anzar-shared 0.9.15

Anzar is a lightweight authentication and authorization framework that runs as a separate microservice
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93

use crate::error::{AuthError, CoreError, Result, TokenErrorType};

use crate::domain::model::{Claims, IssuedTokens, RefreshToken, TokenType};
use crate::intern::session::SessionService;

impl SessionService {
    #[tracing::instrument(name = "auth.consume_refresh_token", skip(self, refresh_token))]
    pub async fn consume_refresh_token(&self, refresh_token: &str) -> Result<String> {
        let claims: Claims = self.crypto.jwt()?.decode(refresh_token)?;

        if claims.token_type != TokenType::RefreshToken {
            return Err(CoreError::Unauthenticated(AuthError::TokenInvalid {
                token_type: TokenErrorType::RefreshToken,
            }));
        }

        match self.jwt_repository.find_and_consume(&claims).await {
            Ok(_) => Ok(claims.sub),
            Err(CoreError::Unauthenticated { .. }) => {
                // Potential breach — revoke everything for this user
                // TODO: Send an email indicating a breach
                self.jwt_repository.revoke(&claims.sub).await?;
                Err(CoreError::Unauthenticated(AuthError::TokenReplay {
                    token_type: TokenErrorType::RefreshToken,
                }))
            }
            Err(e) => Err(e), // NotFound, Expired bubble up as-is
        }
    }

    #[tracing::instrument(
        name = "auth.issue_jwt", skip(self), fields(user.id = user_id)
    )]
    pub async fn issue_jwt(
        &self,
        user_id: &str,
        full_permissions: Vec<String>,
    ) -> Result<IssuedTokens> {
        let jwt_config = self.configuration.auth.jwt()?;
        let rbac_config = &self.configuration.auth.rbac;
        let jwt = self.crypto.jwt()?;

        let (access_claims, refresh_claims) = Claims::new(user_id, &rbac_config.default_role)
            .with_issuer(&jwt_config.issuer)
            .with_audience(&jwt_config.audience)
            .with_permissions(full_permissions)
            .into_token_pair(jwt_config);
        let jti = refresh_claims.jti;

        let refresh_token = RefreshToken::new(&jti.to_string())
            .with_user_id(user_id)
            .with_expire_at(jwt_config.refresh_token_expires_in);
        self.jwt_repository.insert(refresh_token).await?;

        let access = jwt.encode(access_claims)?;
        let refresh = jwt.encode(refresh_claims)?;
        Ok(IssuedTokens::default()
            .with_access_token(&access)
            .with_refresh_token(&refresh)
            .with_jti(jti))
    }

    #[tracing::instrument(name = "auth.invalidate_jwt", skip(self, refresh_token))]
    pub async fn invalidate_jwt(&self, refresh_token: &str) -> Result<()> {
        let claims: Claims = self.crypto.jwt()?.decode(refresh_token)?;

        if claims.token_type != TokenType::RefreshToken {
            return Err(CoreError::from(AuthError::TokenInvalid {
                token_type: TokenErrorType::RefreshToken,
            }));
        }

        self.jwt_repository.invalidate(claims.jti).await?;
        Ok(())
    }

    // async fn logout(&self, payload: AuthPayload) -> Result<()> {
    //     self.jwt_service.invalidate(&payload.jti).await?;
    //     self.session_service.revoke(&payload.user_id).await?;
    //     Ok(())
    // }
    #[tracing::instrument(name = "auth.logout_all", skip(self), fields(user.id = user_id))]
    pub async fn logout_all(&self, user_id: &str) -> Result<()> {
        self.jwt_repository.revoke(user_id).await?;
        self.session_repository.revoke(user_id).await?;
        Ok(())
    }

    #[tracing::instrument(name = "auth.find_jwt_by_jti", skip(self, jti))]
    pub async fn find_jwt_by_jti(&self, jti: &str) -> Result<RefreshToken> {
        self.jwt_repository.find_by_jti(jti).await
    }
}