Skip to content

Commit 12fe8be

Browse files
silva-fjsilva-fj
authored
Include client_id as aud claim in jwt (#3495)
1 parent e364ea2 commit 12fe8be

File tree

17 files changed

+72
-35
lines changed

17 files changed

+72
-35
lines changed

‎tee-worker/omni-executor/executor-crypto/src/jwt.rs

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -17,13 +17,17 @@ pub fn create<T: Serialize>(claims: &T, private_key: &[u8]) -> Result<String, St
1717
pub fn decode<T: DeserializeOwned>(
1818
token: &str,
1919
public_key: &[u8],
20+
audiences: Option<&[&str]>,
2021
skip_exp_check: bool,
2122
) -> Result<T, Error> {
2223
let mut validation = Validation::new(Algorithm::RS256);
2324
if skip_exp_check {
2425
validation.validate_exp = false;
2526
}
26-
validation.set_required_spec_claims(&["sub", "typ"]);
27+
validation.set_required_spec_claims(&["sub", "typ", "aud"]);
28+
if let Some(audiences) = audiences {
29+
validation.set_audience(audiences);
30+
}
2731
let decoding_key = DecodingKey::from_rsa_der(public_key);
2832
decode_jwt::<T>(token, &decoding_key, &validation).map(|data| data.claims)
2933
}
@@ -41,6 +45,7 @@ mod tests {
4145
struct JwtClaims {
4246
pub sub: String,
4347
pub exp: i64,
48+
pub aud: String,
4449
}
4550

4651
#[test]
@@ -55,10 +60,11 @@ mod tests {
5560
.checked_add_days(Days::new(1))
5661
.expect("Failed to calculate expiration")
5762
.timestamp();
58-
let claims = JwtClaims { sub: "test".to_string(), exp };
63+
let claims = JwtClaims { sub: "test".to_string(), exp, aud: "test_aud".to_string() };
5964

6065
let token = create(&claims, private_key.as_bytes()).unwrap();
61-
let decoded = decode::<JwtClaims>(&token, public_key.as_bytes(), false).unwrap();
66+
let decoded =
67+
decode::<JwtClaims>(&token, public_key.as_bytes(), Some(&["test_aud"]), false).unwrap();
6268

6369
assert_eq!(claims, decoded);
6470
}
@@ -75,10 +81,11 @@ mod tests {
7581
.checked_sub_days(Days::new(5)) // some time before now
7682
.expect("Failed to calculate expiration")
7783
.timestamp();
78-
let claims = JwtClaims { sub: "test".to_string(), exp };
84+
let claims = JwtClaims { sub: "test".to_string(), exp, aud: "test_aud".to_string() };
7985

8086
let token = create(&claims, private_key.as_bytes()).unwrap();
81-
let decoded = decode::<JwtClaims>(&token, public_key.as_bytes(), true).unwrap();
87+
let decoded =
88+
decode::<JwtClaims>(&token, public_key.as_bytes(), Some(&["test_aud"]), true).unwrap();
8289

8390
assert_eq!(claims, decoded);
8491
}

‎tee-worker/omni-executor/heima/authentication/src/auth_token.rs

Lines changed: 23 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
use crate::constants::{CLIENT_ID_HEIMA, CLIENT_ID_PUMPX};
12
use executor_crypto::jwt;
23
use parity_scale_codec::{Decode, Encode};
34
use rsa::{
@@ -14,10 +15,6 @@ pub enum Error {
1415
JwtError(jwt::ErrorKind),
1516
}
1617

17-
pub const AUTH_TOKEN_EXPIRATION_DAYS: u64 = 7; // 1 week
18-
pub const AUTH_TOKEN_ACCESS_TYPE: &str = "access";
19-
pub const AUTH_TOKEN_ID_TYPE: &str = "id";
20-
2118
#[derive(Encode, Decode, Clone, Debug, PartialEq, Eq)]
2219
pub struct AuthOptions {
2320
pub expires_at: i64,
@@ -28,11 +25,12 @@ pub struct AuthTokenClaims {
2825
pub sub: String,
2926
pub typ: String,
3027
pub exp: i64,
28+
pub aud: String,
3129
}
3230

3331
impl AuthTokenClaims {
34-
pub fn new(sub: String, typ: String, options: AuthOptions) -> Self {
35-
Self { sub, typ, exp: options.expires_at }
32+
pub fn new(sub: String, typ: String, aud: String, options: AuthOptions) -> Self {
33+
Self { sub, typ, exp: options.expires_at, aud }
3634
}
3735
}
3836

@@ -71,9 +69,13 @@ impl AuthTokenValidator<AuthTokenClaims> for String {
7169
.to_public_key()
7270
.to_pkcs1_der()
7371
.map_err(|_| Error::InternalError)?;
74-
let claims =
75-
jwt::decode::<AuthTokenClaims>(self, public_key.as_bytes(), validation.skip_exp_check)
76-
.map_err(|e| Error::JwtError(e.kind().clone()))?;
72+
let claims = jwt::decode::<AuthTokenClaims>(
73+
self,
74+
public_key.as_bytes(),
75+
Some(&[CLIENT_ID_HEIMA, CLIENT_ID_PUMPX]),
76+
validation.skip_exp_check,
77+
)
78+
.map_err(|e| Error::JwtError(e.kind().clone()))?;
7779
validation.validate(&claims)?;
7880
Ok(claims)
7981
}
@@ -91,16 +93,22 @@ impl AuthTokenValidator<AuthTokenClaims> for &str {
9193
.to_public_key()
9294
.to_pkcs1_der()
9395
.map_err(|_| Error::InternalError)?;
94-
let claims =
95-
jwt::decode::<AuthTokenClaims>(self, public_key.as_bytes(), validation.skip_exp_check)
96-
.map_err(|e| Error::JwtError(e.kind().clone()))?;
96+
let claims = jwt::decode::<AuthTokenClaims>(
97+
self,
98+
public_key.as_bytes(),
99+
Some(&[CLIENT_ID_HEIMA, CLIENT_ID_PUMPX]),
100+
validation.skip_exp_check,
101+
)
102+
.map_err(|e| Error::JwtError(e.kind().clone()))?;
97103
validation.validate(&claims)?;
98104
Ok(claims)
99105
}
100106
}
101107

102108
#[cfg(test)]
103109
mod tests {
110+
use crate::constants::{AUTH_TOKEN_ACCESS_TYPE, AUTH_TOKEN_ID_TYPE, CLIENT_ID_HEIMA};
111+
104112
use super::*;
105113
use chrono::{Days, Utc};
106114
use executor_primitives::{utils::hex::ToHexPrefixed, Identity, Web2IdentityType};
@@ -136,6 +144,7 @@ mod tests {
136144
let claims = AuthTokenClaims::new(
137145
omni_account.to_hex(),
138146
AUTH_TOKEN_ID_TYPE.to_string(),
147+
CLIENT_ID_HEIMA.to_string(),
139148
AuthOptions { expires_at },
140149
);
141150
let token = jwt::create(&claims, private_key.as_bytes()).unwrap();
@@ -159,6 +168,7 @@ mod tests {
159168
let claims = AuthTokenClaims::new(
160169
omni_account.to_hex(),
161170
AUTH_TOKEN_ID_TYPE.to_string(),
171+
CLIENT_ID_HEIMA.to_string(),
162172
AuthOptions { expires_at: 100 },
163173
);
164174
let token = jwt::create(&claims, private_key.as_bytes()).unwrap();
@@ -234,6 +244,7 @@ mod tests {
234244
let claims = AuthTokenClaims::new(
235245
omni_account.to_hex(),
236246
AUTH_TOKEN_ACCESS_TYPE.to_string(),
247+
CLIENT_ID_HEIMA.to_string(),
237248
AuthOptions { expires_at },
238249
);
239250
let token = jwt::create(&claims, private_key.as_bytes()).unwrap();

‎tee-worker/omni-executor/heima/authentication/src/constants.rs

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
// Authentication related constants
2+
pub const AUTH_TOKEN_EXPIRATION_DAYS: u64 = 7; // 1 week
3+
pub const AUTH_TOKEN_ACCESS_TYPE: &str = "access";
4+
pub const AUTH_TOKEN_ID_TYPE: &str = "id";
5+
6+
// Client ID constants for JWT audience
7+
pub const CLIENT_ID_HEIMA: &str = "heima";
8+
pub const CLIENT_ID_PUMPX: &str = "pumpx";

‎tee-worker/omni-executor/heima/authentication/src/lib.rs

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,3 @@
11
pub mod auth_token;
2+
pub mod constants;
23
pub mod web3;

‎tee-worker/omni-executor/intent/executors/cross-chain/src/cross_chain_swap_tests.rs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ use executor_primitives::{EthereumToken, PumpxConfig, SwapOrder};
3636
use executor_storage::Storage;
3737
use executor_storage::StorageDB;
3838
use executor_storage::{PumpxJwtStorage, PumpxProfileStorage};
39-
use heima_authentication::auth_token::AUTH_TOKEN_ACCESS_TYPE;
39+
use heima_authentication::constants::AUTH_TOKEN_ACCESS_TYPE;
4040
use heima_primitives::BoundedVec;
4141
use heima_primitives::IdentityString;
4242
use intent_asset_lock::precise::PreciseAssetsLock;

‎tee-worker/omni-executor/intent/executors/cross-chain/src/lib.rs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ use executor_primitives::PumpxOrderType;
4747
use executor_primitives::SingleChainSwapProvider;
4848
use executor_storage::StorageDB;
4949
use executor_storage::{PumpxJwtStorage, Storage};
50-
use heima_authentication::auth_token::AUTH_TOKEN_ACCESS_TYPE;
50+
use heima_authentication::constants::AUTH_TOKEN_ACCESS_TYPE;
5151
use intent_asset_lock::precise::PreciseAssetsLock;
5252
use intent_asset_lock::AccountAssetLocks;
5353
use intent_asset_lock::AmountType;

‎tee-worker/omni-executor/intent/executors/cross-chain/src/single_chain_swap_tests.rs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ use executor_primitives::{EthereumToken, PumpxConfig, SwapOrder};
3131
use executor_storage::PumpxJwtStorage;
3232
use executor_storage::Storage;
3333
use executor_storage::StorageDB;
34-
use heima_authentication::auth_token::AUTH_TOKEN_ACCESS_TYPE;
34+
use heima_authentication::constants::AUTH_TOKEN_ACCESS_TYPE;
3535
use heima_primitives::BoundedVec;
3636
use heima_primitives::IdentityString;
3737
use intent_asset_lock::precise::PreciseAssetsLock;

‎tee-worker/omni-executor/native-task-handler/src/lib.rs

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,13 @@ use executor_storage::{
1818
IntentIdStorage, MemberOmniAccountStorage, PumpxJwtStorage, PumpxProfileStorage, Storage,
1919
StorageDB,
2020
};
21-
use heima_authentication::auth_token::*;
21+
use heima_authentication::{
22+
auth_token::*,
23+
constants::{
24+
AUTH_TOKEN_ACCESS_TYPE, AUTH_TOKEN_EXPIRATION_DAYS, AUTH_TOKEN_ID_TYPE, CLIENT_ID_HEIMA,
25+
CLIENT_ID_PUMPX,
26+
},
27+
};
2228
use heima_identity_verification::{get_verification_message, web2, web3};
2329
use parentchain_api_interface::runtime_types::{
2430
frame_system::pallet::Call as SystemCall,
@@ -230,12 +236,14 @@ async fn handle_native_task<
230236
AuthTokenClaims::new(
231237
email.to_string(),
232238
AUTH_TOKEN_ID_TYPE.to_string(),
239+
CLIENT_ID_HEIMA.to_string(),
233240
auth_options,
234241
)
235242
},
236243
_ => AuthTokenClaims::new(
237244
sender.hash().to_string(),
238245
AUTH_TOKEN_ID_TYPE.to_string(),
246+
CLIENT_ID_HEIMA.to_string(),
239247
auth_options,
240248
),
241249
};
@@ -618,6 +626,7 @@ async fn handle_native_task<
618626
let access_token_claims = AuthTokenClaims::new(
619627
omni_account.to_hex(),
620628
AUTH_TOKEN_ACCESS_TYPE.to_string(),
629+
CLIENT_ID_PUMPX.to_string(),
621630
auth_options.clone(),
622631
);
623632
let Ok(access_token) = jwt::create(&access_token_claims, &ctx.jwt_rsa_private_key)
@@ -665,6 +674,7 @@ async fn handle_native_task<
665674
let id_token_claims = AuthTokenClaims::new(
666675
omni_account.to_hex(),
667676
AUTH_TOKEN_ID_TYPE.to_string(),
677+
CLIENT_ID_PUMPX.to_string(),
668678
auth_options,
669679
);
670680
let Ok(id_token) = jwt::create(&id_token_claims, &ctx.jwt_rsa_private_key) else {

‎tee-worker/omni-executor/rpc-server/src/methods/omni/notify_limit_order_result.rs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ use crate::verify_auth::verify_auth_token_authentication;
33
use crate::{error_code::*, server::RpcContext, Deserialize, ErrorCode};
44
use executor_core::native_task::*;
55
use executor_primitives::{utils::hex::FromHexPrefixed, OmniAuth};
6-
use heima_authentication::auth_token::AUTH_TOKEN_ACCESS_TYPE;
6+
use heima_authentication::constants::AUTH_TOKEN_ACCESS_TYPE;
77
use heima_primitives::{Address32, Identity};
88
use jsonrpsee::RpcModule;
99
use native_task_handler::NativeTaskOk;

‎tee-worker/omni-executor/rpc-server/src/methods/omni/sign_limit_order.rs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ use executor_core::native_task::PumpxChainId;
2626
use executor_core::native_task::PumxWalletIndex;
2727
use executor_primitives::utils::hex::FromHexPrefixed;
2828
use executor_primitives::OmniAuth;
29-
use heima_authentication::auth_token::AUTH_TOKEN_ACCESS_TYPE;
29+
use heima_authentication::constants::AUTH_TOKEN_ACCESS_TYPE;
3030
use heima_primitives::Address32;
3131
use heima_primitives::Identity;
3232
use heima_primitives::IntentId;

0 commit comments

Comments
 (0)