MVP atproto inter-service auth token support

atproto/auth/jwt.go

···
+package auth
+
+import (
+	"context"
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"log/slog"
+	"math/rand"
+	"time"
+
+	"github.com/bluesky-social/indigo/atproto/crypto"
+	"github.com/bluesky-social/indigo/atproto/identity"
+	"github.com/bluesky-social/indigo/atproto/syntax"
+
+	"github.com/golang-jwt/jwt/v5"
+)
+
+// TODO: check for uniqueness of JTI (random nonce) to prevent token replay
+
+type ServiceAuthValidator struct {
+	// Service DID reference for this validator: a DID with optional #-separated fragment
+	Audience string
+	Dir      identity.Directory
+}
+
+type serviceAuthClaims struct {
+	jwt.RegisteredClaims
+
+	LexMethod string `json:"lxm,omitempty"`
+}
+
+func (s *ServiceAuthValidator) Validate(ctx context.Context, tokenString string, lexMethod *syntax.NSID) (syntax.DID, error) {
+
+	opts := []jwt.ParserOption{
+		jwt.WithValidMethods(supportedAlgs),
+		jwt.WithAudience(s.Audience),
+		jwt.WithExpirationRequired(),
+		jwt.WithIssuedAt(),
+		jwt.WithLeeway(5 * time.Second), // TODO: configurable? better default?
+	}
+
+	token, err := jwt.ParseWithClaims(tokenString, &serviceAuthClaims{}, s.fetchIssuerKeyFunc(ctx), opts...)
+	if err != nil && errors.Is(err, jwt.ErrTokenSignatureInvalid) {
+		// if signature validation fails, purge the directory and try again
+		// TODO: probably need to cache or rate-limit this?
+
+		// do an unvalidated extraction of 'iss' from JWT
+		insecure := jwt.NewParser(jwt.WithoutClaimsValidation())
+		t, _, err := insecure.ParseUnverified(tokenString, &jwt.MapClaims{})
+		claims, ok := t.Claims.(*jwt.MapClaims)
+		if !ok {
+			return "", jwt.ErrTokenInvalidClaims
+		}
+		iss, err := claims.GetIssuer()
+		if err != nil {
+			return "", err
+		}
+		did, err := syntax.ParseDID(iss)
+		if err != nil {
+			return "", fmt.Errorf("%w: invalid DID: %w", jwt.ErrTokenInvalidIssuer, err)
+		}
+
+		slog.Info("purging directory and retrying service auth signature validation", "did", did)
+		err = s.Dir.Purge(ctx, did.AtIdentifier())
+		if err != nil {
+			slog.Error("purging identity directory", "did", did, "err", err)
+		}
+		token, err = jwt.ParseWithClaims(tokenString, &serviceAuthClaims{}, s.fetchIssuerKeyFunc(ctx), opts...)
+	}
+	if err != nil {
+		return "", err
+	}
+	claims, ok := token.Claims.(*serviceAuthClaims)
+	if !ok {
+		// TODO: is this the best error here?
+		return "", jwt.ErrTokenInvalidClaims
+	}
+
+	if lexMethod != nil && claims.LexMethod != lexMethod.String() {
+		return "", fmt.Errorf("%w: Lexicon endpoint (LXM)", jwt.ErrTokenInvalidClaims)
+	}
+
+	// NOTE: KeyFunc has already parsed issuer, so we know it is a valid DID
+	did := syntax.DID(claims.Issuer)
+	return did, nil
+}
+
+// resolves public key from identity directory
+func (s *ServiceAuthValidator) fetchIssuerKeyFunc(ctx context.Context) func(token *jwt.Token) (any, error) {
+	return func(token *jwt.Token) (any, error) {
+		claims, ok := token.Claims.(*serviceAuthClaims)
+		if !ok {
+			return nil, fmt.Errorf("%w: missing 'iss'", jwt.ErrTokenInvalidClaims)
+		}
+		iss, err := claims.GetIssuer()
+		if err != nil {
+			return nil, fmt.Errorf("%w: missing 'iss'", jwt.ErrTokenInvalidClaims)
+		}
+		did, err := syntax.ParseDID(iss)
+		if err != nil {
+			return nil, fmt.Errorf("%w: invalid DID: %w", jwt.ErrTokenInvalidIssuer, err)
+		}
+		// NOTE: this will do handle resolution by default
+		ident, err := s.Dir.LookupDID(ctx, did)
+		if err != nil {
+			return nil, fmt.Errorf("%w: resolving DID (%s): %w", jwt.ErrTokenInvalidIssuer, did, err)
+		}
+		return ident.PublicKey()
+	}
+}
+
+func randomNonce() string {
+	buf := make([]byte, 16)
+	rand.Read(buf)
+	return base64.RawURLEncoding.EncodeToString(buf)
+}
+
+func SignServiceAuth(iss syntax.DID, aud string, ttl time.Duration, lexMethod *syntax.NSID, priv crypto.PrivateKey) (string, error) {
+	claims := serviceAuthClaims{
+		RegisteredClaims: jwt.RegisteredClaims{
+			ExpiresAt: jwt.NewNumericDate(time.Now().Add(ttl)),
+			IssuedAt:  jwt.NewNumericDate(time.Now()),
+			Issuer:    iss.String(),
+			Audience:  []string{aud},
+			ID:        randomNonce(),
+		},
+	}
+	if lexMethod != nil {
+		claims.LexMethod = lexMethod.String()
+	}
+
+	var sm *signingMethodAtproto
+
+	// NOTE: could also have a crypto.PrivateKey.Alg() method which returns a string
+	switch priv.(type) {
+	case *crypto.PrivateKeyP256:
+		sm = signingMethodES256
+	case *crypto.PrivateKeyK256:
+		sm = signingMethodES256K
+	default:
+		return "", fmt.Errorf("unknown signing key type")
+	}
+
+	token := jwt.NewWithClaims(sm, claims)
+	return token.SignedString(priv)
+}

atproto/auth/jwt_signing.go

···
+package auth
+
+import (
+	"crypto"
+
+	atcrypto "github.com/bluesky-social/indigo/atproto/crypto"
+	"github.com/golang-jwt/jwt/v5"
+)
+
+var (
+	signingMethodES256K *signingMethodAtproto
+	signingMethodES256  *signingMethodAtproto
+	supportedAlgs       []string
+)
+
+// Implementation of jwt.SigningMethod for the `atproto/crypto` types.
+type signingMethodAtproto struct {
+	alg      string
+	hash     crypto.Hash
+	toOutSig toOutSig
+	sigLen   int
+}
+
+type toOutSig func(sig []byte) []byte
+
+func init() {
+	// tells JWT library to serialize 'aud' as regular string, not array of strings (when signing)
+	jwt.MarshalSingleStringAsArray = false
+
+	signingMethodES256K = &signingMethodAtproto{
+		alg:      "ES256K",
+		hash:     crypto.SHA256,
+		toOutSig: toES256K,
+		sigLen:   64,
+	}
+	jwt.RegisterSigningMethod(signingMethodES256K.Alg(), func() jwt.SigningMethod {
+		return signingMethodES256K
+	})
+	signingMethodES256 = &signingMethodAtproto{
+		alg:      "ES256",
+		hash:     crypto.SHA256,
+		toOutSig: toES256,
+		sigLen:   64,
+	}
+	jwt.RegisterSigningMethod(signingMethodES256.Alg(), func() jwt.SigningMethod {
+		return signingMethodES256
+	})
+	supportedAlgs = []string{signingMethodES256K.Alg(), signingMethodES256.Alg()}
+}
+
+func (sm *signingMethodAtproto) Verify(signingString string, sig []byte, key interface{}) error {
+	pub, ok := key.(atcrypto.PublicKey)
+	if !ok {
+		return jwt.ErrInvalidKeyType
+	}
+
+	if !sm.hash.Available() {
+		return jwt.ErrHashUnavailable
+	}
+
+	if len(sig) != sm.sigLen {
+		return jwt.ErrTokenSignatureInvalid
+	}
+
+	// NOTE: important to use using "lenient" variant here
+	return pub.HashAndVerifyLenient([]byte(signingString), sig)
+}
+
+func (sm *signingMethodAtproto) Sign(signingString string, key interface{}) ([]byte, error) {
+	priv, ok := key.(atcrypto.PrivateKey)
+	if !ok {
+		return nil, jwt.ErrInvalidKeyType
+	}
+
+	return priv.HashAndSign([]byte(signingString))
+}
+
+func (sm *signingMethodAtproto) Alg() string {
+	return sm.alg
+}
+
+func toES256K(sig []byte) []byte {
+	return sig[:64]
+}
+
+func toES256(sig []byte) []byte {
+	return sig[:64]
+}

atproto/auth/jwt_test.go

···
+package auth
+
+import (
+	"context"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/bluesky-social/indigo/atproto/crypto"
+	"github.com/bluesky-social/indigo/atproto/identity"
+	"github.com/bluesky-social/indigo/atproto/syntax"
+
+	"github.com/golang-jwt/jwt/v5"
+	"github.com/stretchr/testify/assert"
+)
+
+// Returns an early-2024 timestamp as a point in time for validating known JWTs (which contain expires-at)
+func testTime() time.Time {
+	return time.Date(2024, 1, 1, 0, 0, 0, 0, time.UTC)
+}
+
+func validateMinimal(token string, iss, aud string, pub crypto.PublicKey) error {
+
+	p := jwt.NewParser(
+		jwt.WithValidMethods(supportedAlgs),
+		jwt.WithTimeFunc(testTime),
+		jwt.WithIssuer(iss),
+		jwt.WithAudience(aud),
+	)
+	_, err := p.Parse(token, func(tok *jwt.Token) (any, error) {
+		return pub, nil
+	})
+	if err != nil {
+		return fmt.Errorf("failed to parse auth header JWT: %w", err)
+	}
+	return nil
+}
+
+func TestSignatureMethods(t *testing.T) {
+	assert := assert.New(t)
+
+	jwtTestFixtures := []struct {
+		name   string
+		pubkey string
+		iss    string
+		aud    string
+		jwt    string
+	}{
+		{
+			name:   "secp256k1 (K-256)",
+			pubkey: "did:key:zQ3shscXNYZQZSPwegiv7uQZZV5kzATLBRtgJhs7uRY7pfSk4",
+			iss:    "did:example:iss",
+			aud:    "did:example:aud",
+			jwt:    "eyJ0eXAiOiJKV1QiLCJhbGciOiJFUzI1NksifQ.eyJpc3MiOiJkaWQ6ZXhhbXBsZTppc3MiLCJhdWQiOiJkaWQ6ZXhhbXBsZTphdWQiLCJleHAiOjE3MTM1NzEwMTJ9.J_In_PQCMjygeeoIKyjybORD89ZnEy1bZTd--sdq_78qv3KCO9181ZAh-2Pl0qlXZjfUlxgIa6wiak2NtsT98g",
+		},
+		{
+			name:   "secp256k1 (K-256)",
+			pubkey: "did:key:zQ3shqKrpHzQ5HDfhgcYMWaFcpBK3SS39wZLdTjA5GeakX8G5",
+			iss:    "did:example:iss",
+			aud:    "did:example:aud",
+			jwt:    "eyJ0eXAiOiJKV1QiLCJhbGciOiJFUzI1NksifQ.eyJhdWQiOiJkaWQ6ZXhhbXBsZTphdWQiLCJpc3MiOiJkaWQ6ZXhhbXBsZTppc3MiLCJleHAiOjE3MTM1NzExMzJ9.itNeYcF5oFMZIGxtnbJhE4McSniv_aR-Yk1Wj8uWk1K8YjlS2fzuJMo0-fILV3payETxn6r45f0FfpTaqY0EZQ",
+		},
+		{
+			name:   "P-256",
+			pubkey: "did:key:zDnaeXRDKRCEUoYxi8ZJS2pDsgfxUh3pZiu3SES9nbY4DoART",
+			iss:    "did:example:iss",
+			aud:    "did:example:aud",
+			jwt:    "eyJ0eXAiOiJKV1QiLCJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJkaWQ6ZXhhbXBsZTppc3MiLCJhdWQiOiJkaWQ6ZXhhbXBsZTphdWQiLCJleHAiOjE3MTM1NzE1NTR9.FFRLm7SGbDUp6cL0WoCs0L5oqNkjCXB963TqbgI-KxIjbiqMQATVCalcMJx17JGTjMmfVHJP6Op_V4Z0TTjqog",
+		},
+	}
+
+	for _, fix := range jwtTestFixtures {
+
+		pubk, err := crypto.ParsePublicDIDKey(fix.pubkey)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		assert.NoError(validateMinimal(fix.jwt, fix.iss, fix.aud, pubk))
+	}
+}
+
+func testSigningValidation(t *testing.T, priv crypto.PrivateKey) {
+	assert := assert.New(t)
+	ctx := context.Background()
+
+	iss := syntax.DID("did:example:iss")
+	aud := "did:example:aud#svc"
+	lxm := syntax.NSID("com.example.api")
+
+	priv, err := crypto.GeneratePrivateKeyP256()
+	if err != nil {
+		t.Fatal(err)
+	}
+	pub, err := priv.PublicKey()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	dir := identity.NewMockDirectory()
+	dir.Insert(identity.Identity{
+		DID: iss,
+		Keys: map[string]identity.Key{
+			"atproto": identity.Key{
+				Type:               "Multikey",
+				PublicKeyMultibase: pub.Multibase(),
+			},
+		},
+	})
+
+	v := ServiceAuthValidator{
+		Audience: aud,
+		Dir:      &dir,
+	}
+
+	t1, err := SignServiceAuth(iss, aud, time.Minute, nil, priv)
+	if err != nil {
+		t.Fatal(err)
+	}
+	d1, err := v.Validate(ctx, t1, nil)
+	assert.NoError(err)
+	assert.Equal(d1, iss)
+	_, err = v.Validate(ctx, t1, &lxm)
+	assert.Error(err)
+
+	t2, err := SignServiceAuth(iss, aud, time.Minute, &lxm, priv)
+	if err != nil {
+		t.Fatal(err)
+	}
+	d2, err := v.Validate(ctx, t2, nil)
+	assert.NoError(err)
+	assert.Equal(d2, iss)
+	_, err = v.Validate(ctx, t2, &lxm)
+	assert.NoError(err)
+
+	_, err = v.Validate(ctx, t2, nil)
+	assert.NoError(err)
+	_, err = v.Validate(ctx, t2, &lxm)
+	assert.NoError(err)
+}
+
+func TestP256SigningValidation(t *testing.T) {
+	priv, err := crypto.GeneratePrivateKeyP256()
+	if err != nil {
+		t.Fatal(err)
+	}
+	testSigningValidation(t, priv)
+}
+
+func TestK256SigningValidation(t *testing.T) {
+	priv, err := crypto.GeneratePrivateKeyK256()
+	if err != nil {
+		t.Fatal(err)
+	}
+	testSigningValidation(t, priv)
+}