firejwt 0.1.2 → 0.3.2

data/ext_test.go

@@ -0,0 +1,6 @@
+package firejwt
+
+// Mocked creates a validator with a mock URL
+func Mocked(url string) (*Validator, error) {
+	return newValidator("mock-project", url)
+}

data/firejwt.gemspec

@@ -1,6 +1,6 @@
 Gem::Specification.new do |s|
   s.name          = 'firejwt'
-  s.version       = '0.1.2'
+  s.version       = '0.3.2'
   s.authors       = ['Black Square Media Ltd']
   s.email         = ['info@blacksquaremedia.com']
   s.summary       = %(Firebase JWT validation)
@@ -16,6 +16,6 @@ Gem::Specification.new do |s|
   s.add_dependency 'jwt'
   s.add_development_dependency 'rake'
   s.add_development_dependency 'rspec'
-  s.add_development_dependency 'rubocop'
+  s.add_development_dependency 'rubocop-bsm'
   s.add_development_dependency 'webmock'
 end

data/firejwt.go

@@ -6,28 +6,42 @@ import (
 	"crypto/x509"
 	"encoding/json"
 	"encoding/pem"
+	"errors"
 	"fmt"
 	"log"
 	"net/http"
 	"sync/atomic"
 	"time"
 
-	"github.com/dgrijalva/jwt-go"
+	"github.com/golang-jwt/jwt"
 )
 
+const defaultURL = "https://www.googleapis.com/robot/v1/metadata/x509/securetoken@system.gserviceaccount.com"
+
 // Validator validates Firebase JWTs
 type Validator struct {
-	opt *Options
-	htc http.Client
+	audience string
+	issuer   string
+	url      string
+	htc      http.Client
 
 	cancel  context.CancelFunc
 	keyset  atomic.Value
 	expires int64
 }
 
-// New issues a new Validator.
-func New(opt *Options) (*Validator, error) {
-	v := &Validator{opt: opt.norm()}
+// New issues a new Validator with a projectID, a unique identifier for your
+// Firebase project, which can be found in the URL of that project's console.
+func New(projectID string) (*Validator, error) {
+	return newValidator(projectID, defaultURL)
+}
+
+func newValidator(projectID, url string) (*Validator, error) {
+	v := &Validator{
+		audience: projectID,
+		issuer:   "https://securetoken.google.com/" + projectID,
+		url:      url,
+	}
 	if err := v.Refresh(); err != nil {
 		return nil, err
 	}
@@ -45,20 +59,15 @@ func (v *Validator) Stop() {
 }
 
 // Decode decodes the token
-func (v *Validator) Decode(tokenString string) (*jwt.Token, error) {
-	return jwt.Parse(tokenString, func(token *jwt.Token) (interface{}, error) {
-		kid, ok := token.Header["kid"].(string)
-		if !ok {
-			return nil, fmt.Errorf("missing kid header")
-		}
-
-		key, ok := v.keyset.Load().(map[string]publicKey)[kid]
-		if !ok {
-			return nil, fmt.Errorf("unknown kid header %s", kid)
-		}
-
-		return key.PublicKey, nil
-	})
+func (v *Validator) Decode(tokenString string) (*Claims, error) {
+	claims := new(Claims)
+	token, err := jwt.ParseWithClaims(tokenString, claims, v.verify)
+	if err != nil {
+		return nil, err
+	} else if !token.Valid {
+		return nil, errTokenInvalid
+	}
+	return claims, nil
 }
 
 // ExpTime returns the expiration time.
@@ -68,7 +77,7 @@ func (v *Validator) ExpTime() time.Time {
 
 // Refresh retrieves the latest keys.
 func (v *Validator) Refresh() error {
-	resp, err := v.htc.Get(v.opt.URL)
+	resp, err := v.htc.Get(v.url)
 	if err != nil {
 		return err
 	}
@@ -89,12 +98,51 @@ func (v *Validator) Refresh() error {
 	return nil
 }
 
+var (
+	errKIDMissing   = errors.New("missing kid header")
+	errExpired      = errors.New("token has expired")
+	errIssuedFuture = errors.New("issued in the future")
+	errNoSubject    = errors.New("subject is missing")
+	errAuthFuture   = errors.New("auth-time in the future")
+	errTokenInvalid = errors.New("token is invalid")
+)
+
+func (v *Validator) verify(token *jwt.Token) (interface{}, error) {
+	kid, ok := token.Header["kid"].(string)
+	if !ok {
+		return nil, errKIDMissing
+	}
+
+	key, ok := v.keyset.Load().(map[string]publicKey)[kid]
+	if !ok {
+		return nil, fmt.Errorf("invalid kid header %q", kid)
+	}
+
+	now := time.Now().Unix()
+	claims := token.Claims.(*Claims)
+	if claims.Audience != v.audience {
+		return nil, fmt.Errorf("invalid audience claim %q", claims.Audience)
+	} else if claims.Issuer != v.issuer {
+		return nil, fmt.Errorf("invalid issuer claim %q", claims.Issuer)
+	} else if claims.Subject == "" {
+		return nil, errNoSubject
+	} else if claims.ExpiresAt <= now {
+		return nil, errExpired
+	} else if claims.IssuedAt > now {
+		return nil, errIssuedFuture
+	} else if claims.AuthAt > now {
+		return nil, errAuthFuture
+	}
+
+	return key.PublicKey, nil
+}
+
 func (v *Validator) loop(ctx context.Context) {
 	t := time.NewTimer(time.Minute)
 	defer t.Stop()
 
 	for {
-		d := v.ExpTime().Sub(time.Now()) - time.Hour
+		d := time.Until(v.ExpTime()) - time.Hour
 		if d < time.Minute {
 			d = time.Minute
 		}
@@ -135,3 +183,33 @@ func (k *publicKey) UnmarshalText(data []byte) error {
 	*k = publicKey{PublicKey: cert.PublicKey.(*rsa.PublicKey)}
 	return nil
 }
+
+// --------------------------------------------------------------------
+
+// Claims are included in the token.
+type Claims struct {
+	Subject   string `json:"sub,omitempty"`
+	Audience  string `json:"aud,omitempty"`
+	Issuer    string `json:"iss,omitempty"`
+	IssuedAt  int64  `json:"iat,omitempty"`
+	ExpiresAt int64  `json:"exp,omitempty"`
+
+	Name          string         `json:"name,omitempty"`
+	Picture       string         `json:"picture,omitempty"`
+	UserID        string         `json:"user_id,omitempty"`
+	AuthAt        int64          `json:"auth_time,omitempty"`
+	Email         string         `json:"email,omitempty"`
+	EmailVerified bool           `json:"email_verified"`
+	Firebase      *FirebaseClaim `json:"firebase,omitempty"`
+}
+
+// FirebaseClaim represents firebase specific claim.
+type FirebaseClaim struct {
+	SignInProvider string              `json:"sign_in_provider,omitempty"`
+	Identities     map[string][]string `json:"identities,omitempty"`
+}
+
+// Valid implements the jwt.Claims interface.
+func (c *Claims) Valid() error {
+	return nil
+}

data/firejwt_test.go

@@ -1,50 +1,57 @@
 package firejwt_test
 
 import (
+	"bytes"
+	"crypto/rand"
 	"crypto/rsa"
+	"crypto/sha1"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/hex"
 	"encoding/json"
-	"io/ioutil"
+	"encoding/pem"
+	"math/big"
 	"net/http"
 	"net/http/httptest"
 	"testing"
 	"time"
 
 	"github.com/bsm/firejwt"
-	"github.com/dgrijalva/jwt-go"
-	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
+	. "github.com/bsm/ginkgo"
+	. "github.com/bsm/gomega"
+	"github.com/golang-jwt/jwt"
 )
 
 var _ = Describe("Validator", func() {
 	var subject *firejwt.Validator
 	var server *httptest.Server
+	var seeds *firejwt.Claims
 
-	const kid = "e5a91d9f39fa4de254a1e89df00f05b7e248b985"
+	generate := func() string {
+		token := jwt.NewWithClaims(jwt.SigningMethodRS256, seeds)
+		token.Header["kid"] = certKID
 
-	decode := func(method jwt.SigningMethod, claims *jwt.StandardClaims) (*jwt.Token, error) {
-		src := jwt.NewWithClaims(method, claims)
-		src.Header["kid"] = kid
-
-		str, err := src.SignedString(privKey)
+		data, err := token.SignedString(privKey)
 		Expect(err).NotTo(HaveOccurred())
-
-		return subject.Decode(str)
+		return data
 	}
 
 	BeforeEach(func() {
 		server = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
 			w.Header().Set("expires", "Mon, 20 Jan 2020 23:40:59 GMT")
-			json.NewEncoder(w).Encode(map[string]string{
-				kid: string(certPEM),
+			_ = json.NewEncoder(w).Encode(map[string]string{
+				certKID: string(certPEM),
 			})
 		}))
+		seeds = mockClaims(time.Now().Unix())
 
 		var err error
-		subject, err = firejwt.New(&firejwt.Options{URL: server.URL})
+		subject, err = firejwt.Mocked(server.URL)
 		Expect(err).NotTo(HaveOccurred())
 	})
 
 	AfterEach(func() {
+		server.Close()
 		subject.Stop()
 	})
 
@@ -53,28 +60,83 @@ var _ = Describe("Validator", func() {
 	})
 
 	It("should decode tokens", func() {
-		token, err := decode(jwt.SigningMethodRS256, &jwt.StandardClaims{
-			Subject:   "me@example.com",
-			Audience:  "you",
-			Issuer:    "me",
-			ExpiresAt: time.Now().Add(time.Hour).Unix(),
-		})
+		claims, err := subject.Decode(generate())
 		Expect(err).NotTo(HaveOccurred())
-		Expect(token.Valid).To(BeTrue())
-		Expect(token.Claims).To(HaveKeyWithValue("sub", "me@example.com"))
+		Expect(claims).To(Equal(seeds))
 	})
 
 	It("should reject bad tokens", func() {
-		_, err := subject.Decode("BADTOKEN")
+		_, err := subject.Decode("BAD")
 		Expect(err).To(MatchError(`token contains an invalid number of segments`))
+		Expect(err).To(BeAssignableToTypeOf(&jwt.ValidationError{}))
+	})
+
+	It("should verify exp", func() {
+		seeds.ExpiresAt = time.Now().Unix() - 1
+		_, err := subject.Decode(generate())
+		Expect(err).To(MatchError(`token has expired`))
+		Expect(err).To(BeAssignableToTypeOf(&jwt.ValidationError{}))
+	})
+
+	It("should verify iat", func() {
+		seeds.IssuedAt = time.Now().Unix() + 1
+		_, err := subject.Decode(generate())
+		Expect(err).To(MatchError(`issued in the future`))
+		Expect(err).To(BeAssignableToTypeOf(&jwt.ValidationError{}))
 	})
 
-	It("should reject expired tokens", func() {
-		_, err := decode(jwt.SigningMethodRS256, &jwt.StandardClaims{
-			Subject:   "me@example.com",
-			ExpiresAt: time.Now().Add(-time.Minute).Unix(),
-		})
-		Expect(err).To(MatchError(`Token is expired`))
+	It("should verify aud", func() {
+		seeds.Audience = "other"
+		_, err := subject.Decode(generate())
+		Expect(err).To(MatchError(`invalid audience claim "other"`))
+		Expect(err).To(BeAssignableToTypeOf(&jwt.ValidationError{}))
+	})
+
+	It("should verify iss", func() {
+		seeds.Issuer = "other"
+		_, err := subject.Decode(generate())
+		Expect(err).To(MatchError(`invalid issuer claim "other"`))
+		Expect(err).To(BeAssignableToTypeOf(&jwt.ValidationError{}))
+	})
+
+	It("should verify sub", func() {
+		seeds.Subject = ""
+		_, err := subject.Decode(generate())
+		Expect(err).To(MatchError(`subject is missing`))
+		Expect(err).To(BeAssignableToTypeOf(&jwt.ValidationError{}))
+	})
+
+	It("should verify auth time", func() {
+		seeds.AuthAt = time.Now().Unix() + 1
+		_, err := subject.Decode(generate())
+		Expect(err).To(MatchError(`auth-time in the future`))
+		Expect(err).To(BeAssignableToTypeOf(&jwt.ValidationError{}))
+	})
+})
+
+var _ = Describe("Claims", func() {
+	It("should be JWT compatible", func() {
+		subject := mockClaims(1515151515)
+		Expect(json.Marshal(subject)).To(MatchJSON(`{
+			"name": "Me",
+			"picture": "https://test.host/me.jpg",
+			"sub": "MDYwNDQwNjUtYWQ0ZC00ZDkwLThl",
+			"user_id": "MDYwNDQwNjUtYWQ0ZC00ZDkwLThl",
+			"aud": "mock-project",
+			"iss": "https://securetoken.google.com/mock-project",
+			"iat": 1515149715,
+			"exp": 1515155115,
+			"auth_time": 1515151515,
+			"email": "me@example.com",
+			"email_verified": true,
+			"firebase": {
+				"sign_in_provider": "google.com",
+				"identities": {
+					"google.com": ["123123123123123123123"],
+					"email": ["me@example.com"]
+				}
+			}
+		}`))
 	})
 })
 
@@ -86,19 +148,62 @@ func TestSuite(t *testing.T) {
 // --------------------------------------------------------------------
 
 var (
-	certPEM []byte
+	certKID string
+	certPEM string
 	privKey *rsa.PrivateKey
 )
 
 var _ = BeforeSuite(func() {
+	// seed private key
 	var err error
-
-	certPEM, err = ioutil.ReadFile("testdata/cert.pem")
+	privKey, err = rsa.GenerateKey(rand.Reader, 2048)
 	Expect(err).NotTo(HaveOccurred())
 
-	privPEM, err := ioutil.ReadFile("testdata/priv.pem")
+	// seed certificate
+	now := time.Now()
+	template := x509.Certificate{
+		SerialNumber:          big.NewInt(2605014480174073526),
+		Subject:               pkix.Name{CommonName: "securetoken.system.gserviceaccount.com"},
+		NotBefore:             now,
+		NotAfter:              now.Add(23775 * time.Minute),
+		KeyUsage:              x509.KeyUsageDigitalSignature,
+		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
+		BasicConstraintsValid: true,
+	}
+	cert, err := x509.CreateCertificate(rand.Reader, &template, &template, &privKey.PublicKey, privKey)
 	Expect(err).NotTo(HaveOccurred())
 
-	privKey, err = jwt.ParseRSAPrivateKeyFromPEM(privPEM)
+	// calculate key ID
+	kh := sha1.New()
+	_, err = kh.Write(cert)
 	Expect(err).NotTo(HaveOccurred())
+	certKID = hex.EncodeToString(kh.Sum(nil))
+
+	// convert to PEM
+	buf := new(bytes.Buffer)
+	Expect(pem.Encode(buf, &pem.Block{Type: "CERTIFICATE", Bytes: cert})).To(Succeed())
+	certPEM = buf.String()
 })
+
+func mockClaims(now int64) *firejwt.Claims {
+	return &firejwt.Claims{
+		Name:          "Me",
+		Picture:       "https://test.host/me.jpg",
+		Subject:       "MDYwNDQwNjUtYWQ0ZC00ZDkwLThl",
+		UserID:        "MDYwNDQwNjUtYWQ0ZC00ZDkwLThl",
+		Audience:      "mock-project",
+		Issuer:        "https://securetoken.google.com/mock-project",
+		IssuedAt:      now - 1800,
+		ExpiresAt:     now + 3600,
+		AuthAt:        now,
+		Email:         "me@example.com",
+		EmailVerified: true,
+		Firebase: &firejwt.FirebaseClaim{
+			SignInProvider: "google.com",
+			Identities: map[string][]string{
+				"google.com": {"123123123123123123123"},
+				"email":      {"me@example.com"},
+			},
+		},
+	}
+}

data/go.mod

@@ -3,13 +3,7 @@ module github.com/bsm/firejwt
 go 1.13
 
 require (
-	github.com/dgrijalva/jwt-go v3.2.0+incompatible
-	github.com/golang/protobuf v1.3.2 // indirect
-	github.com/kr/pretty v0.1.0 // indirect
-	github.com/onsi/ginkgo v1.11.0
-	github.com/onsi/gomega v1.8.1
-	golang.org/x/net v0.0.0-20191007182048-72f939374954 // indirect
-	golang.org/x/sys v0.0.0-20191008105621-543471e840be // indirect
-	golang.org/x/text v0.3.2 // indirect
-	gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 // indirect
+	github.com/bsm/ginkgo v1.16.1
+	github.com/bsm/gomega v1.11.0
+	github.com/golang-jwt/jwt v3.2.1+incompatible
 )