corteq 0.1.0

Enterprise-grade multi-tenant SaaS framework for Rust with security-first design
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127

//! Authentication module with JWT support

use crate::{CorteqError, Result};
use jsonwebtoken::{DecodingKey, EncodingKey, Header, Validation};
use serde::{Deserialize, Serialize};
use uuid::Uuid;

/// JWT claims with tenant context
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct Claims {
    /// Subject (user ID)
    pub sub: Uuid,

    /// Tenant ID - CRITICAL: Embedded in token for security
    pub tenant_id: Uuid,

    /// User roles
    pub roles: Vec<String>,

    /// Expiration time (Unix timestamp)
    pub exp: i64,

    /// Issued at (Unix timestamp)
    pub iat: i64,
}

/// JWT service for token creation and validation
#[derive(Clone)]
pub struct JwtService {
    encoding_key: EncodingKey,
    decoding_key: DecodingKey,
    validation: Validation,
}

impl std::fmt::Debug for JwtService {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        f.debug_struct("JwtService")
            .field("validation", &self.validation)
            .finish_non_exhaustive()
    }
}

impl JwtService {
    /// Create a new JWT service with the given secret
    pub fn new(secret: &[u8]) -> Self {
        Self {
            encoding_key: EncodingKey::from_secret(secret),
            decoding_key: DecodingKey::from_secret(secret),
            validation: Validation::default(),
        }
    }

    /// Encode claims into a JWT token
    pub fn encode(&self, claims: &Claims) -> Result<String> {
        jsonwebtoken::encode(&Header::default(), claims, &self.encoding_key)
            .map_err(CorteqError::from)
    }

    /// Decode and validate a JWT token
    pub fn decode(&self, token: &str) -> Result<Claims> {
        let token_data =
            jsonwebtoken::decode::<Claims>(token, &self.decoding_key, &self.validation)?;

        Ok(token_data.claims)
    }

    /// Validate that a token belongs to a specific tenant
    pub fn validate_tenant(&self, token: &str, expected_tenant_id: Uuid) -> Result<Claims> {
        let claims = self.decode(token)?;

        if claims.tenant_id != expected_tenant_id {
            return Err(CorteqError::AuthorizationFailed(
                "Token tenant mismatch".to_string(),
            ));
        }

        Ok(claims)
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use chrono::Utc;

    #[test]
    fn test_jwt_encode_decode() {
        let service = JwtService::new(b"test-secret");

        let claims = Claims {
            sub: Uuid::new_v4(),
            tenant_id: Uuid::new_v4(),
            roles: vec!["user".to_string()],
            exp: (Utc::now() + chrono::Duration::hours(1)).timestamp(),
            iat: Utc::now().timestamp(),
        };

        let token = service.encode(&claims).unwrap();
        let decoded = service.decode(&token).unwrap();

        assert_eq!(claims.sub, decoded.sub);
        assert_eq!(claims.tenant_id, decoded.tenant_id);
    }

    #[test]
    fn test_tenant_validation() {
        let service = JwtService::new(b"test-secret");
        let tenant_id = Uuid::new_v4();

        let claims = Claims {
            sub: Uuid::new_v4(),
            tenant_id,
            roles: vec!["user".to_string()],
            exp: (Utc::now() + chrono::Duration::hours(1)).timestamp(),
            iat: Utc::now().timestamp(),
        };

        let token = service.encode(&claims).unwrap();

        // Should succeed with correct tenant
        assert!(service.validate_tenant(&token, tenant_id).is_ok());

        // Should fail with wrong tenant
        let wrong_tenant = Uuid::new_v4();
        assert!(service.validate_tenant(&token, wrong_tenant).is_err());
    }
}