ring-jwt-middleware.core — threatgrid/ring-jwt-middleware 0.0.10

accepted-by-scopes clj

(accepted-by-scopes required scopes)

scopes should be strings. if none of the string contains a / nor a :. It works as is a subset of.

:scopes #{"foo" "bar"} only people with scopes which are super sets of #{"foo" "bar"} will be allowed to use the route.

scopes are considered as path with read/write access. so "foo/bar/baz:read" is a sub-scope of "foo" and of "foo:read".

So the more precise rule of access is. All mandatory scopes must be sub-scopes of at least one user scopes.

authorize-no-jwt-header-strategy clj

Authorize all request even with no Auth header.

check-identity-filter! clj

(check-identity-filter! required identity)

check-jwt-expiry clj

(check-jwt-expiry jwt jwt-max-lifetime-in-sec long-lived-jwt?)

Return a string if JWT expiration check fails, nil otherwise

check-jwt-filter! clj

(check-jwt-filter! required jwt)

check-scopes clj

(check-scopes required scopes)

This function might be useful to be used directly instead of just relying on the :scope.

check-scopes! clj

(check-scopes! required identity)

decode clj

(decode token pubkey)

Given a JWT return an Auth hash-map

default-jwt-lifetime-in-sec clj

forbid-no-jwt-header-strategy clj

(forbid-no-jwt-header-strategy handler)

Forbid all request with no Auth header

get-jwt clj

(get-jwt req)

get the JWT from a ring request

hr-duration clj

(hr-duration t)

Given a duration in ms, return a human readable string

jwt->oauth-ids clj

(jwt->oauth-ids prefix jwt)

can be used as post-jwt-format-fn

This is an example function that given a JWT whose claims looks like:

• :sub
• "<prefix>/scopes"
• "<prefix>/org/id"
• "<prefix>/oauth/client/id"

It is a generic format about what an access-token should provide:

• user-id, client-id, scopes
• org-id

mainly transform a list of <prefix>/foo/bar/baz value into a deep nested map. For example:

(sut/jwt->oauth-ids "http://example.com/claims" {:sub "user-id" "http://example.com/claims/scopes" ["scope1" "scope2"] "http://example.com/claims/user/id" "user-id" "http://example.com/claims/user/name" "John Doe" "http://example.com/claims/user/email" "[e-mail]" "http://example.com/claims/user/idp/id" "iroh" "http://example.com/claims/user/idp/name" "Visibility" "http://example.com/claims/org/id" "org-id" "http://example.com/claims/org/name" "ACME Inc." "http://example.com/claims/oauth/client/id" "client-id" "http://example.com/claims/oauth/kind" "code"})

=> {:user {:idp {:name "Visibility" :id "iroh"}, :name "John Doe", :email "[e-mail]", :id "user-id"} :oauth {:kind "code" :client {:id "client-id"}}, :org {:name "ACME Inc." :id "org-id"}, :scopes #{"scope1" "scope2"}}

jwt->user-id clj

(jwt->user-id jwt)

can be used as post-jwt-format-fn

jwt-expiry-ms clj

(jwt-expiry-ms jwt-created jwt-max-lifetime-in-sec)

Given a JWT and a lifetime, calculate when it expired

log-and-refuse clj

(log-and-refuse error-log-msg error-msg)

Return an unauthorized HTTP response and log the error along debug infos

match-access clj

(match-access required-access access)

match-scope clj

(match-scope required-scope scope)

no-long-lived-jwt clj

no-revocation-strategy clj

sub-hash? clj

(sub-hash? m1 m2)

Return true if the 1st hashmap is a sub hashmap of the second.

Take into account that if some value is a collection then only check if the corresponding value in the first hashmap is a sub-collection.

> (sub-hash? {:foo 1 :bar 2} {:foo 1 :bar 2 :baz 3})
true
> (sub-hash? {:foo 1 :bar #{2 3}} {:foo 1 :bar #{1 2 3 4} :baz 3})
true
> (sub-hash? {:foo 1 :bar 2} {:foo 1})
false
> (sub-hash? {:foo 1 :bar 2} {:foo 1 :bar 3})
false

sub-list clj

(sub-list req-list scope-path-list)

to-scope-repr clj

(to-scope-repr txt)

Transform a textual scope as an internal representation to help check rules typically

"foo" {:path ["foo"] :access #{:read :write}}

"foo/bar/baz:write" {:path ["foo" "bar" "baz"] :access #{:write}}

validate-jwt clj

(validate-jwt jwt jwt-max-lifetime-in-sec)

(validate-jwt jwt jwt-max-lifetime-in-sec jwt-check-fn long-lived-jwt?)

Run both expiration and user checks, return a vec of errors or nothing

wrap-jwt-auth-fn clj

(wrap-jwt-auth-fn {:keys [pubkey-path is-revoked-fn jwt-check-fn
                          jwt-max-lifetime-in-sec post-jwt-format-fn
                          no-jwt-handler long-lived-jwt?]
                   :or {jwt-max-lifetime-in-sec default-jwt-lifetime-in-sec
                        is-revoked-fn no-revocation-strategy
                        post-jwt-format-fn jwt->user-id
                        no-jwt-handler forbid-no-jwt-header-strategy
                        long-lived-jwt? no-long-lived-jwt}})

wrap a ring handler with JWT check