Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: tolerate initial JWK error #1475

Merged
merged 7 commits into from
Dec 23, 2024
Merged

feat: tolerate initial JWK error #1475

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
fd698a1
feat: tolerate initial JWK error
StarpTech Dec 23, 2024
8c64b62
chore: avoid panic
StarpTech Dec 23, 2024
793c328
chore: return early in error case
StarpTech Dec 23, 2024
e9eac58
chore: fix tests
StarpTech Dec 23, 2024
7f7849b
chore: improve
StarpTech Dec 23, 2024
ccdc344
chore: improve err msg
StarpTech Dec 23, 2024
cf0235c
chore: generate build summary
StarpTech Dec 23, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 0 additions & 3 deletions .github/actions/build-push-image/action.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,9 +79,6 @@ runs:

- name: Build & Push Docker Image
uses: docker/build-push-action@v6
env:
DOCKER_BUILD_SUMMARY: false
DOCKER_BUILD_RECORD_UPLOAD: false
with:
# This is a limitation of GitHub. Only organization members can push to GitHub Container Registry
# For now, we will disable the push to the GitHub Container Registry for external contributors
Expand Down
11 changes: 6 additions & 5 deletions router-tests/authentication_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@ package integration_test

import (
"bytes"
"go.uber.org/zap"
"io"
"net/http"
"strings"
Expand Down Expand Up @@ -29,7 +30,7 @@ func configureAuth(t *testing.T) ([]authentication.Authenticator, *jwks.Server)
authServer, err := jwks.NewServer(t)
require.NoError(t, err)
t.Cleanup(authServer.Close)
tokenDecoder, _ := authentication.NewJwksTokenDecoder(authServer.JWKSURL(), time.Second*5)
tokenDecoder, _ := authentication.NewJwksTokenDecoder(zap.NewNop(), authServer.JWKSURL(), time.Second*5)
authOptions := authentication.HttpHeaderAuthenticatorOptions{
Name: jwksName,
URL: authServer.JWKSURL(),
Expand Down Expand Up @@ -613,7 +614,7 @@ func TestAuthenticationWithCustomHeaders(t *testing.T) {
authServer, err := jwks.NewServer(t)
require.NoError(t, err)
t.Cleanup(authServer.Close)
tokenDecoder, _ := authentication.NewJwksTokenDecoder(authServer.JWKSURL(), time.Second*5)
tokenDecoder, _ := authentication.NewJwksTokenDecoder(zap.NewNop(), authServer.JWKSURL(), time.Second*5)
authOptions := authentication.HttpHeaderAuthenticatorOptions{
Name: jwksName,
URL: authServer.JWKSURL(),
Expand Down Expand Up @@ -748,7 +749,7 @@ func TestAuthenticationMultipleProviders(t *testing.T) {
require.NoError(t, err)
t.Cleanup(authServer2.Close)

tokenDecoder1, _ := authentication.NewJwksTokenDecoder(authServer1.JWKSURL(), time.Second*5)
tokenDecoder1, _ := authentication.NewJwksTokenDecoder(zap.NewNop(), authServer1.JWKSURL(), time.Second*5)
authenticator1HeaderValuePrefixes := []string{"Bearer"}
authenticator1, err := authentication.NewHttpHeaderAuthenticator(authentication.HttpHeaderAuthenticatorOptions{
Name: "1",
Expand All @@ -758,7 +759,7 @@ func TestAuthenticationMultipleProviders(t *testing.T) {
})
require.NoError(t, err)

tokenDecoder2, _ := authentication.NewJwksTokenDecoder(authServer2.JWKSURL(), time.Second*5)
tokenDecoder2, _ := authentication.NewJwksTokenDecoder(zap.NewNop(), authServer2.JWKSURL(), time.Second*5)
authenticator2HeaderValuePrefixes := []string{"", "Bearer", "Token"}
authenticator2, err := authentication.NewHttpHeaderAuthenticator(authentication.HttpHeaderAuthenticatorOptions{
Name: "2",
Expand Down Expand Up @@ -858,7 +859,7 @@ func TestAuthenticationOverWebsocket(t *testing.T) {
require.NoError(t, err)
defer authServer.Close()

tokenDecoder, _ := authentication.NewJwksTokenDecoder(authServer.JWKSURL(), time.Second*5)
tokenDecoder, _ := authentication.NewJwksTokenDecoder(zap.NewNop(), authServer.JWKSURL(), time.Second*5)
jwksOpts := authentication.HttpHeaderAuthenticatorOptions{
Name: jwksName,
URL: authServer.JWKSURL(),
Expand Down
3 changes: 2 additions & 1 deletion router-tests/modules/set_scopes_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@ import (
"github.com/wundergraph/cosmo/router/core"
"github.com/wundergraph/cosmo/router/pkg/authentication"
"github.com/wundergraph/cosmo/router/pkg/config"
"go.uber.org/zap"
"io"
"net/http"
"strings"
Expand All @@ -26,7 +27,7 @@ func configureAuth(t *testing.T) ([]authentication.Authenticator, *jwks.Server)
authServer, err := jwks.NewServer(t)
require.NoError(t, err)
t.Cleanup(authServer.Close)
tokenDecoder, _ := authentication.NewJwksTokenDecoder(authServer.JWKSURL(), time.Second*5)
tokenDecoder, _ := authentication.NewJwksTokenDecoder(zap.NewNop(), authServer.JWKSURL(), time.Second*5)
authOptions := authentication.HttpHeaderAuthenticatorOptions{
Name: jwksName,
URL: authServer.JWKSURL(),
Expand Down
15 changes: 8 additions & 7 deletions router-tests/websocket_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@ import (
"encoding/json"
"errors"
"fmt"
"go.uber.org/zap"
"io"
"math/big"
"net"
Expand Down Expand Up @@ -73,7 +74,7 @@ func TestWebSockets(t *testing.T) {
authServer, err := jwks.NewServer(t)
require.NoError(t, err)
t.Cleanup(authServer.Close)
tokenDecoder, _ := authentication.NewJwksTokenDecoder(authServer.JWKSURL(), time.Second*5)
tokenDecoder, _ := authentication.NewJwksTokenDecoder(zap.NewNop(), authServer.JWKSURL(), time.Second*5)
authOptions := authentication.HttpHeaderAuthenticatorOptions{
Name: jwksName,
URL: authServer.JWKSURL(),
Expand Down Expand Up @@ -123,7 +124,7 @@ func TestWebSockets(t *testing.T) {
authServer, err := jwks.NewServer(t)
require.NoError(t, err)
t.Cleanup(authServer.Close)
tokenDecoder, _ := authentication.NewJwksTokenDecoder(authServer.JWKSURL(), time.Second*5)
tokenDecoder, _ := authentication.NewJwksTokenDecoder(zap.NewNop(), authServer.JWKSURL(), time.Second*5)
authOptions := authentication.HttpHeaderAuthenticatorOptions{
Name: jwksName,
URL: authServer.JWKSURL(),
Expand Down Expand Up @@ -173,7 +174,7 @@ func TestWebSockets(t *testing.T) {
authServer, err := jwks.NewServer(t)
require.NoError(t, err)
t.Cleanup(authServer.Close)
tokenDecoder, _ := authentication.NewJwksTokenDecoder(authServer.JWKSURL(), time.Second*5)
tokenDecoder, _ := authentication.NewJwksTokenDecoder(zap.NewNop(), authServer.JWKSURL(), time.Second*5)
authOptions := authentication.HttpHeaderAuthenticatorOptions{
Name: jwksName,
URL: authServer.JWKSURL(),
Expand Down Expand Up @@ -232,7 +233,7 @@ func TestWebSockets(t *testing.T) {
authServer, err := jwks.NewServer(t)
require.NoError(t, err)
t.Cleanup(authServer.Close)
tokenDecoder, _ := authentication.NewJwksTokenDecoder(authServer.JWKSURL(), time.Second*5)
tokenDecoder, _ := authentication.NewJwksTokenDecoder(zap.NewNop(), authServer.JWKSURL(), time.Second*5)
authOptions := authentication.HttpHeaderAuthenticatorOptions{
Name: jwksName,
URL: authServer.JWKSURL(),
Expand Down Expand Up @@ -290,7 +291,7 @@ func TestWebSockets(t *testing.T) {
authServer, err := jwks.NewServer(t)
require.NoError(t, err)
t.Cleanup(authServer.Close)
tokenDecoder, _ := authentication.NewJwksTokenDecoder(authServer.JWKSURL(), time.Second*5)
tokenDecoder, _ := authentication.NewJwksTokenDecoder(zap.NewNop(), authServer.JWKSURL(), time.Second*5)
authOptions := authentication.WebsocketInitialPayloadAuthenticatorOptions{
TokenDecoder: tokenDecoder,
Key: "Authorization",
Expand Down Expand Up @@ -351,7 +352,7 @@ func TestWebSockets(t *testing.T) {
authServer, err := jwks.NewServer(t)
require.NoError(t, err)
t.Cleanup(authServer.Close)
tokenDecoder, _ := authentication.NewJwksTokenDecoder(authServer.JWKSURL(), time.Second*5)
tokenDecoder, _ := authentication.NewJwksTokenDecoder(zap.NewNop(), authServer.JWKSURL(), time.Second*5)
authOptions := authentication.WebsocketInitialPayloadAuthenticatorOptions{
TokenDecoder: tokenDecoder,
Key: "Authorization",
Expand Down Expand Up @@ -400,7 +401,7 @@ func TestWebSockets(t *testing.T) {
authServer, err := jwks.NewServer(t)
require.NoError(t, err)
t.Cleanup(authServer.Close)
tokenDecoder, _ := authentication.NewJwksTokenDecoder(authServer.JWKSURL(), time.Second*5)
tokenDecoder, _ := authentication.NewJwksTokenDecoder(zap.NewNop(), authServer.JWKSURL(), time.Second*5)
authOptions := authentication.WebsocketInitialPayloadAuthenticatorOptions{
TokenDecoder: tokenDecoder,
Key: "Authorization",
Expand Down
13 changes: 10 additions & 3 deletions router/cmd/instance.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,7 +61,12 @@ func NewRouter(params Params, additionalOptions ...core.Option) (*core.Router, e
if name == "" {
name = fmt.Sprintf("jwks-#%d", i)
}
tokenDecoder, _ := authentication.NewJwksTokenDecoder(auth.JWKS.URL, auth.JWKS.RefreshInterval)
providerLogger := logger.With(zap.String("provider_name", name))
tokenDecoder, err := authentication.NewJwksTokenDecoder(providerLogger, auth.JWKS.URL, auth.JWKS.RefreshInterval)
if err != nil {
providerLogger.Error("Could not create JWKS token decoder", zap.Error(err))
return nil, err
}
opts := authentication.HttpHeaderAuthenticatorOptions{
Name: name,
URL: auth.JWKS.URL,
Expand All @@ -71,7 +76,8 @@ func NewRouter(params Params, additionalOptions ...core.Option) (*core.Router, e
}
authenticator, err := authentication.NewHttpHeaderAuthenticator(opts)
if err != nil {
logger.Fatal("Could not create HttpHeader authenticator", zap.Error(err), zap.String("name", name))
providerLogger.Error("Could not create HttpHeader authenticator", zap.Error(err))
return nil, err
}
authenticators = append(authenticators, authenticator)

Expand All @@ -83,7 +89,8 @@ func NewRouter(params Params, additionalOptions ...core.Option) (*core.Router, e
}
authenticator, err = authentication.NewWebsocketInitialPayloadAuthenticator(opts)
if err != nil {
logger.Fatal("Could not create WebsocketInitialPayload authenticator", zap.Error(err))
providerLogger.Error("Could not create WebsocketInitialPayload authenticator", zap.Error(err))
return nil, err
}
authenticators = append(authenticators, authenticator)
}
Expand Down
12 changes: 11 additions & 1 deletion router/pkg/authentication/jwks_token_decoder.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@ package authentication

import (
"fmt"
"go.uber.org/zap"
"time"

"github.com/MicahParks/keyfunc/v2"
Expand Down Expand Up @@ -29,10 +30,19 @@ func (j *jwksTokenDecoder) Decode(tokenString string) (Claims, error) {
return Claims(claims), nil
}

func NewJwksTokenDecoder(url string, refreshInterval time.Duration) (TokenDecoder, error) {
func NewJwksTokenDecoder(logger *zap.Logger, url string, refreshInterval time.Duration) (TokenDecoder, error) {

jwks, err := keyfunc.Get(url, keyfunc.Options{
RefreshInterval: refreshInterval,
// Allow the JWKS to be empty initially, but it can recover on refresh.
TolerateInitialJWKHTTPError: true,
RefreshErrorHandler: func(err error) {
logger.Error("Could not refresh JWKS. Trying again in the next interval.",
zap.Error(err),
zap.String("url", url),
zap.String("interval", refreshInterval.String()),
)
},
})
if err != nil {
return nil, fmt.Errorf("error initializing JWKS from %q: %w", url, err)
Expand Down
Loading