Use new authenticator

Cargo.lock

@@ -2517,7 +2517,6 @@ name = "oswilno"
 version = "0.1.0"
 dependencies = [
  "actix",
- "actix-jwt-session",
  "actix-rt",
  "actix-web",
  "actix-web-grants",

crates/actix-jwt-session/src/lib.rs

@@ -1,5 +1,5 @@
+use actix_web::{HttpMessage, FromRequest};
 use actix_web::{dev::ServiceRequest, HttpResponse};
-use actix_web::HttpMessage;
 use jsonwebtoken::{decode, DecodingKey, Validation};
 use serde::{de::DeserializeOwned, Serialize};
 use std::sync::Arc;
@@ -20,6 +20,10 @@ pub enum Error {
     InvalidSession,
     #[error("No http authentication header")]
     NoAuthHeader,
+    #[error("Failed to serialize claims")]
+    SerializeFailed,
+    #[error("Unable to write claims to storage")]
+    WriteFailed,
 }
 
 impl actix_web::ResponseError for Error {
@@ -35,13 +39,41 @@ impl actix_web::ResponseError for Error {
     }
 }
 
+#[derive(Clone)]
 pub struct Authenticated<T>(Arc<T>);
 
+impl<T> std::ops::Deref for Authenticated<T> {
+    type Target = T;
+
+    fn deref(&self) -> &Self::Target {
+        &*self.0
+    }
+}
+
+impl<T: Claims> FromRequest for Authenticated<T> {
+    type Error = actix_web::error::Error;
+    type Future = std::future::Ready<Result<Self, actix_web::Error>>;
+
+    fn from_request(
+        req: &actix_web::HttpRequest,
+        _payload: &mut actix_web::dev::Payload,
+    ) -> Self::Future {
+        let value = req.extensions_mut().get::<Authenticated<T>>().map(Clone::clone);
+        std::future::ready(value.ok_or_else(|| Error::NotFound.into()))
+    }
+}
+
 #[async_trait::async_trait(?Send)]
 pub trait TokenStorage {
     type ClaimsType: Claims;
 
     async fn get_from_jti(self: Arc<Self>, jti: uuid::Uuid) -> Result<Self::ClaimsType, Error>;
+
+    async fn set_by_jti(
+        self: Arc<Self>,
+        claims: Self::ClaimsType,
+        exp: std::time::Duration,
+    ) -> Result<(), Error>;
 }
 
 struct Extractor;
@@ -53,7 +85,6 @@ impl Extractor {
         jwt_validator: Arc<Validation>,
         storage: Arc<dyn TokenStorage<ClaimsType = ClaimsType>>,
     ) -> Result<(), Error> {
-
         let authorisation_header = req
             .headers()
             .get("Authorization")

crates/actix-jwt-session/src/redis_adapter.rs

@@ -3,10 +3,10 @@ use actix_web::dev::{forward_ready, Service, ServiceRequest, ServiceResponse, Tr
 use futures_util::future::LocalBoxFuture;
 use jsonwebtoken::{DecodingKey, Validation};
 use redis::AsyncCommands;
+use std::future::{ready, Ready};
 use std::marker::PhantomData;
 use std::rc::Rc;
 use std::sync::Arc;
-use std::future::{ready, Ready};
 
 #[derive(Clone)]
 pub struct RedisStorage<ClaimsType: Claims> {
@@ -39,6 +39,20 @@ where
             .map_err(|_| Error::NotFound)?;
         bincode::deserialize(&val).map_err(|_| Error::RecordMalformed)
     }
+
+    async fn set_by_jti(
+        self: Arc<Self>,
+        claims: Self::ClaimsType,
+        exp: std::time::Duration,
+    ) -> Result<(), Error> {
+        let pool = self.pool.clone();
+        let mut conn = pool.get().await.map_err(|_| Error::RedisConn)?;
+        let val = bincode::serialize(&claims).map_err(|_| Error::SerializeFailed)?;
+        conn.set_ex::<_, _, String>(claims.jti().as_bytes(), val, exp.as_secs() as usize)
+            .await
+            .map_err(|_| Error::WriteFailed)?;
+        Ok(())
+    }
 }
 
 pub struct RedisMiddleware<S, ClaimsType>
@@ -80,18 +94,33 @@ where
     }
 }
 
-#[derive(Debug,Clone)]
+#[derive(Clone)]
 pub struct RedisMiddlewareFactory<ClaimsType: Claims> {
     jwt_decoding_key: Arc<DecodingKey>,
     jwt_validator: Arc<Validation>,
-    storage: Arc<dyn TokenStorage>,
+    storage: Arc<RedisStorage<ClaimsType>>,
     _claims_type_marker: PhantomData<ClaimsType>,
 }
 
+impl<ClaimsType: Claims> RedisMiddlewareFactory<ClaimsType> {
+    pub fn new(
+        jwt_decoding_key: Arc<DecodingKey>,
+        jwt_validator: Arc<Validation>,
+        storage: Arc<RedisStorage<ClaimsType>>,
+    ) -> Self {
+        Self {
+            jwt_decoding_key,
+            jwt_validator,
+            storage,
+            _claims_type_marker: Default::default(),
+        }
+    }
+}
+
 impl<S, B, ClaimsType> Transform<S, ServiceRequest> for RedisMiddlewareFactory<ClaimsType>
 where
     S: Service<ServiceRequest, Response = ServiceResponse<B>, Error = actix_web::Error> + 'static,
-    ClaimsType: DeserializeOwned + 'static,
+    ClaimsType: Claims,
 {
     type Response = ServiceResponse<B>;
     type Error = actix_web::Error;
@@ -110,7 +139,6 @@ where
     }
 }
 
-
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -127,6 +155,5 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn extract() {
-    }
+    async fn extract() {}
 }

crates/oswilno-parking-space/src/lib.rs

@@ -9,8 +9,8 @@ use sea_orm::ActiveValue::{NotSet, Set};
 use std::collections::HashMap;
 use std::sync::Arc;
 
+use oswilno_session::{Claims, Authenticated};
 use oswilno_view::Layout;
-use oswilno_session::UserSession;
 
 pub fn mount(config: &mut ServiceConfig) {
     config.service(
@@ -30,7 +30,9 @@ struct AllPartialParkingSpace {
 }
 
 #[get("/all")]
-async fn all_parking_spaces(db: Data<sea_orm::DatabaseConnection>) -> Layout<AllPartialParkingSpace> {
+async fn all_parking_spaces(
+    db: Data<sea_orm::DatabaseConnection>,
+) -> Layout<AllPartialParkingSpace> {
     let db = db.into_inner();
 
     let main = load_parking_spaces(db).await;
@@ -105,7 +107,7 @@ struct CreateParkingSpace {
 async fn create(
     db: Data<sea_orm::DatabaseConnection>,
     p: Form<CreateParkingSpace>,
-    session: UserSession,
+    session: Authenticated<Claims>,
 ) -> HttpResponse {
     use oswilno_contract::parking_spaces::*;
     let CreateParkingSpace { location, spot } = p.into_inner();
@@ -115,7 +117,7 @@ async fn create(
         id: NotSet,
         location: Set(location.clone()),
         spot: Set(spot.map(|n| n as i32)),
-        account_id: Set(session.claims.account_id()),
+        account_id: Set(session.account_id()),
         ..Default::default()
     };
     if let Err(_e) = model.save(&*db).await {

crates/oswilno-server/Cargo.toml

@@ -15,7 +15,6 @@ oswilno-config = { path = "../oswilno-config" }
 oswilno-parking-space = { path = "../oswilno-parking-space" }
 oswilno-session = { path = "../oswilno-session" }
 oswilno-view = { path = "../oswilno-view" }
-actix-jwt-session = { path = "../actix-jwt-session", features = ["use-redis"] }
 redis = { version = "0.17" }
 redis-async-pool = "0.2.4"
 sea-orm = { version = "0.11", features = ["postgres-array", "runtime-actix-rustls", "sqlx-postgres"] }

crates/oswilno-server/src/main.rs

@@ -50,8 +50,7 @@ async fn main() -> std::io::Result<()> {
         let session_config = session_config.clone();
         App::new()
             .wrap(middleware::Logger::default())
-            .wrap(actix_jwt_session::RedisMiddleware::new())
-            // .wrap(session_config.factory())
+            .wrap(session_config.factory())
             .app_data(Data::new(conn.clone()))
             .app_data(Data::new(redis.clone()))
             .app_data(Data::new(l10n.clone()))

crates/oswilno-session/Cargo.toml

@@ -17,7 +17,7 @@ garde = { version = "0.14.0", features = ["derive"] }
 jsonwebtoken = "8.3.0"
 oswilno-contract = { path = "../oswilno-contract" }
 oswilno-view = { path = "../oswilno-view" }
-actix-jwt-session = { path = "../actix-jwt-session" }
+actix-jwt-session = { path = "../actix-jwt-session", features = ["use-redis"] }
 rand = "0.8.5"
 redis = { version = "0.17" }
 redis-async-pool = "0.2.4"

crates/oswilno-session/src/lib.rs

@@ -1,14 +1,11 @@
 use std::ops::Add;
 use std::sync::Arc;
 
-use actix_jwt_authc::*;
+pub use actix_jwt_session::{Error, RedisMiddlewareFactory, Authenticated};
 use actix_web::web::{Data, Form, ServiceConfig};
 use actix_web::{get, post, HttpResponse};
 use askama_actix::Template;
 use autometrics::autometrics;
-use futures::channel::{mpsc, mpsc::Sender};
-use futures::stream::Stream;
-use futures::SinkExt;
 use garde::Validate;
 use jsonwebtoken::*;
 use oswilno_view::{Errors, Lang, Layout, TranslationStorage};
@@ -18,14 +15,13 @@ use sea_orm::DatabaseConnection;
 use serde::{Deserialize, Serialize};
 use time::ext::*;
 use time::OffsetDateTime;
-use tokio::sync::Mutex;
 
 mod extract_session;
 mod hashing;
 
 pub use oswilno_view::filters;
 
-pub type UserSession = Authenticated<Claims>;
+pub type UserSession = Claims;
 
 #[derive(Clone, Copy)]
 pub struct JWTTtl(time::Duration);
@@ -51,6 +47,12 @@ pub struct Claims {
     jwt_id: uuid::Uuid,
 }
 
+impl actix_jwt_session::Claims for Claims {
+    fn jti(&self) -> uuid::Uuid {
+        self.jwt_id
+    }
+}
+
 impl Claims {
     pub fn account_id(&self) -> i32 {
         self.subject
@@ -76,15 +78,13 @@ const JWT_SIGNING_ALGO: Algorithm = Algorithm::EdDSA;
 #[derive(Clone)]
 pub struct SessionConfigurator {
     jwt_ttl: Data<JWTTtl>,
-    invalidated_jwts_store: Data<InvalidatedJWTStore>,
     encoding_key: Data<EncodingKey>,
-    factory: AuthenticateMiddlewareFactory<Claims>,
+    factory: RedisMiddlewareFactory<Claims>,
 }
 
 impl SessionConfigurator {
     pub fn app_data(self, config: &mut ServiceConfig) {
         config
-            .app_data(self.invalidated_jwts_store)
             .app_data(self.encoding_key)
             .app_data(self.jwt_ttl)
             .service(login)
@@ -97,7 +97,7 @@ impl SessionConfigurator {
             .service(register_partial_view);
     }
 
-    pub fn factory(&self) -> AuthenticateMiddlewareFactory<Claims> {
+    pub fn factory(&self) -> RedisMiddlewareFactory<Claims> {
         self.factory.clone()
     }
 
@@ -133,18 +133,13 @@ impl SessionConfigurator {
         let jwt_ttl = JWTTtl(31.days());
         let jwt_signing_keys = JwtSigningKeys::generate().unwrap();
         let validator = Validation::new(JWT_SIGNING_ALGO);
-        let auth_middleware_settings = AuthenticateMiddlewareSettings {
-            jwt_decoding_key: jwt_signing_keys.decoding_key,
-            jwt_authorization_header_prefixes: Some(vec!["Bearer".to_string()]),
-            jwt_validator: validator,
-            jwt_session_key: None,
-        };
-        let (invalidated_jwts_store, stream) = InvalidatedJWTStore::new_with_stream(redis);
-        let auth_middleware_factory =
-            AuthenticateMiddlewareFactory::<Claims>::new(stream, auth_middleware_settings.clone());
+        let auth_middleware_factory = RedisMiddlewareFactory::<Claims>::new(
+            Arc::new(jwt_signing_keys.decoding_key),
+            Arc::new(validator),
+            Arc::new(actix_jwt_session::RedisStorage::new(redis)),
+        );
 
         Self {
-            invalidated_jwts_store: Data::new(invalidated_jwts_store.clone()),
             encoding_key: Data::new(jwt_signing_keys.encoding_key.clone()),
             jwt_ttl: Data::new(jwt_ttl.clone()),
             factory: auth_middleware_factory,
@@ -308,8 +303,8 @@ async fn login_inner(
 
 #[autometrics]
 #[get("/session")]
-async fn session_info(authenticated: UserSession) -> Result<HttpResponse, Error> {
-    Ok(HttpResponse::Ok().json(authenticated))
+async fn session_info(authenticated: Authenticated<Claims>) -> Result<HttpResponse, Error> {
+    Ok(HttpResponse::Ok().json(&*authenticated))
 }
 
 #[autometrics]
@@ -320,7 +315,7 @@ async fn logout(
 ) -> Result<HttpResponse, Error> {
     {
         use redis::AsyncCommands;
-        let jwt_id = authenticated.claims.jwt_id;
+        let jwt_id = authenticated.jwt_id;
         if let Ok(mut conn) = redis.get().await {
             if conn.del::<_, String>(jwt_id.as_bytes()).await.is_err() {}
         }
@@ -506,48 +501,7 @@ async fn register_internal(
         .json(EmptyResponse {}))
 }
 
-#[derive(Clone)]
-struct InvalidatedJWTStore {
-    // store: Arc<DashSet<JWT>>,
-    redis: redis_async_pool::RedisPool,
-    tx: Arc<Mutex<Sender<InvalidatedTokensEvent>>>,
-}
-
-impl InvalidatedJWTStore {
-    /// Returns a [InvalidatedJWTStore] with a Stream of [InvalidatedTokensEvent]s
-    fn new_with_stream(
-        redis: redis_async_pool::RedisPool,
-    ) -> (
-        InvalidatedJWTStore,
-        impl Stream<Item = InvalidatedTokensEvent>,
-    ) {
-        // let invalidated = Arc::new(DashSet::new());
-        let (tx, rx) = mpsc::channel(100);
-        let tx_to_hold = Arc::new(Mutex::new(tx));
-        (
-            InvalidatedJWTStore {
-                // store: invalidated,
-                redis,
-                tx: tx_to_hold,
-            },
-            rx,
-        )
-    }
-
-    async fn add_to_invalidated(&self, authenticated: Authenticated<Claims>) {
-        // self.store.insert(authenticated.jwt.clone());
-        let mut tx = self.tx.lock().await;
-        if let Err(_e) = tx
-            .send(InvalidatedTokensEvent::Add(authenticated.jwt))
-            .await
-        {
-            #[cfg(feature = "tracing")]
-            error!(error = ?_e, "Failed to send update on adding to invalidated")
-        }
-    }
-}
-
-struct JwtSigningKeys {
+pub struct JwtSigningKeys {
     encoding_key: EncodingKey,
     decoding_key: DecodingKey,
 }