mikcar 0.1.1

Sidecar infrastructure services for mik (storage, kv, sql, queue)
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147

//! Token-based authentication middleware.
//!
//! Simple bearer token auth for internal sidecar communication.
//! In production, sidecars should also be network-isolated.
//!
//! Uses constant-time comparison to prevent timing attacks.

use axum::{
    body::Body,
    extract::Request,
    http::{StatusCode, header},
    middleware::Next,
    response::Response,
};
use subtle::ConstantTimeEq;

/// Token authentication configuration.
#[derive(Clone)]
pub struct TokenAuth {
    /// Expected token value.
    token: Option<String>,
}

impl std::fmt::Debug for TokenAuth {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        f.debug_struct("TokenAuth")
            .field("token", &self.token.as_ref().map(|_| "[REDACTED]"))
            .finish()
    }
}

impl TokenAuth {
    /// Create auth with a specific token.
    #[must_use]
    pub fn new(token: impl Into<String>) -> Self {
        Self {
            token: Some(token.into()),
        }
    }

    /// Create auth from environment variable.
    ///
    /// Reads `SIDECAR_TOKEN` or `AUTH_TOKEN` from environment.
    /// If neither is set, authentication is disabled.
    #[must_use]
    pub fn from_env() -> Self {
        let token = std::env::var("SIDECAR_TOKEN")
            .or_else(|_| std::env::var("AUTH_TOKEN"))
            .ok();
        Self { token }
    }

    /// Create disabled auth (no token required).
    #[must_use]
    pub fn disabled() -> Self {
        Self { token: None }
    }

    /// Check if authentication is enabled.
    #[must_use]
    pub fn is_enabled(&self) -> bool {
        self.token.is_some()
    }

    /// Validate a token using constant-time comparison.
    ///
    /// Uses constant-time comparison to prevent timing attacks where an
    /// attacker could infer the correct token by measuring response times.
    #[must_use]
    pub fn validate(&self, provided: &str) -> bool {
        match &self.token {
            Some(expected) => {
                // Use constant-time comparison to prevent timing attacks.
                // Both strings must be compared in their entirety regardless
                // of where they first differ.
                let expected_bytes = expected.as_bytes();
                let provided_bytes = provided.as_bytes();

                // Length check must also be constant-time to avoid leaking length info
                if expected_bytes.len() != provided_bytes.len() {
                    // Still do a comparison to maintain constant time
                    let _ = expected_bytes.ct_eq(expected_bytes);
                    return false;
                }

                expected_bytes.ct_eq(provided_bytes).into()
            }
            None => true, // No auth required
        }
    }
}

/// Middleware function for token authentication.
///
/// Expects `Authorization: Bearer <token>` header.
pub async fn auth_middleware(
    auth: TokenAuth,
    request: Request<Body>,
    next: Next,
) -> Result<Response, StatusCode> {
    // Skip auth if disabled
    if !auth.is_enabled() {
        return Ok(next.run(request).await);
    }

    // Skip auth for health endpoint
    if request.uri().path() == "/health" {
        return Ok(next.run(request).await);
    }

    // Extract Authorization header
    let auth_header = request
        .headers()
        .get(header::AUTHORIZATION)
        .and_then(|h| h.to_str().ok());

    match auth_header {
        Some(header) if header.starts_with("Bearer ") => {
            let token = &header[7..];
            if auth.validate(token) {
                Ok(next.run(request).await)
            } else {
                Err(StatusCode::UNAUTHORIZED)
            }
        }
        Some(_) | None => Err(StatusCode::UNAUTHORIZED),
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn test_token_auth_validation() {
        let auth = TokenAuth::new("secret123");
        assert!(auth.validate("secret123"));
        assert!(!auth.validate("wrong"));
    }

    #[test]
    fn test_disabled_auth() {
        let auth = TokenAuth::disabled();
        assert!(!auth.is_enabled());
        assert!(auth.validate("anything"));
    }
}