Story Crater Bot
47e55afae3
- Add jwt_validator module with JWKS caching (TTL + refresh-on-miss) - Implement RS256 algorithm pinning + claim validation - Replace apikey with Bearer token validation in http_server - Add capability-based access control (memory:read/write/*) - Backward compatible: MEM_AUTH_MODE=jwt|apikey (default: apikey) - 16 tests passing (7 unit + 9 integration) - Docs: JWT_AUTH.md with deployment guide Config via env vars: - MEM_AUTH_MODE=jwt - AUTHENTIK_ISSUER=https://authentik.riotpiao.com/application/o/poimen-memory/ - AUTHENTIK_AUDIENCE=poimen-memory - JWT_CACHE_TTL_SECS=3600 (optional) Gw passes Authorization: Bearer <token> header Memory validates + checks permissions claim
108 lines
3.1 KiB
Rust
108 lines
3.1 KiB
Rust
use mem_cli::jwt_validator::{JwtValidator, JwtClaims};
|
|
|
|
#[test]
|
|
fn test_extract_bearer_token() {
|
|
let header = "Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9";
|
|
let result = JwtValidator::extract_bearer_token(header);
|
|
assert!(result.is_ok());
|
|
assert_eq!(
|
|
result.unwrap(),
|
|
"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9"
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn test_extract_bearer_token_missing_bearer() {
|
|
let header = "Basic dXNlcjpwYXNz";
|
|
let result = JwtValidator::extract_bearer_token(header);
|
|
assert!(result.is_err());
|
|
}
|
|
|
|
#[test]
|
|
fn test_jwt_validator_creation() {
|
|
let validator = JwtValidator::new(
|
|
"https://authentik.example.com/application/o/memory/".to_string(),
|
|
"memory-service".to_string(),
|
|
3600,
|
|
);
|
|
// Just verify creation doesn't panic
|
|
assert_eq!(validator.issuer, "https://authentik.example.com/application/o/memory/");
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn test_jwt_claims_structure() {
|
|
// Test that JwtClaims can be created and serialized
|
|
let claims = JwtClaims {
|
|
sub: "user123".to_string(),
|
|
iss: "https://authentik.example.com/application/o/memory/".to_string(),
|
|
aud: "memory-service".to_string(),
|
|
exp: 9999999999,
|
|
iat: 1000000000,
|
|
nbf: Some(1000000000),
|
|
permissions: Some(vec!["memory:read".to_string(), "memory:write".to_string()]),
|
|
groups: Some(vec!["homelab-admins".to_string()]),
|
|
};
|
|
|
|
assert_eq!(claims.sub, "user123");
|
|
assert!(claims.permissions.is_some());
|
|
assert_eq!(
|
|
claims.permissions.as_ref().unwrap().len(),
|
|
2
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn test_jwt_permissions_claim() {
|
|
let claims = JwtClaims {
|
|
sub: "user123".to_string(),
|
|
iss: "https://authentik.example.com/application/o/memory/".to_string(),
|
|
aud: "memory-service".to_string(),
|
|
exp: 9999999999,
|
|
iat: 1000000000,
|
|
nbf: None,
|
|
permissions: Some(vec!["memory:read".to_string()]),
|
|
groups: None,
|
|
};
|
|
|
|
// Check if permissions exist
|
|
assert!(claims.permissions.is_some());
|
|
let perms = claims.permissions.unwrap();
|
|
assert!(perms.contains(&"memory:read".to_string()));
|
|
assert!(!perms.contains(&"memory:write".to_string()));
|
|
}
|
|
|
|
#[test]
|
|
fn test_jwt_wildcard_permission() {
|
|
let claims = JwtClaims {
|
|
sub: "admin".to_string(),
|
|
iss: "https://authentik.example.com/application/o/memory/".to_string(),
|
|
aud: "memory-service".to_string(),
|
|
exp: 9999999999,
|
|
iat: 1000000000,
|
|
nbf: None,
|
|
permissions: Some(vec!["*".to_string()]),
|
|
groups: None,
|
|
};
|
|
|
|
// Wildcard should grant all permissions
|
|
let perms = claims.permissions.unwrap();
|
|
assert!(perms.contains(&"*".to_string()));
|
|
}
|
|
|
|
#[test]
|
|
fn test_jwt_no_permissions() {
|
|
let claims = JwtClaims {
|
|
sub: "user123".to_string(),
|
|
iss: "https://authentik.example.com/application/o/memory/".to_string(),
|
|
aud: "memory-service".to_string(),
|
|
exp: 9999999999,
|
|
iat: 1000000000,
|
|
nbf: None,
|
|
permissions: None,
|
|
groups: Some(vec!["users".to_string()]),
|
|
};
|
|
|
|
// No permissions claim should mean no access
|
|
assert!(claims.permissions.is_none());
|
|
}
|