malpercio.dev / ezpds
An easy-to-host PDS on the ATProtocol, iPhone and MacOS. Maintain control of your keys and data, always.
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

feat(relay): auth middleware — Bearer/DPoP JWT validation extractor #44

open opened by
malpercio.dev targeting main from malpercio/mm-139-auth-middleware-bearerdpop-token-validation-extractor

Summary#

  • Adds crates/relay/src/auth/mod.rs with AuthenticatedUser as an Axum FromRequestParts extractor — the first extractor in this codebase, enabling handlers to declare auth via function parameters
  • Validates HS256 JWT signature, exp (zero leeway), aud (when server_did configured), and sub; maps ExpiredSignature → TOKEN_EXPIRED, all other failures → INVALID_TOKEN, missing header → AUTHENTICATION_REQUIRED
  • Full DPoP proof validation (RFC 9449): JWK thumbprint (RFC 7638), htm/htu claim checks, iat freshness window, cnf.jkt binding against access token
  • New AuthenticationRequired and InvalidToken error codes in common; jwt_secret: [u8; 32] added to AppState (generated via OsRng at startup, ephemeral)

Test plan#

  • cargo test --package relay — 243 tests pass, 0 failures
  • Missing Authorization header → 401 AUTHENTICATION_REQUIRED
  • Wrong Bearer scheme (e.g. Token abc) → 401 AUTHENTICATION_REQUIRED
  • Malformed JWT / wrong signature → 401 INVALID_TOKEN
  • Expired token (leeway = 0) → 401 TOKEN_EXPIRED
  • Unknown scope string → 401 INVALID_TOKEN
  • Valid access token → 200 with correct DID and Access scope
  • Valid refresh token → 200 with Refresh scope
  • DPoP header present but access token missing cnf claim → 401 INVALID_TOKEN
  • RFC 7638 RSA thumbprint test vector passes
  • EC thumbprint format: 43-char base64url, stable across runs
Labels

None yet.

assignee

None yet.

Participants 1
AT URI
at://did:web:malpercio.dev/sh.tangled.repo.pull/3mhlwotx3oj22
Diff #0

No differences found between the selected revisions.

History

1 round 0 comments
sign up or login to add to the discussion
malpercio.dev submitted #0
patch application failed: error: No valid patches in input (allow with "--allow-empty")
expand 0 comments