Jw/changing how jwt is passed around

libsql-server/src/auth/parsers.rs

@@ -4,6 +4,8 @@ use anyhow::{bail, Context as _, Result};
 use axum::http::HeaderValue;
 use tonic::metadata::MetadataMap;
 
+use super::UserAuthContext;
+
 pub fn parse_http_basic_auth_arg(arg: &str) -> Result<Option<String>> {
     if arg == "always" {
         return Ok(Some("always".to_string()));
@@ -34,13 +36,33 @@ pub fn parse_jwt_key(data: &str) -> Result<jsonwebtoken::DecodingKey> {
     }
 }
 
-pub(crate) fn parse_grpc_auth_header(metadata: &MetadataMap) -> Option<HeaderValue> {
-    metadata
-        .get(GRPC_AUTH_HEADER)
-        .map(|v| v.to_bytes().expect("Auth should always be ASCII"))
-        .map(|v| HeaderValue::from_maybe_shared(v).expect("Should already be valid header"))
+pub(crate) fn parse_grpc_auth_header(metadata: &MetadataMap) -> Result<UserAuthContext, tonic::Status> {
+// todo fix error messages and chaining
+    let header = metadata.get(GRPC_AUTH_HEADER)
+        .ok_or(tonic::Status::new(tonic::Code::Unauthenticated,""))?;
+
+
+    let header_str = header.to_str().context("Auth should be ASCII")
+        .map_err(|err| tonic::Status::new(tonic::Code::InvalidArgument, ""))?;
+
+    return auth_string_to_auth_context(header_str).context(format!("Failed parse grpc auth: {header_str}"))
+        .map_err(|err| tonic::Status::new(tonic::Code::InvalidArgument, ""));
+}
+
+// todo this should be a constructor or a factory associates iwth userauthcontext
+pub fn auth_string_to_auth_context(
+    auth_string: &str,
+) -> Result<UserAuthContext> {
+
+    let(scheme, token) = auth_string.split_once(' ').context("malformed auth header string")?;
+
+    Ok(UserAuthContext{
+        scheme: Some(scheme.into()), 
+        token: Some(token.into()),
+    })
 }
 
+
 pub fn parse_http_auth_header<'a>(
     expected_scheme: &str,
     auth_header: &'a Option<HeaderValue>,
@@ -120,3 +142,4 @@ mod tests {
         assert_eq!(out, Some("always".to_string()));
     }
 }
+

libsql-server/src/auth/user_auth_strategies/disabled.rs

@@ -24,7 +24,8 @@ mod tests {
     fn authenticates() {
         let strategy = Disabled::new();
         let context = UserAuthContext {
-            user_credential: None,
+            scheme: None,
+            token: None,
         };
 
         assert!(matches!(

libsql-server/src/auth/user_auth_strategies/http_basic.rs

@@ -1,4 +1,4 @@
-use crate::auth::{parse_http_auth_header, AuthError, Authenticated};
+use crate::auth::{AuthError, Authenticated};
 
 use super::{UserAuthContext, UserAuthStrategy};
 
@@ -7,17 +7,22 @@ pub struct HttpBasic {
 }
 
 impl UserAuthStrategy for HttpBasic {
+
     fn authenticate(&self, context: UserAuthContext) -> Result<Authenticated, AuthError> {
+
         tracing::trace!("executing http basic auth");
-
-        let param = parse_http_auth_header("basic", &context.user_credential)?;
-
+
         // NOTE: this naive comparison may leak information about the `expected_value`
         // using a timing attack
-        let actual_value = param.trim_end_matches('=');
         let expected_value = self.credential.trim_end_matches('=');
 
-        if actual_value == expected_value {
+        let creds_match = match context.token {
+            Some(s) => s.contains(expected_value),
+            None => expected_value.is_empty(),
+        };
+
+
+        if creds_match {
             return Ok(Authenticated::FullAccess);
         }
 
@@ -33,8 +38,6 @@ impl HttpBasic {
 
 #[cfg(test)]
 mod tests {
-    use axum::http::HeaderValue;
-
     use super::*;
 
     const CREDENTIAL: &str = "d29qdGVrOnRoZWJlYXI=";
@@ -46,7 +49,8 @@ mod tests {
     #[test]
     fn authenticates_with_valid_credential() {
         let context = UserAuthContext {
-            user_credential: HeaderValue::from_str(&format!("Basic {CREDENTIAL}")).ok(),
+            scheme: Some("basic".into()),
+            token: Some(CREDENTIAL.into()),
         };
 
         assert!(matches!(
@@ -60,7 +64,8 @@ mod tests {
         let credential = CREDENTIAL.trim_end_matches('=');
 
         let context = UserAuthContext {
-            user_credential: HeaderValue::from_str(&format!("Basic {credential}")).ok(),
+            scheme: Some("basic".into()),
+            token: Some(credential.into()),
         };
 
         assert!(matches!(
@@ -72,7 +77,8 @@ mod tests {
     #[test]
     fn errors_when_credentials_do_not_match() {
         let context = UserAuthContext {
-            user_credential: HeaderValue::from_str("Basic abc").ok(),
+            token: Some("abc".into()),
+            scheme: Some("basic".into()),
         };
 
         assert_eq!(

libsql-server/src/auth/user_auth_strategies/jwt.rs

@@ -1,7 +1,7 @@
 use chrono::{DateTime, Utc};
 
 use crate::{
-    auth::{parse_http_auth_header, AuthError, Authenticated, Authorized, Permission},
+    auth::{AuthError, Authenticated, Authorized, Permission},
     namespace::NamespaceName,
 };
 
@@ -14,8 +14,20 @@ pub struct Jwt {
 impl UserAuthStrategy for Jwt {
     fn authenticate(&self, context: UserAuthContext) -> Result<Authenticated, AuthError> {
         tracing::trace!("executing jwt auth");
-        let param = parse_http_auth_header("bearer", &context.user_credential)?;
-        validate_jwt(&self.key, param)
+
+        let Some(scheme) = context.scheme else {
+            return Err(AuthError::HttpAuthHeaderInvalid);
+        };
+
+        if !scheme.eq_ignore_ascii_case("bearer") {
+            return Err(AuthError::HttpAuthHeaderUnsupportedScheme);
+        }
+
+        let Some(token) = context.token else {
+            return Err(AuthError::HttpAuthHeaderInvalid);
+        };
+
+        return validate_jwt(&self.key, &token);
     }
 }
 
@@ -96,7 +108,6 @@ fn validate_jwt(
 mod tests {
     use std::time::Duration;
 
-    use axum::http::HeaderValue;
     use jsonwebtoken::{DecodingKey, EncodingKey};
     use ring::signature::{Ed25519KeyPair, KeyPair};
     use serde::Serialize;
@@ -135,7 +146,8 @@ mod tests {
         let token = encode(&token, &enc);
 
         let context = UserAuthContext {
-            user_credential: HeaderValue::from_str(&format!("Bearer {token}")).ok(),
+            scheme: Some("bearer".into()),
+            token: token.into(),
         };
 
         assert!(matches!(
@@ -156,7 +168,8 @@ mod tests {
         let token = encode(&token, &enc);
 
         let context = UserAuthContext {
-            user_credential: HeaderValue::from_str(&format!("Bearer {token}")).ok(),
+            scheme: Some("bearer".into()),
+            token: token.into(),
         };
 
         let Authenticated::Authorized(a) = strategy(dec).authenticate(context).unwrap() else {
@@ -175,7 +188,8 @@ mod tests {
     fn errors_when_jwt_token_invalid() {
         let (_enc, dec) = key_pair();
         let context = UserAuthContext {
-            user_credential: HeaderValue::from_str("Bearer abc").ok(),
+            scheme: Some("bearer".into()),
+            token: Some("abc".into()),
         };
 
         assert_eq!(
@@ -197,7 +211,8 @@ mod tests {
         let token = encode(&token, &enc);
 
         let context = UserAuthContext {
-            user_credential: HeaderValue::from_str(&format!("Bearer {token}")).ok(),
+            scheme: Some("bearer".into()),
+            token: Some(token.into()),
         };
 
         assert_eq!(
@@ -221,7 +236,8 @@ mod tests {
         let token = encode(&token, &enc);
 
         let context = UserAuthContext {
-            user_credential: HeaderValue::from_str(&format!("Bearer {token}")).ok(),
+            scheme: Some("bearer".into()),
+            token: token.into(),
         };
 
         let Authenticated::Authorized(a) = strategy(dec).authenticate(context).unwrap() else {

libsql-server/src/auth/user_auth_strategies/mod.rs

@@ -2,15 +2,15 @@ pub mod disabled;
 pub mod http_basic;
 pub mod jwt;
 
-use axum::http::HeaderValue;
 pub use disabled::*;
 pub use http_basic::*;
 pub use jwt::*;
 
 use super::{AuthError, Authenticated};
 
 pub struct UserAuthContext {
-    pub user_credential: Option<HeaderValue>,
+    pub scheme: Option<String>,
+    pub token: Option<String>, // token might not be required in some cases
 }
 
 pub trait UserAuthStrategy: Sync + Send {

libsql-server/src/hrana/ws/session.rs

@@ -2,7 +2,6 @@ use std::collections::HashMap;
 use std::sync::Arc;
 
 use anyhow::{anyhow, bail, Result};
-use axum::http::HeaderValue;
 use futures::future::BoxFuture;
 use tokio::sync::{mpsc, oneshot};
 
@@ -77,16 +76,11 @@ pub(super) async fn handle_initial_hello(
         .with(namespace.clone(), |ns| ns.jwt_key())
         .await??;
 
-    // Convert jwt token into a HeaderValue to be compatible with UserAuthStrategy
-    let user_credential = jwt
-        .clone()
-        .and_then(|t| HeaderValue::from_str(&format!("Bearer {t}")).ok());
-
     let auth = namespace_jwt_key
         .map(Jwt::new)
         .map(Auth::new)
         .unwrap_or(server.user_auth_strategy.clone())
-        .authenticate(UserAuthContext { user_credential })
+        .authenticate(UserAuthContext { scheme: Some("Bearer".into()), token: jwt })
         .map_err(|err| anyhow!(ResponseError::Auth { source: err }))?;
 
     Ok(Session {
@@ -115,16 +109,11 @@ pub(super) async fn handle_repeated_hello(
         .with(namespace.clone(), |ns| ns.jwt_key())
         .await??;
 
-    // Convert jwt token into a HeaderValue to be compatible with UserAuthStrategy
-    let user_credential = jwt
-        .clone()
-        .and_then(|t| HeaderValue::from_str(&format!("Bearer {t}")).ok());
-
     session.auth = namespace_jwt_key
         .map(Jwt::new)
         .map(Auth::new)
         .unwrap_or_else(|| server.user_auth_strategy.clone())
-        .authenticate(UserAuthContext { user_credential })
+        .authenticate(UserAuthContext { scheme: Some("Bearer".into()), token: jwt })
         .map_err(|err| anyhow!(ResponseError::Auth { source: err }))?;
 
     Ok(())

libsql-server/src/http/user/extract.rs

@@ -1,7 +1,8 @@
+use anyhow::Context;
 use axum::extract::FromRequestParts;
 
 use crate::{
-    auth::{Jwt, UserAuthContext, UserAuthStrategy},
+    auth::{parsers::auth_string_to_auth_context, Auth, Jwt, UserAuthContext},
     connection::RequestContext,
 };
 
@@ -15,6 +16,8 @@ impl FromRequestParts<AppState> for RequestContext {
         parts: &mut axum::http::request::Parts,
         state: &AppState,
     ) -> std::result::Result<Self, Self::Rejection> {
+
+        // start todo this block is same as the one in mod.rs
         let namespace = db_factory::namespace_from_headers(
             &parts.headers,
             state.disable_default_namespace,
@@ -26,19 +29,23 @@ impl FromRequestParts<AppState> for RequestContext {
             .with(namespace.clone(), |ns| ns.jwt_key())
             .await??;
 
-        let auth_header = parts.headers.get(hyper::header::AUTHORIZATION);
+    // todo think how to decide if the particular auth stragegy even needs a context?
+    // we need it to understand whether to treat absence of auth header as error or not
+        let context = parts.headers
+        .get(hyper::header::AUTHORIZATION).context("auth header not found") // todo this context is swallowed for now, gotta fix that but not with panicking
+        .and_then(|h| h.to_str().context("non ascii auth token"))
+        .and_then(|t| auth_string_to_auth_context(t))
+        .unwrap_or(UserAuthContext{scheme: None, token: None});
+
 
-        let auth = match namespace_jwt_key {
-            Some(key) => Jwt::new(key).authenticate(UserAuthContext {
-                user_credential: auth_header.cloned(),
-            })?,
-            None => state.user_auth_strategy.authenticate(UserAuthContext {
-                user_credential: auth_header.cloned(),
-            })?,
-        };
+        let authenticated = namespace_jwt_key
+        .map(Jwt::new)
+        .map(Auth::new)
+        .unwrap_or_else(|| state.user_auth_strategy.clone())
+        .authenticate(context)?;            
 
         Ok(Self::new(
-            auth,
+            authenticated,
             namespace,
             state.namespaces.meta_store().clone(),
         ))

libsql-server/src/http/user/mod.rs

@@ -29,8 +29,8 @@ use tonic::transport::Server;
 
 use tower_http::{compression::CompressionLayer, cors};
 
-use crate::auth::user_auth_strategies::UserAuthContext;
-use crate::auth::{Auth, Authenticated, Jwt};
+use crate::auth::parsers::auth_string_to_auth_context;
+use crate::auth::{Auth, Authenticated, Jwt, UserAuthContext};
 use crate::connection::{Connection, RequestContext};
 use crate::error::Error;
 use crate::hrana;
@@ -460,23 +460,27 @@ impl FromRequestParts<AppState> for Authenticated {
             state.disable_default_namespace,
             state.disable_namespaces,
         )?;
-
+// todo get rid of duplication - this and replication_log.rs
         let namespace_jwt_key = state
             .namespaces
             .with(ns.clone(), |ns| ns.jwt_key())
             .await??;
 
-        let auth_header = parts.headers.get(hyper::header::AUTHORIZATION);
-
-        let auth = namespace_jwt_key
-            .map(Jwt::new)
-            .map(Auth::new)
-            .unwrap_or_else(|| state.user_auth_strategy.clone())
-            .authenticate(UserAuthContext {
-                user_credential: auth_header.cloned(),
-            })?;
-
-        Ok(auth)
+    // todo think how to decide if the particular auth stragegy even needs a context?
+    // we need it to understand whether to treat absence of auth header as error or not
+        let context = parts.headers
+            .get(hyper::header::AUTHORIZATION).context("auth header not found") // todo this context is swallowed for now, gotta fix that but not with panicking
+            .and_then(|h| h.to_str().context("non ascii auth token"))
+            .and_then(|t| auth_string_to_auth_context(t))
+            .unwrap_or(UserAuthContext{scheme: None, token: None});
+
+
+        let authenticated = namespace_jwt_key
+        .map(Jwt::new)
+        .map(Auth::new)
+        .unwrap_or_else(|| state.user_auth_strategy.clone())
+        .authenticate(context)?;
+        Ok(authenticated)
     }
 }