alibi-plugins 0.4.0

Built-in authentication plugins and API metadata for Alibi
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105

//! Typed account-cookie payload boundary for the shared authenticated JWE codec.

use super::state::AccountCookiePayload;
use alibi_core::{AuthError, AuthResult, utils::jwe};

pub(super) fn encode(
    secret: &str,
    payload: &AccountCookiePayload,
    max_age: f64,
) -> AuthResult<String> {
    jwe::encode(
        secret,
        "better-auth-account",
        &payload.wire_value()?,
        max_age,
    )
}

pub(super) fn decode(secret: &str, token: &str) -> AuthResult<AccountCookiePayload> {
    let payload = jwe::decode_parsed(secret, "better-auth-account", token)
        .map_err(|_error| AuthError::bad_request("Account not found"))?;
    let snapshot = payload.as_object().cloned();
    let mut account: AccountCookiePayload = serde_json::from_value(payload)
        .map_err(|_error| AuthError::bad_request("Account not found"))?;
    account.original = serde_json::to_value(&account)?.as_object().cloned();
    account.snapshot = snapshot;
    Ok(account)
}

// LCOV_EXCL_START
#[cfg(test)]
mod tests {
    use base64::{Engine, engine::general_purpose::URL_SAFE_NO_PAD as BASE64};

    #[test]
    fn account_cookie_accepts_pinned_encrypted_vectors_and_rejects_unauthenticated_values() {
        let vectors: serde_json::Value = serde_json::from_str(include_str!(
            "../../../../../tests/fixtures/oauth/account-cookie-vectors.json"
        ))
        .unwrap();
        let secret = (*(vectors)
            .get("secret")
            .expect("fixture contains the requested index"))
        .as_str()
        .unwrap();
        for name in ["valid", "noKid"] {
            let decoded = crate::oauth::state::decode_account_cookie_value(
                &alibi_core::AuthConfig::new(secret),
                (*(vectors)
                    .get(name)
                    .expect("fixture contains the requested index"))
                .as_str()
                .unwrap(),
            )
            .unwrap();
            assert_eq!(
                serde_json::to_value(&decoded).unwrap(),
                (*(vectors)
                    .get("decoded")
                    .and_then(|expected| expected.get(name))
                    .expect("fixture contains the requested index"))
            );
        }
        for name in ["wrongSalt", "wrongSecret", "expired", "gcm", "jws"] {
            assert!(
                crate::oauth::state::decode_account_cookie_value(
                    &alibi_core::AuthConfig::new(secret),
                    (*(vectors)
                        .get(name)
                        .expect("fixture contains the requested index"))
                    .as_str()
                    .unwrap()
                )
                .is_err(),
                "{name} must not resolve a provider account"
            );
        }
        let original = (*(vectors)
            .get("valid")
            .expect("fixture contains the requested index"))
        .as_str()
        .unwrap();
        for segment in [0, 2, 3, 4] {
            let mut parts: Vec<_> = original.split('.').map(str::to_owned).collect();
            let mut bytes = BASE64
                .decode(
                    (parts)
                        .get(segment)
                        .expect("fixture contains the requested index"),
                )
                .unwrap();
            *bytes.first_mut().expect("decoded fixture is nonempty") ^= 1;
            *parts.get_mut(segment).expect("fixture segment exists") = BASE64.encode(bytes);
            assert!(
                crate::oauth::state::decode_account_cookie_value(
                    &alibi_core::AuthConfig::new(secret),
                    &parts.join(".")
                )
                .is_err(),
                "changed segment {segment} must not authenticate"
            );
        }
    }
}
// LCOV_EXCL_STOP