1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
package atprotoauth
import (
"context"
"errors"
"fmt"
"time"
"github.com/bluesky-social/indigo/atproto/auth"
"github.com/bluesky-social/indigo/atproto/identity"
"github.com/bluesky-social/indigo/atproto/syntax"
"github.com/golang-jwt/jwt/v5"
)
const MaxServiceAuthLifetime = 5 * time.Minute
var (
ErrMalformed = errors.New("atprotoauth: malformed service-auth token")
ErrExpired = errors.New("atprotoauth: service-auth token expired")
ErrBadSignature = errors.New("atprotoauth: service-auth signature does not match the issuer")
ErrNoKey = errors.New("atprotoauth: could not resolve the issuer's signing key")
ErrBadAudience = errors.New("atprotoauth: service-auth token is for another service")
ErrBadLxm = errors.New("atprotoauth: service-auth token is for another lexicon method")
ErrBadIssuer = errors.New("atprotoauth: the issuer's DID method is not admitted at this door")
ErrLifetimeTooLong = errors.New("atprotoauth: service-auth token lifetime exceeds the maximum")
)
func Verify(
ctx context.Context,
token string,
wantLxm string,
audiences []string,
dir identity.Directory,
) (string, error) {
if wantLxm == "" {
return "", fmt.Errorf("%w: no lexicon method was required", ErrBadLxm)
}
nsid, err := syntax.ParseNSID(wantLxm)
if err != nil {
return "", fmt.Errorf("%w: %q is not an NSID: %v", ErrBadLxm, wantLxm, err)
}
if len(audiences) == 0 {
return "", fmt.Errorf("%w: no audience is configured", ErrBadAudience)
}
var lastAud error
for _, aud := range audiences {
v := &auth.ServiceAuthValidator{Audience: aud, Dir: admitPlcAndWeb{dir}}
did, err := v.Validate(ctx, token, &nsid)
if err == nil {
if err := checkLifetime(token); err != nil {
return "", err
}
return did.String(), nil
}
if errors.Is(err, jwt.ErrTokenInvalidAudience) {
lastAud = err
continue
}
return "", classify(err)
}
return "", fmt.Errorf("%w: %v", ErrBadAudience, lastAud)
}
// ponytail: a validated token stays replayable until its short exp; if replay ever matters, keep a jti set keyed by exp and evict each entry at its exp.
func checkLifetime(token string) error {
claims := jwt.MapClaims{}
if _, _, err := jwt.NewParser().ParseUnverified(token, claims); err != nil {
return fmt.Errorf("%w: %v", ErrMalformed, err)
}
exp, err := claims.GetExpirationTime()
if err != nil || exp == nil {
return fmt.Errorf("%w: no expiry claim", ErrMalformed)
}
iat, err := claims.GetIssuedAt()
if err != nil || iat == nil {
return fmt.Errorf("%w: no issued-at claim", ErrMalformed)
}
if lifetime := exp.Time.Sub(iat.Time); lifetime > MaxServiceAuthLifetime {
return fmt.Errorf("%w: token lifetime %s exceeds the %s maximum", ErrLifetimeTooLong, lifetime, MaxServiceAuthLifetime)
}
return nil
}
func classify(err error) error {
switch {
case errors.Is(err, jwt.ErrTokenExpired):
return fmt.Errorf("%w: %v", ErrExpired, err)
case errors.Is(err, jwt.ErrTokenInvalidAudience):
return fmt.Errorf("%w: %v", ErrBadAudience, err)
case errors.Is(err, jwt.ErrTokenInvalidClaims):
return fmt.Errorf("%w: %v", ErrBadLxm, err)
case errors.Is(err, jwt.ErrTokenSignatureInvalid):
return fmt.Errorf("%w: %v", ErrBadSignature, err)
case errors.Is(err, ErrBadIssuer):
return err
case errors.Is(err, jwt.ErrTokenUnverifiable):
return fmt.Errorf("%w: %v", ErrNoKey, err)
default:
return fmt.Errorf("%w: %v", ErrMalformed, err)
}
}
