Skip to content

Commit 4576568

Browse files
battermannsupersven
battermann
authored and
supersven
committed
Battermann/update rusty jwt tools to deploy 044 (#3348)
1 parent e37aebb commit 4576568

File tree

5 files changed

+75
-10
lines changed

5 files changed

+75
-10
lines changed

‎changelog.d/5-internal/pr-3348

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Updated rusty-jwt-tools and error mapping

‎libs/jwt-tools/src/Data/Jwt/Tools.hs

Lines changed: 46 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -277,6 +277,50 @@ data DPoPTokenGenerationError
277277
MissingExpError
278278
| -- | (exp) claim in DPoP token is larger than supplied [max_expiration]
279279
ExpMismatchError
280-
| -- | (exp) claim in DPoP token is sooner than now (with [max_skew_secs] leeway)
281-
ExpError
280+
| -- (exp) claim in DPoP token is sooner than now (with [max_skew_secs] leeway)
281+
Expired
282+
| -- userId supplied across the FFI is invalid
283+
InvalidUserId
284+
| -- Client DPoP token "nbf" claim is in the future
285+
NotYetValid
286+
| -- Bubbling up errors
287+
JwtSimpleError
288+
| -- Bubbling up errors
289+
RandError
290+
| -- Bubbling up errors
291+
Sec1Error
292+
| -- Bubbling up errors
293+
UrlParseError
294+
| -- Bubbling up errors
295+
UuidError
296+
| -- Bubbling up errors
297+
Utf8Error
298+
| -- Bubbling up errors
299+
Base64DecodeError
300+
| -- Bubbling up errors
301+
JsonError
302+
| -- Bubbling up errors
303+
InvalidJsonPath
304+
| -- Bubbling up errors
305+
JsonPathError
306+
| -- Bubbling up errors
307+
InvalidJwkThumbprint
308+
| -- Bubbling up errors
309+
MissingDpopHeader
310+
| -- Bubbling up errors
311+
MissingIssuer
312+
| -- Bubbling up errors
313+
DpopChallengeMismatch
314+
| -- Bubbling up errors
315+
DpopHtuMismatch
316+
| -- Bubbling up errors
317+
DpopHtmMismatch
318+
| -- Bubbling up errors
319+
InvalidBackendKeys
320+
| -- Bubbling up errors
321+
InvalidClientId
322+
| -- Bubbling up errors
323+
UnsupportedApiVersion
324+
| -- Bubbling up errors
325+
UnsupportedScope
282326
deriving (Eq, Show, Generic, Bounded, Enum)

‎libs/jwt-tools/test/Spec.hs

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -68,8 +68,8 @@ main = hspec $ do
6868
toResult (Just 16) (Just token) `shouldBe` Left MissingExpError
6969
toResult (Just 17) Nothing `shouldBe` Left ExpMismatchError
7070
toResult (Just 17) (Just token) `shouldBe` Left ExpMismatchError
71-
toResult (Just 18) Nothing `shouldBe` Left ExpError
72-
toResult (Just 18) (Just token) `shouldBe` Left ExpError
71+
toResult (Just 18) Nothing `shouldBe` Left Expired
72+
toResult (Just 18) (Just token) `shouldBe` Left Expired
7373
toResult Nothing Nothing `shouldBe` Left UnknownError
7474
where
7575
token = ""

‎nix/pkgs/rusty_jwt_tools_ffi/default.nix

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,8 @@ let
1111
src = fetchFromGitHub {
1212
owner = "wireapp";
1313
repo = "rusty-jwt-tools";
14-
rev = "v${version}";
15-
sha256 = "sha256-awfpyMmDGWLViKI8Pr/BjbfnmFKo4JAcUB0+o6/prOA=";
14+
rev = "fc4569c5b84d00a5cc8fc77b450714a5261cd3d9";
15+
sha256 = "sha256-cZffVKfH0FzA4Eo7YVxivT3JWTwz9uu1HWhPVlvbYqM=";
1616
};
1717
cargoLockFile = builtins.toFile "cargo.lock" (builtins.readFile "${src}/ffi/Cargo.lock");
1818

@@ -26,9 +26,7 @@ rustPlatform.buildRustPackage {
2626
outputHashes = {
2727
# if any of these need updating, replace / create new key with
2828
# lib.fakeSha256, rebuild, and replace with actual hash.
29-
"biscuit-0.6.0-beta1" = "sha256-j8Pxi2nHgsKz6umroYjwR8sr1xLQAaWdnej5U9+L5ko=";
30-
"jwt-simple-0.11.3" = "sha256-kVBTXYtBW9SE6F6nmH71iVc0KKxvpX/axCvMAP1cZvY=";
31-
"ring-0.17.0-not-released-yet" = "sha256-9M4lR68r8phscSFw9Xh+CVHnOkilDI0brAdU0tW3xaA=";
29+
"jwt-simple-0.11.4" = "sha256-zLKEvL6M7WD7F7HIABqq4b2rmlCS88QXDsj4JhAPe7o=";
3230
};
3331
};
3432

‎services/brig/src/Brig/API/Error.hs

Lines changed: 23 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -192,7 +192,29 @@ certEnrollmentError (RustError MissingIatError) = StdError $ Wai.mkError status4
192192
certEnrollmentError (RustError IatError) = StdError $ Wai.mkError status400 "client-token-bad-iat" "(iat) claim in DPoP token is not earlier of now (with max_skew_secs leeway)"
193193
certEnrollmentError (RustError MissingExpError) = StdError $ Wai.mkError status400 "client-token-exp-missing" "(exp) claim is absent in DPoP token"
194194
certEnrollmentError (RustError ExpMismatchError) = StdError $ Wai.mkError status400 "client-token-exp-too-large" "(exp) claim in DPoP token is larger than supplied [max_expiration]"
195-
certEnrollmentError (RustError ExpError) = StdError $ Wai.mkError status400 "client-token-exp-too-small" "(exp) claim in DPoP token is sooner than now (with [max_skew_secs] leeway)"
195+
certEnrollmentError (RustError Expired) = StdError $ Wai.mkError status400 "client-token-exp-too-small" "(exp) claim in DPoP token is sooner than now (with [max_skew_secs] leeway)"
196+
certEnrollmentError (RustError InvalidUserId) = StdError $ Wai.mkError status400 "invalid-user-id" "userId supplied across the FFI is invalid"
197+
certEnrollmentError (RustError NotYetValid) = StdError $ Wai.mkError status400 "not-yet-valid" "Client DPoP token 'nbf' claim is in the future"
198+
certEnrollmentError (RustError JwtSimpleError) = StdError $ Wai.mkError status400 "jwt-simple-error" "Bubbling up errors"
199+
certEnrollmentError (RustError RandError) = StdError $ Wai.mkError status400 "rand-error" "Bubbling up errors"
200+
certEnrollmentError (RustError Sec1Error) = StdError $ Wai.mkError status400 "sec1-error" "Bubbling up errors"
201+
certEnrollmentError (RustError UrlParseError) = StdError $ Wai.mkError status400 "url-parse-error" "Bubbling up errors"
202+
certEnrollmentError (RustError UuidError) = StdError $ Wai.mkError status400 "uuid-error" "Bubbling up errors"
203+
certEnrollmentError (RustError Utf8Error) = StdError $ Wai.mkError status400 "utf8-error" "Bubbling up errors"
204+
certEnrollmentError (RustError Base64DecodeError) = StdError $ Wai.mkError status400 "base64-decode-error" "Bubbling up errors"
205+
certEnrollmentError (RustError JsonError) = StdError $ Wai.mkError status400 "json-error" "Bubbling up errors"
206+
certEnrollmentError (RustError InvalidJsonPath) = StdError $ Wai.mkError status400 "invalid-json-path" "Bubbling up errors"
207+
certEnrollmentError (RustError JsonPathError) = StdError $ Wai.mkError status400 "json-path-error" "Bubbling up errors"
208+
certEnrollmentError (RustError InvalidJwkThumbprint) = StdError $ Wai.mkError status400 "invalid-jwk-thumbprint" "Bubbling up errors"
209+
certEnrollmentError (RustError MissingDpopHeader) = StdError $ Wai.mkError status400 "missing-dpop-header" "Bubbling up errors"
210+
certEnrollmentError (RustError MissingIssuer) = StdError $ Wai.mkError status400 "missing-issuer" "Bubbling up errors"
211+
certEnrollmentError (RustError DpopChallengeMismatch) = StdError $ Wai.mkError status400 "dpop-challenge-mismatch" "Bubbling up errors"
212+
certEnrollmentError (RustError DpopHtuMismatch) = StdError $ Wai.mkError status400 "dpop-htu-mismatch" "Bubbling up errors"
213+
certEnrollmentError (RustError DpopHtmMismatch) = StdError $ Wai.mkError status400 "dpop-htm-mismatch" "Bubbling up errors"
214+
certEnrollmentError (RustError InvalidBackendKeys) = StdError $ Wai.mkError status400 "invalid-backend-keys" "Bubbling up errors"
215+
certEnrollmentError (RustError InvalidClientId) = StdError $ Wai.mkError status400 "invalid-client-id" "Bubbling up errors"
216+
certEnrollmentError (RustError UnsupportedApiVersion) = StdError $ Wai.mkError status400 "unsupported-api-version" "Bubbling up errors"
217+
certEnrollmentError (RustError UnsupportedScope) = StdError $ Wai.mkError status400 "unsupported-scope" "Bubbling up errors"
196218
certEnrollmentError NonceNotFound = StdError $ Wai.mkError status400 "client-token-bad-nonce" "The client sent an unacceptable anti-replay nonce"
197219
certEnrollmentError MisconfiguredRequestUrl = StdError $ Wai.mkError status500 "misconfigured-request-url" "The request url cannot be derived from optSettings.setFederationDomain in brig.yaml"
198220
certEnrollmentError KeyBundleError = StdError $ Wai.mkError status404 "no-server-key-bundle" "The key bundle required for the certificate enrollment process could not be found"

0 commit comments

Comments
 (0)