gogrlx/nats-server
1
0
Fork 0
mirror of https://github.com/gogrlx/nats-server.git synced 2026-04-02 03:38:42 -07:00
Code Issues Packages Projects Releases Wiki Activity

fix jwt template ordering issue and error message (#3373)

Browse Source 
ordering of templates got messed up by a map (now removed)
Also improved error message when template generation fails

Signed-off-by: Matthias Hanel <mh@synadia.com>
This commit is contained in:
Matthias Hanel
2022-08-16 19:00:41 -07:00
committed by GitHub
parent 4b4de20c25
commit c67d6aad79
2 changed files with 13 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
server/auth.go
View File

@@ -423,7 +423,7 @@ func processUserPermissionsTemplate(lim jwt.UserPermissionLimits, ujwt *jwt.User
tokens := strings.Split(list[i], tsep)
newTokens := make([]string, len(tokens))
tagValues := map[int][]string{} // indexed by token
tagValues := [][]string{}
for tokenNum, tk := range tokens {
if strings.HasPrefix(tk, "{{") && strings.HasSuffix(tk, "}}") {
@@ -460,12 +460,16 @@ func processUserPermissionsTemplate(lim jwt.UserPermissionLimits, ujwt *jwt.User
strings.TrimSuffix(strings.TrimPrefix(op, "tag("), ")")))
}
valueList := []string{}
for _, tag := range tags {
if strings.HasPrefix(tag, tagPrefix) {
tagValue := strings.TrimPrefix(tag, tagPrefix)
tagValues[tokenNum] = append(tagValues[tokenNum], tagValue)
valueList = append(valueList, tagValue)
}
}
if len(valueList) != 0 {
tagValues = append(tagValues, valueList)
}
default:
// if macro is not recognized, throw off subject check on purpose
tk = " "
@@ -483,12 +487,8 @@ func processUserPermissionsTemplate(lim jwt.UserPermissionLimits, ujwt *jwt.User
}
// else skip emitting
} else {
orderedList := make([][]string, 0, len(tagValues))
for _, valueList := range tagValues {
orderedList = append(orderedList, valueList)
}
// compute the cartesian product and compute subject to emit for each combination
for _, valueList := range nArrayCartesianProduct(orderedList...) {
for _, valueList := range nArrayCartesianProduct(tagValues...) {
b := strings.Builder{}
for i, token := range newTokens {
if token == _EMPTY_ {
@@ -777,7 +777,7 @@ func (s *Server) processClientOrLeafAuthentication(c *client, opts *Options) boo
c.Debugf("User JWT is not valid")
return false
} else if juc.UserPermissionLimits, err = processUserPermissionsTemplate(uSc.Template, juc, acc); err != nil {
c.Debugf("User JWT is not valid")
c.Debugf("User JWT generated invalid permissions")
return false
}
}

5
server/jwt_test.go
View File

@@ -4205,6 +4205,11 @@ func TestJwtTemplates(t *testing.T) {
require_True(t, len(resLim.Sub.Allow) == 0)
require_True(t, len(resLim.Sub.Deny) == 1)
require_Contains(t, resLim.Sub.Deny[0], fmt.Sprintf("foo.myname.%s.accname.%s.bar", upub, aPub))
lim.Pub.Deny.Add("{{tag(NOT_THERE)}}")
_, err = processUserPermissionsTemplate(lim, uclaim, acc)
require_Error(t, err)
require_Contains(t, err.Error(), "generated invalid subject")
}
func TestJWTLimitsTemplate(t *testing.T) {