Skip to content

Commit

Permalink
feat: tolerate initial JWK error (wundergraph#1475)
Browse files Browse the repository at this point in the history
  • Loading branch information
@StarpTech
StarpTech authored Dec 23, 2024
1 parent 4a72ded commit 57e8507
Show file tree
Hide file tree
Showing 6 changed files with 37 additions and 20 deletions.
3 changes: 0 additions & 3 deletions .github/actions/build-push-image/action.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -79,9 +79,6 @@ runs:

- name: Build & Push Docker Image
uses: docker/build-push-action@v6
env:
DOCKER_BUILD_SUMMARY: false
DOCKER_BUILD_RECORD_UPLOAD: false
with:
# This is a limitation of GitHub. Only organization members can push to GitHub Container Registry
# For now, we will disable the push to the GitHub Container Registry for external contributors
Expand Down
11 changes: 6 additions & 5 deletions router-tests/authentication_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@ package integration_test

import (
"bytes"
"go.uber.org/zap"
"io"
"net/http"
"strings"
Expand Down Expand Up @@ -29,7 +30,7 @@ func configureAuth(t *testing.T) ([]authentication.Authenticator, *jwks.Server)
authServer, err := jwks.NewServer(t)
require.NoError(t, err)
t.Cleanup(authServer.Close)
tokenDecoder, _ := authentication.NewJwksTokenDecoder(authServer.JWKSURL(), time.Second*5)
tokenDecoder, _ := authentication.NewJwksTokenDecoder(zap.NewNop(), authServer.JWKSURL(), time.Second*5)
authOptions := authentication.HttpHeaderAuthenticatorOptions{
Name: jwksName,
URL: authServer.JWKSURL(),
Expand Down Expand Up @@ -613,7 +614,7 @@ func TestAuthenticationWithCustomHeaders(t *testing.T) {
authServer, err := jwks.NewServer(t)
require.NoError(t, err)
t.Cleanup(authServer.Close)
tokenDecoder, _ := authentication.NewJwksTokenDecoder(authServer.JWKSURL(), time.Second*5)
tokenDecoder, _ := authentication.NewJwksTokenDecoder(zap.NewNop(), authServer.JWKSURL(), time.Second*5)
authOptions := authentication.HttpHeaderAuthenticatorOptions{
Name: jwksName,
URL: authServer.JWKSURL(),
Expand Down Expand Up @@ -748,7 +749,7 @@ func TestAuthenticationMultipleProviders(t *testing.T) {
require.NoError(t, err)
t.Cleanup(authServer2.Close)

tokenDecoder1, _ := authentication.NewJwksTokenDecoder(authServer1.JWKSURL(), time.Second*5)
tokenDecoder1, _ := authentication.NewJwksTokenDecoder(zap.NewNop(), authServer1.JWKSURL(), time.Second*5)
authenticator1HeaderValuePrefixes := []string{"Bearer"}
authenticator1, err := authentication.NewHttpHeaderAuthenticator(authentication.HttpHeaderAuthenticatorOptions{
Name: "1",
Expand All @@ -758,7 +759,7 @@ func TestAuthenticationMultipleProviders(t *testing.T) {
})
require.NoError(t, err)

tokenDecoder2, _ := authentication.NewJwksTokenDecoder(authServer2.JWKSURL(), time.Second*5)
tokenDecoder2, _ := authentication.NewJwksTokenDecoder(zap.NewNop(), authServer2.JWKSURL(), time.Second*5)
authenticator2HeaderValuePrefixes := []string{"", "Bearer", "Token"}
authenticator2, err := authentication.NewHttpHeaderAuthenticator(authentication.HttpHeaderAuthenticatorOptions{
Name: "2",
Expand Down Expand Up @@ -858,7 +859,7 @@ func TestAuthenticationOverWebsocket(t *testing.T) {
require.NoError(t, err)
defer authServer.Close()

tokenDecoder, _ := authentication.NewJwksTokenDecoder(authServer.JWKSURL(), time.Second*5)
tokenDecoder, _ := authentication.NewJwksTokenDecoder(zap.NewNop(), authServer.JWKSURL(), time.Second*5)
jwksOpts := authentication.HttpHeaderAuthenticatorOptions{
Name: jwksName,
URL: authServer.JWKSURL(),
Expand Down
3 changes: 2 additions & 1 deletion router-tests/modules/set_scopes_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@ import (
"github.com/wundergraph/cosmo/router/core"
"github.com/wundergraph/cosmo/router/pkg/authentication"
"github.com/wundergraph/cosmo/router/pkg/config"
"go.uber.org/zap"
"io"
"net/http"
"strings"
Expand All @@ -26,7 +27,7 @@ func configureAuth(t *testing.T) ([]authentication.Authenticator, *jwks.Server)
authServer, err := jwks.NewServer(t)
require.NoError(t, err)
t.Cleanup(authServer.Close)
tokenDecoder, _ := authentication.NewJwksTokenDecoder(authServer.JWKSURL(), time.Second*5)
tokenDecoder, _ := authentication.NewJwksTokenDecoder(zap.NewNop(), authServer.JWKSURL(), time.Second*5)
authOptions := authentication.HttpHeaderAuthenticatorOptions{
Name: jwksName,
URL: authServer.JWKSURL(),
Expand Down
15 changes: 8 additions & 7 deletions router-tests/websocket_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@ import (
"encoding/json"
"errors"
"fmt"
"go.uber.org/zap"
"io"
"math/big"
"net"
Expand Down Expand Up @@ -73,7 +74,7 @@ func TestWebSockets(t *testing.T) {
authServer, err := jwks.NewServer(t)
require.NoError(t, err)
t.Cleanup(authServer.Close)
tokenDecoder, _ := authentication.NewJwksTokenDecoder(authServer.JWKSURL(), time.Second*5)
tokenDecoder, _ := authentication.NewJwksTokenDecoder(zap.NewNop(), authServer.JWKSURL(), time.Second*5)
authOptions := authentication.HttpHeaderAuthenticatorOptions{
Name: jwksName,
URL: authServer.JWKSURL(),
Expand Down Expand Up @@ -123,7 +124,7 @@ func TestWebSockets(t *testing.T) {
authServer, err := jwks.NewServer(t)
require.NoError(t, err)
t.Cleanup(authServer.Close)
tokenDecoder, _ := authentication.NewJwksTokenDecoder(authServer.JWKSURL(), time.Second*5)
tokenDecoder, _ := authentication.NewJwksTokenDecoder(zap.NewNop(), authServer.JWKSURL(), time.Second*5)
authOptions := authentication.HttpHeaderAuthenticatorOptions{
Name: jwksName,
URL: authServer.JWKSURL(),
Expand Down Expand Up @@ -173,7 +174,7 @@ func TestWebSockets(t *testing.T) {
authServer, err := jwks.NewServer(t)
require.NoError(t, err)
t.Cleanup(authServer.Close)
tokenDecoder, _ := authentication.NewJwksTokenDecoder(authServer.JWKSURL(), time.Second*5)
tokenDecoder, _ := authentication.NewJwksTokenDecoder(zap.NewNop(), authServer.JWKSURL(), time.Second*5)
authOptions := authentication.HttpHeaderAuthenticatorOptions{
Name: jwksName,
URL: authServer.JWKSURL(),
Expand Down Expand Up @@ -232,7 +233,7 @@ func TestWebSockets(t *testing.T) {
authServer, err := jwks.NewServer(t)
require.NoError(t, err)
t.Cleanup(authServer.Close)
tokenDecoder, _ := authentication.NewJwksTokenDecoder(authServer.JWKSURL(), time.Second*5)
tokenDecoder, _ := authentication.NewJwksTokenDecoder(zap.NewNop(), authServer.JWKSURL(), time.Second*5)
authOptions := authentication.HttpHeaderAuthenticatorOptions{
Name: jwksName,
URL: authServer.JWKSURL(),
Expand Down Expand Up @@ -290,7 +291,7 @@ func TestWebSockets(t *testing.T) {
authServer, err := jwks.NewServer(t)
require.NoError(t, err)
t.Cleanup(authServer.Close)
tokenDecoder, _ := authentication.NewJwksTokenDecoder(authServer.JWKSURL(), time.Second*5)
tokenDecoder, _ := authentication.NewJwksTokenDecoder(zap.NewNop(), authServer.JWKSURL(), time.Second*5)
authOptions := authentication.WebsocketInitialPayloadAuthenticatorOptions{
TokenDecoder: tokenDecoder,
Key: "Authorization",
Expand Down Expand Up @@ -351,7 +352,7 @@ func TestWebSockets(t *testing.T) {
authServer, err := jwks.NewServer(t)
require.NoError(t, err)
t.Cleanup(authServer.Close)
tokenDecoder, _ := authentication.NewJwksTokenDecoder(authServer.JWKSURL(), time.Second*5)
tokenDecoder, _ := authentication.NewJwksTokenDecoder(zap.NewNop(), authServer.JWKSURL(), time.Second*5)
authOptions := authentication.WebsocketInitialPayloadAuthenticatorOptions{
TokenDecoder: tokenDecoder,
Key: "Authorization",
Expand Down Expand Up @@ -400,7 +401,7 @@ func TestWebSockets(t *testing.T) {
authServer, err := jwks.NewServer(t)
require.NoError(t, err)
t.Cleanup(authServer.Close)
tokenDecoder, _ := authentication.NewJwksTokenDecoder(authServer.JWKSURL(), time.Second*5)
tokenDecoder, _ := authentication.NewJwksTokenDecoder(zap.NewNop(), authServer.JWKSURL(), time.Second*5)
authOptions := authentication.WebsocketInitialPayloadAuthenticatorOptions{
TokenDecoder: tokenDecoder,
Key: "Authorization",
Expand Down
13 changes: 10 additions & 3 deletions router/cmd/instance.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -61,7 +61,12 @@ func NewRouter(params Params, additionalOptions ...core.Option) (*core.Router, e
if name == "" {
name = fmt.Sprintf("jwks-#%d", i)
}
tokenDecoder, _ := authentication.NewJwksTokenDecoder(auth.JWKS.URL, auth.JWKS.RefreshInterval)
providerLogger := logger.With(zap.String("provider_name", name))
tokenDecoder, err := authentication.NewJwksTokenDecoder(providerLogger, auth.JWKS.URL, auth.JWKS.RefreshInterval)
if err != nil {
providerLogger.Error("Could not create JWKS token decoder", zap.Error(err))
return nil, err
}
opts := authentication.HttpHeaderAuthenticatorOptions{
Name: name,
URL: auth.JWKS.URL,
Expand All @@ -71,7 +76,8 @@ func NewRouter(params Params, additionalOptions ...core.Option) (*core.Router, e
}
authenticator, err := authentication.NewHttpHeaderAuthenticator(opts)
if err != nil {
logger.Fatal("Could not create HttpHeader authenticator", zap.Error(err), zap.String("name", name))
providerLogger.Error("Could not create HttpHeader authenticator", zap.Error(err))
return nil, err
}
authenticators = append(authenticators, authenticator)

Expand All @@ -83,7 +89,8 @@ func NewRouter(params Params, additionalOptions ...core.Option) (*core.Router, e
}
authenticator, err = authentication.NewWebsocketInitialPayloadAuthenticator(opts)
if err != nil {
logger.Fatal("Could not create WebsocketInitialPayload authenticator", zap.Error(err))
providerLogger.Error("Could not create WebsocketInitialPayload authenticator", zap.Error(err))
return nil, err
}
authenticators = append(authenticators, authenticator)
}
Expand Down
12 changes: 11 additions & 1 deletion router/pkg/authentication/jwks_token_decoder.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@ package authentication

import (
"fmt"
"go.uber.org/zap"
"time"

"github.com/MicahParks/keyfunc/v2"
Expand Down Expand Up @@ -29,10 +30,19 @@ func (j *jwksTokenDecoder) Decode(tokenString string) (Claims, error) {
return Claims(claims), nil
}

func NewJwksTokenDecoder(url string, refreshInterval time.Duration) (TokenDecoder, error) {
func NewJwksTokenDecoder(logger *zap.Logger, url string, refreshInterval time.Duration) (TokenDecoder, error) {

jwks, err := keyfunc.Get(url, keyfunc.Options{
RefreshInterval: refreshInterval,
// Allow the JWKS to be empty initially, but it can recover on refresh.
TolerateInitialJWKHTTPError: true,
RefreshErrorHandler: func(err error) {
logger.Error("Could not refresh JWKS. Trying again in the next interval.",
zap.Error(err),
zap.String("url", url),
zap.String("interval", refreshInterval.String()),
)
},
})
if err != nil {
return nil, fmt.Errorf("error initializing JWKS from %q: %w", url, err)
Expand Down

0 comments on commit 57e8507

Please sign in to comment.