1 // Copyright 2021 Google LLC
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 // http://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14 //
15 ///////////////////////////////////////////////////////////////////////////////
16
17 #include "tink/jwt/internal/jwt_public_key_verify_wrapper.h"
18
19 #include <memory>
20 #include <string>
21 #include <utility>
22
23 #include "absl/status/status.h"
24 #include "tink/jwt/internal/jwt_format.h"
25 #include "tink/jwt/internal/jwt_public_key_verify_internal.h"
26 #include "tink/jwt/jwt_public_key_verify.h"
27 #include "tink/primitive_set.h"
28 #include "tink/util/status.h"
29 #include "tink/util/statusor.h"
30
31 namespace crypto {
32 namespace tink {
33 namespace jwt_internal {
34
35 using google::crypto::tink::OutputPrefixType;
36
37 namespace {
38
39 class JwtPublicKeyVerifySetWrapper : public JwtPublicKeyVerify {
40 public:
JwtPublicKeyVerifySetWrapper(std::unique_ptr<PrimitiveSet<JwtPublicKeyVerifyInternal>> jwt_verify_set)41 explicit JwtPublicKeyVerifySetWrapper(
42 std::unique_ptr<PrimitiveSet<JwtPublicKeyVerifyInternal>> jwt_verify_set)
43 : jwt_verify_set_(std::move(jwt_verify_set)) {}
44
45 crypto::tink::util::StatusOr<crypto::tink::VerifiedJwt> VerifyAndDecode(
46 absl::string_view compact,
47 const crypto::tink::JwtValidator& validator) const override;
48
49 ~JwtPublicKeyVerifySetWrapper() override = default;
50
51 private:
52 std::unique_ptr<PrimitiveSet<JwtPublicKeyVerifyInternal>> jwt_verify_set_;
53 };
54
Validate(PrimitiveSet<JwtPublicKeyVerifyInternal> * jwt_verify_set)55 util::Status Validate(
56 PrimitiveSet<JwtPublicKeyVerifyInternal>* jwt_verify_set) {
57 if (jwt_verify_set == nullptr) {
58 return util::Status(absl::StatusCode::kInternal,
59 "jwt_verify_set must be non-NULL");
60 }
61 for (const auto* entry : jwt_verify_set->get_all()) {
62 if ((entry->get_output_prefix_type() != OutputPrefixType::RAW) &&
63 (entry->get_output_prefix_type() != OutputPrefixType::TINK)) {
64 return util::Status(absl::StatusCode::kInvalidArgument,
65 "all JWT keys must be either RAW or TINK");
66 }
67 }
68 return util::OkStatus();
69 }
70
71 util::StatusOr<crypto::tink::VerifiedJwt>
VerifyAndDecode(absl::string_view compact,const crypto::tink::JwtValidator & validator) const72 JwtPublicKeyVerifySetWrapper::VerifyAndDecode(
73 absl::string_view compact,
74 const crypto::tink::JwtValidator& validator) const {
75 absl::optional<util::Status> interesting_status;
76 for (const auto* entry : jwt_verify_set_->get_all()) {
77 JwtPublicKeyVerifyInternal& jwt_verify = entry->get_primitive();
78 absl::optional<std::string> kid =
79 GetKid(entry->get_key_id(), entry->get_output_prefix_type());
80 util::StatusOr<VerifiedJwt> verified_jwt =
81 jwt_verify.VerifyAndDecodeWithKid(compact, validator, kid);
82 if (verified_jwt.ok()) {
83 return verified_jwt;
84 } else if (verified_jwt.status().code() !=
85 absl::StatusCode::kUnauthenticated) {
86 // errors that are not the result of a signature verification
87 interesting_status = verified_jwt.status();
88 }
89 }
90 if (interesting_status.has_value()) {
91 return *std::move(interesting_status);
92 }
93 return util::Status(absl::StatusCode::kInvalidArgument,
94 "verification failed");
95 }
96
97 } // namespace
98
99 util::StatusOr<std::unique_ptr<JwtPublicKeyVerify>>
Wrap(std::unique_ptr<PrimitiveSet<JwtPublicKeyVerifyInternal>> jwt_verify_set) const100 JwtPublicKeyVerifyWrapper::Wrap(
101 std::unique_ptr<PrimitiveSet<JwtPublicKeyVerifyInternal>> jwt_verify_set)
102 const {
103 util::Status status = Validate(jwt_verify_set.get());
104 if (!status.ok()) return status;
105 std::unique_ptr<JwtPublicKeyVerify> jwt_verify =
106 absl::make_unique<JwtPublicKeyVerifySetWrapper>(
107 std::move(jwt_verify_set));
108 return std::move(jwt_verify);
109 }
110
111 } // namespace jwt_internal
112 } // namespace tink
113 } // namespace crypto
114