feat: building layer from rsa, ec, ed, secret

demo-server/src/main.rs

@@ -39,7 +39,7 @@ async fn main() {
 
     let api = Router::new()
         .route("/protected", get(protected))
-        .layer(jwt_auth.layer());
+        .layer(jwt_auth.layer().unwrap());
     // .layer(jwt_auth.check_claims(|_: User| true));
 
     let app = Router::new()

jwt-authorizer/docs/README.md

@@ -21,7 +21,7 @@ Example:
 
     // adding the authorization layer
     let app = Router::new().route("/protected", get(protected))
-            .layer(jwt_auth.layer());         
+            .layer(jwt_auth.layer().unwrap());         
 
     // proteced handler with user injection (mapping some jwt claims) 
     async fn protected(JwtClaims(user): JwtClaims<User>) -> Result<String, AuthError> {

jwt-authorizer/src/authorizer.rs

@@ -4,7 +4,7 @@ use jsonwebtoken::{decode, decode_header, jwk::JwkSet, DecodingKey, TokenData, V
 use serde::de::DeserializeOwned;
 
 use crate::{
-    error::AuthError,
+    error::{AuthError, InitError},
     jwks::{key_store_manager::KeyStoreManager, KeySource},
 };
 
@@ -37,13 +37,21 @@ where
     pub claims_checker: Option<FnClaimsChecker<C>>,
 }
 
-fn read_data(path: &str) -> Result<Vec<u8>, AuthError> {
+fn read_data(path: &str) -> Result<Vec<u8>, InitError> {
     let mut data = Vec::<u8>::new();
     let mut f = std::fs::File::open(path)?;
     f.read_to_end(&mut data)?;
     Ok(data)
 }
 
+pub enum KeySourceType {
+    RSA(String),
+    EC(String),
+    ED(String),
+    Secret(&'static str),
+    Jwks(String),
+}
+
 impl<C> Authorizer<C>
 where
     C: DeserializeOwned + Clone + Send + Sync,
@@ -58,38 +66,22 @@ where
         })
     }
 
-    pub fn from_rsa_file(path: &str) -> Result<Authorizer<C>, AuthError> {
+    pub fn from(key_source_type: &KeySourceType) -> Result<Authorizer<C>, InitError> {
+        let key = match key_source_type {
+            KeySourceType::RSA(path) => DecodingKey::from_rsa_pem(&read_data(path.as_str())?)?,
+            KeySourceType::EC(path) => DecodingKey::from_ec_der(&read_data(path.as_str())?),
+            KeySourceType::ED(path) => DecodingKey::from_ed_der(&read_data(path.as_str())?),
+            KeySourceType::Secret(secret) => DecodingKey::from_secret(secret.as_bytes()),
+            KeySourceType::Jwks(_) => panic!("bug: use from_jwks_url() to initialise Authorizer"), // should never hapen
+        };
+
         Ok(Authorizer {
-            key_source: KeySource::DecodingKeySource(DecodingKey::from_rsa_pem(&read_data(path)?)?),
+            key_source: KeySource::DecodingKeySource(key),
             claims_checker: None,
         })
     }
 
-    pub fn from_ec_file(path: &str) -> Result<Authorizer<C>, AuthError> {
-        let k = DecodingKey::from_ec_der(&read_data(path)?);
-        Ok(Authorizer {
-            key_source: KeySource::DecodingKeySource(k),
-            claims_checker: None,
-        })
-    }
-
-    pub fn from_ed_file(path: &str) -> Result<Authorizer<C>, AuthError> {
-        let k = DecodingKey::from_ed_der(&read_data(path)?);
-        Ok(Authorizer {
-            key_source: KeySource::DecodingKeySource(k),
-            claims_checker: None,
-        })
-    }
-
-    pub fn from_secret(secret: &str) -> Result<Authorizer<C>, AuthError> {
-        let k = DecodingKey::from_secret(secret.as_bytes());
-        Ok(Authorizer {
-            key_source: KeySource::DecodingKeySource(k),
-            claims_checker: None,
-        })
-    }
-
-    pub fn from_jwks_url(url: &str, claims_checker: Option<FnClaimsChecker<C>>) -> Result<Authorizer<C>, AuthError> {
+    pub fn from_jwks_url(url: &str, claims_checker: Option<FnClaimsChecker<C>>) -> Result<Authorizer<C>, InitError> {
         let key_store_manager = KeyStoreManager::with_refresh_interval(url, Duration::from_secs(60));
         Ok(Authorizer {
             key_source: KeySource::KeyStoreSource(key_store_manager),
@@ -119,12 +111,12 @@ mod tests {
     use jsonwebtoken::{Algorithm, Header};
     use serde_json::Value;
 
-    use super::Authorizer;
+    use super::{Authorizer, KeySourceType};
 
     #[tokio::test]
     async fn from_secret() {
         let h = Header::new(Algorithm::HS256);
-        let a = Authorizer::<Value>::from_secret("xxxxxx").unwrap();
+        let a = Authorizer::<Value>::from(&KeySourceType::Secret("xxxxxx")).unwrap();
         let k = a.key_source.get_key(h);
         assert!(k.await.is_ok());
     }
@@ -148,22 +140,22 @@ mod tests {
 
     #[tokio::test]
     async fn from_file() {
-        let a = Authorizer::<Value>::from_rsa_file("../config/jwtRS256.key.pub").unwrap();
+        let a = Authorizer::<Value>::from(&KeySourceType::RSA("../config/jwtRS256.key.pub".to_owned())).unwrap();
         let k = a.key_source.get_key(Header::new(Algorithm::RS256));
         assert!(k.await.is_ok());
 
-        let a = Authorizer::<Value>::from_ec_file("../config/ec256-public.pem").unwrap();
+        let a = Authorizer::<Value>::from(&KeySourceType::EC("../config/ec256-public.pem".to_owned())).unwrap();
         let k = a.key_source.get_key(Header::new(Algorithm::ES256));
         assert!(k.await.is_ok());
 
-        let a = Authorizer::<Value>::from_ed_file("../config/ed25519-public.pem").unwrap();
+        let a = Authorizer::<Value>::from(&KeySourceType::ED("../config/ed25519-public.pem".to_owned())).unwrap();
         let k = a.key_source.get_key(Header::new(Algorithm::EdDSA));
         assert!(k.await.is_ok());
     }
 
     #[tokio::test]
     async fn from_file_errors() {
-        let a = Authorizer::<Value>::from_rsa_file("./config/does-not-exist.pem");
+        let a = Authorizer::<Value>::from(&KeySourceType::RSA("./config/does-not-exist.pem".to_owned()));
         println!("{:?}", a.as_ref().err());
         assert!(a.is_err());
     }

jwt-authorizer/src/error.rs

@@ -8,6 +8,18 @@ use thiserror::Error;
 
 use tracing::log::warn;
 
+#[derive(Debug, Error)]
+pub enum InitError {
+    #[error("Builder Error {0}")]
+    BuilderError(String),
+
+    #[error(transparent)]
+    KeyFileError(#[from] std::io::Error),
+
+    #[error(transparent)]
+    KeyFileDecodingError(#[from] jsonwebtoken::errors::Error),
+}
+
 #[derive(Debug, Error)]
 pub enum AuthError {
     #[error(transparent)]
@@ -16,9 +28,6 @@ pub enum AuthError {
     #[error(transparent)]
     JwksRefreshError(#[from] reqwest::Error),
 
-    #[error(transparent)]
-    KeyFileError(#[from] std::io::Error),
-
     #[error("InvalidKey {0}")]
     InvalidKey(String),
 
@@ -43,7 +52,6 @@ impl IntoResponse for AuthError {
         warn!("AuthError: {}", &self);
         let (status, error_message) = match self {
             AuthError::JwksRefreshError(e) => (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()),
-            AuthError::KeyFileError(e) => (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()),
             AuthError::InvalidKid(msg) => (StatusCode::INTERNAL_SERVER_ERROR, msg),
             AuthError::InvalidTokenHeader(_) => (StatusCode::BAD_REQUEST, self.to_string()),
             AuthError::InvalidToken(_) => (StatusCode::BAD_REQUEST, self.to_string()),

jwt-authorizer/src/layer.rs

@@ -15,7 +15,8 @@ use std::task::{Context, Poll};
 use tower_layer::Layer;
 use tower_service::Service;
 
-use crate::authorizer::{Authorizer, FnClaimsChecker};
+use crate::authorizer::{Authorizer, FnClaimsChecker, KeySourceType};
+use crate::error::InitError;
 
 /// Authorizer Layer builder
 ///
@@ -25,45 +26,54 @@ pub struct JwtAuthorizer<C>
 where
     C: Clone + DeserializeOwned,
 {
-    url: Option<&'static str>,
+    key_source_type: Option<KeySourceType>,
     claims_checker: Option<FnClaimsChecker<C>>,
 }
 
-/// layer builder
+/// authorization layer builder
 impl<C> JwtAuthorizer<C>
 where
     C: Clone + DeserializeOwned + Send + Sync,
 {
     pub fn new() -> Self {
         JwtAuthorizer {
-            url: None,
+            key_source_type: None,
             claims_checker: None,
         }
     }
 
+    /// Build Authorizer Layer from a JWKS endpoint
     pub fn from_jwks_url(mut self, url: &'static str) -> JwtAuthorizer<C> {
-        self.url = Some(url);
+        self.key_source_type = Some(KeySourceType::Jwks(url.to_owned()));
 
         self
     }
 
+    /// Build Authorizer Layer from a RSA PEM file
     pub fn from_rsa_pem(mut self, path: &'static str) -> JwtAuthorizer<C> {
-        // TODO
+        self.key_source_type = Some(KeySourceType::RSA(path.to_owned()));
+
         self
     }
 
-    pub fn from_ec_der(mut self, path: &'static str) -> JwtAuthorizer<C> {
-        // TODO
+    /// Build Authorizer Layer from a EC PEM file
+    pub fn from_ec_pem(mut self, path: &'static str) -> JwtAuthorizer<C> {
+        self.key_source_type = Some(KeySourceType::EC(path.to_owned()));
+
         self
     }
 
-    pub fn from_ed_der(mut self, path: &'static str) -> JwtAuthorizer<C> {
-        // TODO
+    /// Build Authorizer Layer from a EC PEM file
+    pub fn from_ed_pem(mut self, path: &'static str) -> JwtAuthorizer<C> {
+        self.key_source_type = Some(KeySourceType::ED(path.to_owned()));
+
         self
     }
 
-    pub fn from_secret(mut self, path: &'static str) -> JwtAuthorizer<C> {
-        // TODO
+    /// Build Authorizer Layer from a secret phrase
+    pub fn from_secret(mut self, secret: &'static str) -> JwtAuthorizer<C> {
+        self.key_source_type = Some(KeySourceType::Secret(secret));
+
         self
     }
 
@@ -74,12 +84,24 @@ where
         self
     }
 
-    /// build axum layer
-    pub fn layer(&self) -> AsyncAuthorizationLayer<C> {
-        // TODO: replace unwrap
-        let auth = Arc::new(Authorizer::from_jwks_url(self.url.unwrap(), self.claims_checker.clone()).unwrap());
+    /// Build axum layer
+    pub fn layer(&self) -> Result<AsyncAuthorizationLayer<C>, InitError> {
+        let auth = if let Some(ref key_source_type) = self.key_source_type {
+            match key_source_type {
+                KeySourceType::RSA(_) | KeySourceType::EC(_) | KeySourceType::ED(_) | KeySourceType::Secret(_) => {
+                    Arc::new(Authorizer::from(key_source_type)?)
+                }
+                KeySourceType::Jwks(url) => {
+                    Arc::new(Authorizer::from_jwks_url(url.as_str(), self.claims_checker.clone())?)
+                }
+            }
+        } else {
+            return Err(InitError::BuilderError(
+                "No key source to build the layer user from_*() to specify the key source!".to_owned(),
+            ));
+        };
 
-        AsyncAuthorizationLayer::new(auth)
+        Ok(AsyncAuthorizationLayer::new(auth))
     }
 }