whyrusleeping / algoz Goto Github PK

type jwtBody struct {
	UserDID    string `json:"sub"`
	ServiceDID string `json:"aud"`
	Expiry     int64  `json:"exp,omitempty"`
}

func ValidateAuthentication(ctx context.Context, r *http.Request) error {
	authHeader := r.Header.Get("authorization")
	jwt := ""
	if strings.HasPrefix(strings.ToLower(authHeader), "bearer ") {
		jwt = authHeader[len("bearer "):]
	}

	jwtParts := strings.Split(jwt, ".")
	encodedJWTBody, jwtSignature := jwtParts[1], jwtParts[2]

	decoded, err := base64.StdEncoding.DecodeString(encodedJWTBody)
	if err != nil {
		return err
	}
	var body jwtBody
	if err = json.Unmarshal(decoded, &body); err != nil {
		return err
	}

	ignore := IgnoreJWTExpiration(ctx)
	if ignore {
		expireTime := time.Unix(body.Expiry, 0)
		if body.Expiry > 0 && time.Now().After(expireTime) {
			return errors.New("jwt expired")
		}
	}

	resolver := GetResolver(ctx)

	did, err := syntax.ParseDID(body.UserDID)
	if err != nil {
		return err
	}

	user, err := resolver.LookupDID(ctx, did)
	if err != nil {
		return err
	}

	key, err := user.PublicKey()
	if err != nil {
		return err
	}

	// rawSig, err := base64.RawStdEncoding.DecodeString(jwtSignature)
	// if err != nil {
	// 	return err
	// }

	return key.HashAndVerifyLenient([]byte(strings.Join(jwtParts[0:2], ".")), []byte(jwtSignature))
}