Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

VEGA-2340 Accept URNs in JWTs #minor #115

Merged
merged 2 commits into from
Feb 28, 2024
Merged

VEGA-2340 Accept URNs in JWTs #minor #115

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5944726
Allow URN as JWT subject
Feb 20, 2024
23a76bc
Use more realistic MRLPA sub in tests
Feb 20, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,7 @@ require (
github.com/jmespath/go-jmespath v0.4.0 // indirect
github.com/klauspost/compress v1.17.2 // indirect
github.com/kr/pretty v0.3.1 // indirect
github.com/leodido/go-urn v1.4.0 // indirect
github.com/pkg/errors v0.9.1 // indirect
github.com/pmezard/go-difflib v1.0.0 // indirect
github.com/valyala/bytebufferpool v1.0.0 // indirect
Expand Down
2 changes: 2 additions & 0 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,6 +71,8 @@ github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ=
github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI=
github.com/ministryofjustice/opg-go-common v0.0.0-20231128145056-24628fba649c h1:598i3upKVEHRLW+eSkGmCaV7+yIaFTV6lMiHOC3tXDY=
github.com/ministryofjustice/opg-go-common v0.0.0-20231128145056-24628fba649c/go.mod h1:qktwZb46YkojkLVHU2QNnVK6yVktXkNpBuJ+TyobvuY=
github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
Expand Down
25 changes: 13 additions & 12 deletions internal/shared/jwt.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,8 @@ import (
"time"

"github.com/aws/aws-lambda-go/events"
"github.com/golang-jwt/jwt/v5"
jwt "github.com/golang-jwt/jwt/v5"
urn "github.com/leodido/go-urn"
)

const (
Expand Down Expand Up @@ -61,17 +62,17 @@ func (l LpaStoreClaims) Validate() error {
return err
}

if iss == sirius {
emailRegex := regexp.MustCompile("^[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$")
if !emailRegex.MatchString(sub) {
return errors.New("Subject is not a valid email")
}
}

if iss == mrlpa {
uidRegex := regexp.MustCompile("^.+$")
if !uidRegex.MatchString(sub) {
return errors.New("Subject is not a valid UID")
_, isUrn := urn.Parse([]byte(sub))

if !isUrn {
switch iss {
case mrlpa:
return errors.New("Subject is not a valid URN")
case sirius:
emailRegex := regexp.MustCompile("^[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$")
if !emailRegex.MatchString(sub) {
return errors.New("Subject is not a valid email or URN")
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Minor comment but in this case the subject is neither a valid email nor URN right? If so, could the error message reflect that?

}
}
}

Expand Down
34 changes: 28 additions & 6 deletions internal/shared/jwt_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@ func TestVerifyExpInPast(t *testing.T) {
"exp": time.Now().Add(time.Hour * -24).Unix(),
"iat": time.Now().Add(time.Hour * -24).Unix(),
"iss": "opg.poas.makeregister",
"sub": "M-3467-89QW-ERTY",
"sub": "urn:opg:poas:makeregister:users:e6707412-c9cd-4547-b428-7039a87e985e",
})

_, err := verifier.verifyToken(token)
Expand Down Expand Up @@ -78,7 +78,7 @@ func TestVerifyIssuer(t *testing.T) {
}
}

func TestVerifyBadEmailForSiriusIssuer(t *testing.T) {
func TestVerifyBadSubForSiriusIssuer(t *testing.T) {
token := createToken(jwt.MapClaims{
"exp": time.Now().Add(time.Hour * 24).Unix(),
"iat": time.Now().Add(time.Hour * -24).Unix(),
Expand All @@ -90,11 +90,11 @@ func TestVerifyBadEmailForSiriusIssuer(t *testing.T) {

assert.NotNil(t, err)
if err != nil {
assert.Containsf(t, err.Error(), "Subject is not a valid email", "")
assert.Containsf(t, err.Error(), "Subject is not a valid email or URN", "")
}
}

func TestVerifyBadUIDForMRLPAIssuer(t *testing.T) {
func TestVerifyBadSubForMRLPAIssuer(t *testing.T) {
token := createToken(jwt.MapClaims{
"exp": time.Now().Add(time.Hour * 24).Unix(),
"iat": time.Now().Add(time.Hour * -24).Unix(),
Expand All @@ -106,11 +106,11 @@ func TestVerifyBadUIDForMRLPAIssuer(t *testing.T) {

assert.NotNil(t, err)
if err != nil {
assert.Containsf(t, err.Error(), "Subject is not a valid UID", "")
assert.Containsf(t, err.Error(), "Subject is not a valid URN", "")
}
}

func TestVerifyGoodJwt(t *testing.T) {
func TestVerifyGoodJwtSiriusSubs(t *testing.T) {
token := createToken(jwt.MapClaims{
"exp": time.Now().Add(time.Hour * 24).Unix(),
"iat": time.Now().Add(time.Hour * -24).Unix(),
Expand All @@ -120,6 +120,28 @@ func TestVerifyGoodJwt(t *testing.T) {

_, err := verifier.verifyToken(token)
assert.Nil(t, err)

token = createToken(jwt.MapClaims{
"exp": time.Now().Add(time.Hour * 24).Unix(),
"iat": time.Now().Add(time.Hour * -24).Unix(),
"iss": "opg.poas.sirius",
"sub": "urn:opg:sirius:users:34",
})

_, err = verifier.verifyToken(token)
assert.Nil(t, err)
}

func TestVerifyGoodJwtMRLPASubs(t *testing.T) {
token := createToken(jwt.MapClaims{
"exp": time.Now().Add(time.Hour * 24).Unix(),
"iat": time.Now().Add(time.Hour * -24).Unix(),
"iss": "opg.poas.makeregister",
"sub": "urn:opg:poas:makeregister:users:e6707412-c9cd-4547-b428-7039a87e985e",
})

_, err := verifier.verifyToken(token)
assert.Nil(t, err)
}

func TestNewJWTVerifier(t *testing.T) {
Expand Down