alibi-plugins 0.10.0

Built-in authentication plugins and API metadata for Alibi
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81

//! Application-owned client-secret hashing shared by registration, rotation and authentication.
use alibi_core::{AuthContext, AuthResult, AuthSchema};
use async_trait::async_trait;
use base64::{Engine as _, engine::general_purpose::URL_SAFE_NO_PAD};
use sha2::{Digest as _, Sha256};
use subtle::ConstantTimeEq;

/// Custom client-secret hash storage, matching `storeClientSecret.hash` and optional `verify`.
#[async_trait]
pub trait OAuthClientSecretHasher: Send + Sync + std::fmt::Debug {
    async fn hash(&self, secret: &str) -> AuthResult<String>;
    /// Override verification for application-owned formats or password hashing.
    /// The default hashes the presented secret and compares it in constant time.
    async fn verify(&self, secret: &str, stored: &str) -> AuthResult<bool> {
        let hash = self.hash(secret).await?;
        Ok(bool::from(hash.as_bytes().ct_eq(stored.as_bytes())))
    }
}

/// Custom reversible client-secret storage, matching `storeClientSecret.encrypt` and `decrypt`.
#[async_trait]
pub trait OAuthClientSecretCipher: Send + Sync + std::fmt::Debug {
    async fn encrypt(&self, secret: &str) -> AuthResult<String>;
    async fn decrypt(&self, stored: &str) -> AuthResult<String>;
}

pub(super) async fn store<S: AuthSchema>(
    ctx: &AuthContext<S>,
    config: &super::OAuthProviderConfig,
    secret: &str,
) -> AuthResult<String> {
    if let Some(hasher) = &config.client_secret_hasher {
        return hasher.hash(secret).await;
    }
    if let Some(cipher) = &config.client_secret_cipher {
        return cipher.encrypt(secret).await;
    }
    if config.disable_jwt_plugin {
        crate::token_crypto::encrypt_with_config(secret, &ctx.config)
    } else {
        Ok(URL_SAFE_NO_PAD.encode(Sha256::digest(secret)))
    }
}

pub(super) async fn verify<S: AuthSchema>(
    ctx: &AuthContext<S>,
    config: &super::OAuthProviderConfig,
    secret: &str,
    stored: &str,
) -> AuthResult<bool> {
    if secret.is_empty() {
        return Ok(false);
    }
    if let Some(hasher) = &config.client_secret_hasher {
        return hasher.verify(secret, stored).await;
    }
    if let Some(cipher) = &config.client_secret_cipher {
        let plaintext = cipher.decrypt(stored).await?;
        return Ok(bool::from(plaintext.as_bytes().ct_eq(secret.as_bytes())));
    }
    if config.disable_jwt_plugin {
        Ok(
            crate::token_crypto::decrypt_with_config(stored, &ctx.config)
                .is_ok_and(|plaintext| bool::from(plaintext.as_bytes().ct_eq(secret.as_bytes()))),
        )
    } else {
        let hash = URL_SAFE_NO_PAD.encode(Sha256::digest(secret));
        Ok(bool::from(hash.as_bytes().ct_eq(stored.as_bytes())))
    }
}

pub(super) async fn decrypt<S: AuthSchema>(
    ctx: &AuthContext<S>,
    config: &super::OAuthProviderConfig,
    stored: &str,
) -> AuthResult<String> {
    if let Some(cipher) = &config.client_secret_cipher {
        return cipher.decrypt(stored).await;
    }
    crate::token_crypto::decrypt_with_config(stored, &ctx.config)
}