structured_proxy/auth/
crypto.rs

1//! Process-wide `jsonwebtoken` crypto provider selection.
2//!
3//! `jsonwebtoken` infers its provider from its own two backend features, and
4//! with both on it cannot: it falls back to a provider that panics on first
5//! use. Cargo features being additive, that combination arrives on its own.
6//! Either this crate's `rust_crypto` and `aws_lc_rs` are both enabled (two
7//! dependents asking for different backends, or `--all-features`, which is what
8//! docs.rs and `cargo-semver-checks` use), or one of ours is enabled while
9//! another crate in the graph turns on the other `jsonwebtoken` feature
10//! directly. The second case looks single-backend from here, so the provider is
11//! installed explicitly whichever backend this crate compiled with.
12
13#[cfg(test)]
14mod tests;
15
16/// The provider this crate installs.
17///
18/// `aws_lc_rs` wins whenever it is compiled in: it is constant-time and
19/// advisory-free, while `rust_crypto` pulls in `rsa` (RUSTSEC-2023-0071).
20#[cfg(feature = "aws_lc_rs")]
21pub(crate) fn preferred_provider() -> &'static jsonwebtoken::crypto::CryptoProvider {
22    &jsonwebtoken::crypto::aws_lc::DEFAULT_PROVIDER
23}
24
25/// The provider this crate installs: RustCrypto, the only backend this build
26/// compiled with.
27#[cfg(all(feature = "rust_crypto", not(feature = "aws_lc_rs")))]
28pub(crate) fn preferred_provider() -> &'static jsonwebtoken::crypto::CryptoProvider {
29    &jsonwebtoken::crypto::rust_crypto::DEFAULT_PROVIDER
30}
31
32/// Select the `jsonwebtoken` crypto provider for this process.
33///
34/// Call it once at startup, before anything in the process signs or verifies a
35/// JWT. It is idempotent, and installs the backend this crate was built with,
36/// so `jsonwebtoken` never has to infer one.
37///
38/// A plain [`ProxyServer`](crate::ProxyServer) deployment needs no call: the
39/// server does this while it is being built. It is public for the case the
40/// server cannot cover, which is also how the ambiguity arises in the first
41/// place: another crate in the graph uses `jsonwebtoken` too and may reach it
42/// first. Call this at the top of `main` and every consumer is covered,
43/// whichever runs first.
44///
45/// With both backends linked the choice is `aws_lc_rs`: constant-time, and free
46/// of the `rsa` advisory `rust_crypto` carries. A process that wants a different
47/// one installs it through
48/// [`CryptoProvider::install_default`](jsonwebtoken::crypto::CryptoProvider::install_default)
49/// before calling this, and the earlier choice stands.
50pub fn install_default_crypto_provider() {
51    if preferred_provider().install_default().is_err() {
52        // Something installed a provider before us: an embedder that made its
53        // own choice, or an earlier call here. Either way it stands: the
54        // process gets one provider, and the first explicit choice is the one
55        // the caller meant.
56        tracing::debug!("jsonwebtoken crypto provider already installed; keeping it");
57    }
58}
structured_proxy/auth/crypto.rs

structured_proxy/auth/
crypto.rs
