[jwt] secure token parsing

Author: capcom6

api/requests.http

@@ -192,6 +192,20 @@ Content-Type: application/json
     }
 }
 
+###
+POST {{baseUrl}}/3rdparty/v1/auth/token HTTP/1.1
+Authorization: Basic {{credentials}}
+Content-Type: application/json
+
+{}
+
+###
+POST {{baseUrl}}/3rdparty/v1/auth/token/revoke HTTP/1.1
+Authorization: Basic {{credentials}}
+Content-Type: application/json
+
+{}
+
 ###
 GET http://localhost:3000/metrics HTTP/1.1
 

internal/sms-gateway/handlers/3rdparty.go

@@ -74,13 +74,14 @@ func (h *thirdPartyHandler) Register(router fiber.Router) {
 
 func newThirdPartyHandler(params ThirdPartyHandlerParams) *thirdPartyHandler {
 	return &thirdPartyHandler{
-		Handler:         base.Handler{Logger: params.Logger.Named("ThirdPartyHandler"), Validator: params.Validator},
+		Handler:         base.Handler{Logger: params.Logger, Validator: params.Validator},
 		healthHandler:   params.HealthHandler,
 		messagesHandler: params.MessagesHandler,
 		webhooksHandler: params.WebhooksHandler,
 		devicesHandler:  params.DevicesHandler,
 		settingsHandler: params.SettingsHandler,
 		logsHandler:     params.LogsHandler,
+		authHandler:     params.AuthHandler,
 		authSvc:         params.AuthSvc,
 	}
 }

internal/sms-gateway/jwt/service.go

@@ -80,12 +80,17 @@ func (s *service) GenerateToken(userID string, scopes []string, ttl time.Duratio
 }
 
 func (s *service) ParseToken(ctx context.Context, token string) (*Claims, error) {
-	parsedToken, err := jwt.ParseWithClaims(token, new(Claims), func(t *jwt.Token) (any, error) {
-		if t.Method != jwt.SigningMethodHS256 {
-			return nil, fmt.Errorf("%w: %v", ErrUnexpectedSigningMethod, t.Header["alg"])
-		}
-		return []byte(s.config.Secret), nil
-	})
+	parsedToken, err := jwt.ParseWithClaims(
+		token,
+		new(Claims),
+		func(t *jwt.Token) (any, error) {
+			return []byte(s.config.Secret), nil
+		},
+		jwt.WithExpirationRequired(),
+		jwt.WithIssuedAt(),
+		jwt.WithIssuer(s.config.Issuer),
+		jwt.WithValidMethods([]string{jwt.SigningMethodHS256.Name}),
+	)
 	if err != nil {
 		return nil, fmt.Errorf("failed to parse token: %w", err)
 	}