mirror of
https://github.com/renorris/openfsd
synced 2026-03-22 14:35:36 +08:00
57d54d6705
Changes:
- Implement bootstrapping library for managing several concurrent internal services
- Refactor concurrency model for connections/logical clients and their associated I/O
- Refactor server context singleton
- Refactor error handling
- Most errors are now gracefully sent to the FSD client directly encoded as an $ER packet,
enhancing visibility and debugging
- Most errors are now rightfully treated as non-fatal
- Refactor package/dependency graph
- Refactor calling conventions/interfaces for many packages
- Refactor database package
- Refactor post office
Features:
- Add VATSIM-esque HTTP/JSON "data feed"
- Add ephemeral in-memory database option
- Add user management REST API
- Add improved web interface
- Add MySQL support (drop SQLite support)
56 lines
1.4 KiB
Go
56 lines
1.4 KiB
Go
package auth
|
|
|
|
import (
|
|
"errors"
|
|
"github.com/golang-jwt/jwt/v5"
|
|
"github.com/renorris/openfsd/servercontext"
|
|
"time"
|
|
)
|
|
|
|
// JWTVerifier is an frontend for verifying JWT tokens
|
|
type JWTVerifier interface {
|
|
VerifyJWT(tokenStr string) (*jwt.Token, error)
|
|
}
|
|
|
|
// DefaultVerifier is the default implementation of JWTVerifier
|
|
type DefaultVerifier struct{}
|
|
|
|
// VerifyJWT verifies the signature, issuer, expiration times, and not-before times of a token string
|
|
func (d DefaultVerifier) VerifyJWT(tokenStr string) (token *jwt.Token, err error) {
|
|
if token, err = jwt.Parse(tokenStr, func(token *jwt.Token) (interface{}, error) {
|
|
return servercontext.JWTKey(), nil
|
|
}, jwt.WithValidMethods([]string{"HS256"})); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
var issuer string
|
|
if issuer, err = token.Claims.GetIssuer(); err != nil {
|
|
return nil, err
|
|
}
|
|
if issuer != "openfsd" {
|
|
return nil, errors.New("issuer != openfsd")
|
|
}
|
|
|
|
// Verify expiration time
|
|
var expirationTime *jwt.NumericDate
|
|
if expirationTime, err = token.Claims.GetExpirationTime(); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
if expirationTime.Before(time.Now()) {
|
|
return nil, errors.New("token expired")
|
|
}
|
|
|
|
// Verify not-before time
|
|
var notBeforeTime *jwt.NumericDate
|
|
if notBeforeTime, err = token.Claims.GetNotBefore(); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
if notBeforeTime.After(time.Now()) {
|
|
return nil, errors.New("token not yet valid")
|
|
}
|
|
|
|
return
|
|
}
|