!("{}{}", Uuid::new_v4().simple(), Uuid::new_v4().simple());
|
|
let key = format!("mrc_{}", raw);
|
|
let prefix = raw[..8].to_string();
|
|
let hash = hash_api_key(&key);
|
|
(key, prefix, hash)
|
|
}
|
|
|
|
pub fn hash_api_key(key: &str) -> String {
|
|
format!("{:x}", Sha256::digest(key.as_bytes()))
|
|
}
|
|
|
|
/// Resolves an API key token against the database.
|
|
/// Updates `last_used_at` on success.
|
|
pub async fn resolve_api_key(token: &str, pool: &sqlx::PgPool) -> Option<Claims> {
|
|
if !token.starts_with("mrc_") {
|
|
return None;
|
|
}
|
|
let hash = hash_api_key(token);
|
|
let row: (String, String) = sqlx::query_as(
|
|
"UPDATE api_keys SET last_used_at = now()
|
|
WHERE key_hash = $1 AND (expires_at IS NULL OR expires_at > now())
|
|
RETURNING name, permissions_mask",
|
|
)
|
|
.bind(&hash)
|
|
.fetch_optional(pool)
|
|
.await
|
|
.ok()??;
|
|
|
|
Some(Claims {
|
|
sub: row.0,
|
|
permissions: row.1,
|
|
exp: usize::MAX,
|
|
})
|
|
}
|
|
|
|
pub fn decode_jwt(token: &str, secret: &str) -> Result<Claims> {
|
|
let data = decode::<Claims>(
|
|
token,
|
|
&DecodingKey::from_secret(secret.as_bytes()),
|
|
&Validation::default(),
|
|
)?;
|
|
Ok(data.claims)
|
|
}
|
|
|
|
#[cfg(test)]
|
|
mod tests {
|
|
use super::*;
|
|
|
|
#[test]
|
|
fn test_encode_decode_roundtrip() {
|
|
let secret = "test_secret";
|
|
let token = encode_jwt("alice", 63u128, secret, 3600).unwrap();
|
|
let claims = decode_jwt(&token, secret).unwrap();
|
|
assert_eq!(claims.sub, "alice");
|
|
assert_eq!(claims.permissions_mask(), 63u128);
|
|
}
|
|
|
|
#[test]
|
|
fn test_has_permission() {
|
|
let claims = Claims {
|
|
sub: "bob".into(),
|
|
permissions: "9".into(), // READ (1) + ADMIN_QUERY (8)
|
|
exp: 9999999999,
|
|
};
|
|
assert!(claims.has_permission(permissions::READ));
|
|
assert!(claims.has_permission(permissions::ADMIN_QUERY));
|
|
assert!(!claims.has_permission(permissions::SUPER_ADMIN));
|
|
}
|
|
}
|