use formal JWT validation (#35)

route/v1.go

@@ -1,11 +1,13 @@
 package route
 
 import (
+	"crypto/ecdsa"
 	"os"
 
 	"github.com/IceWhaleTech/CasaOS-Common/middleware"
 	"github.com/IceWhaleTech/CasaOS-Common/utils/jwt"
 	v1 "github.com/IceWhaleTech/CasaOS-UserService/route/v1"
+	"github.com/IceWhaleTech/CasaOS-UserService/service"
 	"github.com/gin-contrib/gzip"
 	"github.com/gin-gonic/gin"
 )
@@ -13,7 +15,7 @@ import (
 func InitRouter() *gin.Engine {
 	r := gin.Default()
 	r.Use(middleware.Cors())
-	//r.Use(middleware.WriteLog())
+	// r.Use(middleware.WriteLog())
 	r.Use(gzip.Gzip(gzip.DefaultCompression))
 
 	// check if environment variable is set
@@ -34,7 +36,12 @@ func InitRouter() *gin.Engine {
 
 	v1Group := r.Group("/v1")
 
-	v1Group.Use(jwt.JWT())
+	v1Group.Use(jwt.JWT(
+		func() (*ecdsa.PublicKey, error) {
+			_, publicKey := service.MyService.User().GetKeyPair()
+			return publicKey, nil
+		},
+	))
 	{
 		v1UsersGroup := v1Group.Group("/users")
 		v1UsersGroup.Use()

route/v1/user.go

@@ -1,6 +1,7 @@
 package v1
 
 import (
+	"crypto/ecdsa"
 	json2 "encoding/json"
 	"io"
 	"net/http"
@@ -109,9 +110,23 @@ func PostUserLogin(c *gin.Context) {
 			model.Result{Success: common_err.PWD_INVALID, Message: common_err.GetMsg(common_err.PWD_INVALID)})
 		return
 	}
+
+	privateKey, _ := service.MyService.User().GetKeyPair()
+
 	token := system_model.VerifyInformation{}
-	token.AccessToken = jwt.GetAccessToken(user.Username, user.Password, user.Id)
-	token.RefreshToken = jwt.GetRefreshToken(user.Username, user.Password, user.Id)
+
+	accessToken, err := jwt.GetAccessToken(user.Username, privateKey, user.Id)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, model.Result{Success: common_err.SERVICE_ERROR, Message: err.Error()})
+	}
+	token.AccessToken = accessToken
+
+	refreshToken, err := jwt.GetRefreshToken(user.Username, privateKey, user.Id)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, model.Result{Success: common_err.SERVICE_ERROR, Message: err.Error()})
+	}
+	token.RefreshToken = refreshToken
+
 	token.ExpiresAt = time.Now().Add(3 * time.Hour * time.Duration(1)).Unix()
 	data := make(map[string]interface{}, 2)
 	user.Password = ""
@@ -639,20 +654,41 @@ func PostUserRefreshToken(c *gin.Context) {
 	js := make(map[string]string)
 	c.ShouldBind(&js)
 	refresh := js["refresh_token"]
-	claims, err := jwt.ParseToken(refresh, true)
+
+	privateKey, _ := service.MyService.User().GetKeyPair()
+
+	claims, err := jwt.ParseToken(
+		refresh,
+		func() (*ecdsa.PublicKey, error) {
+			_, publicKey := service.MyService.User().GetKeyPair()
+			return publicKey, nil
+		})
 	if err != nil {
-		c.JSON(common_err.CLIENT_ERROR, model.Result{Success: common_err.VERIFICATION_FAILURE, Message: common_err.GetMsg(common_err.VERIFICATION_FAILURE), Data: err.Error()})
+		c.JSON(http.StatusUnauthorized, model.Result{Success: common_err.VERIFICATION_FAILURE, Message: common_err.GetMsg(common_err.VERIFICATION_FAILURE), Data: err.Error()})
 		return
 	}
 	if !claims.VerifyExpiresAt(time.Now(), true) || !claims.VerifyIssuer("refresh", true) {
-		c.JSON(common_err.CLIENT_ERROR, model.Result{Success: common_err.VERIFICATION_FAILURE, Message: common_err.GetMsg(common_err.VERIFICATION_FAILURE)})
+		c.JSON(http.StatusUnauthorized, model.Result{Success: common_err.VERIFICATION_FAILURE, Message: common_err.GetMsg(common_err.VERIFICATION_FAILURE)})
 		return
 	}
-	newToken := jwt.GetAccessToken(claims.Username, claims.Password, claims.ID)
-	verifyInfo := system_model.VerifyInformation{}
-	verifyInfo.AccessToken = newToken
-	verifyInfo.RefreshToken = jwt.GetRefreshToken(claims.Username, claims.Password, claims.ID)
-	verifyInfo.ExpiresAt = time.Now().Add(3 * time.Hour * time.Duration(1)).Unix()
+
+	newAccessToken, err := jwt.GetAccessToken(claims.Username, privateKey, claims.ID)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, model.Result{Success: common_err.SERVICE_ERROR, Message: err.Error()})
+		return
+	}
+
+	newRefreshToken, err := jwt.GetRefreshToken(claims.Username, privateKey, claims.ID)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, model.Result{Success: common_err.SERVICE_ERROR, Message: err.Error()})
+		return
+	}
+
+	verifyInfo := system_model.VerifyInformation{
+		AccessToken:  newAccessToken,
+		RefreshToken: newRefreshToken,
+		ExpiresAt:    time.Now().Add(3 * time.Hour).Unix(),
+	}
 
 	c.JSON(common_err.SUCCESS, model.Result{Success: common_err.SUCCESS, Message: common_err.GetMsg(common_err.SUCCESS), Data: verifyInfo})
 }

route/v2.go

@@ -1,15 +1,16 @@
 package route
 
 import (
+	"crypto/ecdsa"
 	"net/http"
 	"net/url"
 	"strconv"
 	"strings"
 
-	"github.com/IceWhaleTech/CasaOS-Common/utils/common_err"
 	"github.com/IceWhaleTech/CasaOS-Common/utils/jwt"
 	codegen "github.com/IceWhaleTech/CasaOS-UserService/codegen/user_service"
 	v2 "github.com/IceWhaleTech/CasaOS-UserService/route/v2"
+	"github.com/IceWhaleTech/CasaOS-UserService/service"
 	"github.com/deepmap/oapi-codegen/pkg/middleware"
 	"github.com/getkin/kin-openapi/openapi3"
 	"github.com/getkin/kin-openapi/openapi3filter"
@@ -64,8 +65,13 @@ func InitV2Router() http.Handler {
 			return c.RealIP() == "::1" || c.RealIP() == "127.0.0.1"
 		},
 		ParseTokenFunc: func(token string, c echo.Context) (interface{}, error) {
-			claims, code := jwt.Validate(token)
-			if code != common_err.SUCCESS {
+			valid, claims, err := jwt.Validate(
+				token,
+				func() (*ecdsa.PublicKey, error) {
+					_, publicKey := service.MyService.User().GetKeyPair()
+					return publicKey, nil
+				})
+			if err != nil || !valid {
 				return nil, echo.ErrUnauthorized
 			}