Compare commits
No commits in common. "57570a097677ef3072c0c3b145c4c90775872deb" and "a938b8c305dc55bb19e872fd60069d7c6733f12f" have entirely different histories.
57570a0976
...
a938b8c305
@ -9,80 +9,3 @@ Deno.test("AuthSdk - initializes with config", () => {
|
||||
assertEquals(typeof sdk.validateSession, "function");
|
||||
assertEquals(typeof sdk.requireAuth, "function");
|
||||
});
|
||||
|
||||
Deno.test("AuthSdk - Event Bus: registers, receives, and unregisters events", () => {
|
||||
const sdk = createAuthSdk({
|
||||
authApiUrl: "http://localhost:8000",
|
||||
timeoutMs: 3000,
|
||||
});
|
||||
|
||||
const receivedTokens: string[] = [];
|
||||
const handler = (token: string) => {
|
||||
receivedTokens.push(token);
|
||||
};
|
||||
|
||||
sdk.on("invalidate", handler);
|
||||
|
||||
// Simulate Valkey push event
|
||||
(sdk as any)._handleValkeyPush(["invalidate", ["token1", "token2"]]);
|
||||
|
||||
assertEquals(receivedTokens, ["token1", "token2"]);
|
||||
|
||||
sdk.off("invalidate", handler);
|
||||
|
||||
// Simulate another push event
|
||||
(sdk as any)._handleValkeyPush(["invalidate", ["token3"]]);
|
||||
|
||||
// The tokens should not be added because handler was unregistered
|
||||
assertEquals(receivedTokens, ["token1", "token2"]);
|
||||
});
|
||||
|
||||
Deno.test("AuthSdk - Event Bus: failing async handlers do not crash bus", async () => {
|
||||
const sdk = createAuthSdk({
|
||||
authApiUrl: "http://localhost:8000",
|
||||
timeoutMs: 3000,
|
||||
});
|
||||
|
||||
const receivedTokens: string[] = [];
|
||||
|
||||
const failingHandlerAsync = async (token: string) => {
|
||||
throw new Error(`Simulated async failure for ${token}`);
|
||||
};
|
||||
|
||||
const failingHandlerSync = (token: string) => {
|
||||
throw new Error(`Simulated sync failure for ${token}`);
|
||||
};
|
||||
|
||||
const successHandler = (token: string) => {
|
||||
receivedTokens.push(token);
|
||||
};
|
||||
|
||||
sdk.on("invalidate", failingHandlerAsync);
|
||||
sdk.on("invalidate", failingHandlerSync);
|
||||
sdk.on("invalidate", successHandler);
|
||||
|
||||
// Stub console.error to avoid test noise
|
||||
const originalConsoleError = console.error;
|
||||
let loggedErrors = 0;
|
||||
console.error = (...args: any[]) => {
|
||||
const msg = args.join(" ");
|
||||
if (msg.includes("Error in 'invalidate' listener")) {
|
||||
loggedErrors++;
|
||||
}
|
||||
};
|
||||
|
||||
try {
|
||||
(sdk as any)._handleValkeyPush(["invalidate", ["token4"]]);
|
||||
|
||||
// Give microtasks a chance to process the async rejection
|
||||
await new Promise((resolve) => setTimeout(resolve, 0));
|
||||
|
||||
// The successful handler should have run despite the failures
|
||||
assertEquals(receivedTokens, ["token4"]);
|
||||
|
||||
// Both the sync and async errors should have been caught and logged
|
||||
assertEquals(loggedErrors, 2);
|
||||
} finally {
|
||||
console.error = originalConsoleError;
|
||||
}
|
||||
});
|
||||
|
||||
97
sdk/mod.ts
97
sdk/mod.ts
@ -6,16 +6,6 @@ import { createClient } from "npm:@connectrpc/connect@^1.4.0";
|
||||
import { createConnectTransport } from "npm:@connectrpc/connect-node@^1.4.0";
|
||||
import { AuthService } from "./gen/auth_connect.ts";
|
||||
|
||||
/**
|
||||
* Supported event types for the Auth SDK.
|
||||
*/
|
||||
export type AuthSdkEvent = "invalidate";
|
||||
|
||||
/**
|
||||
* Handler type for invalidation events.
|
||||
*/
|
||||
export type InvalidationHandler = (token: string) => void | Promise<void>;
|
||||
|
||||
/**
|
||||
* Configuration options for the Auth SDK.
|
||||
*/
|
||||
@ -68,7 +58,6 @@ export class AuthSdk {
|
||||
private l1Cache: Map<string, SessionData>;
|
||||
private valkeyClient: Redis | null = null;
|
||||
private grpcClient: any;
|
||||
private listeners: Map<string, Set<InvalidationHandler>> = new Map();
|
||||
|
||||
constructor(config: AuthSdkConfig) {
|
||||
this.config = config;
|
||||
@ -95,78 +84,6 @@ export class AuthSdk {
|
||||
this.grpcClient = createClient(AuthService, transport);
|
||||
}
|
||||
|
||||
/**
|
||||
* Registers a callback to be invoked when a specific event occurs.
|
||||
*
|
||||
* @param event The event name (e.g., "invalidate").
|
||||
* @param handler The callback function.
|
||||
*/
|
||||
on(event: AuthSdkEvent, handler: InvalidationHandler): void {
|
||||
let eventListeners = this.listeners.get(event);
|
||||
if (!eventListeners) {
|
||||
eventListeners = new Set();
|
||||
this.listeners.set(event, eventListeners);
|
||||
}
|
||||
eventListeners.add(handler);
|
||||
}
|
||||
|
||||
/**
|
||||
* Unregisters a previously registered callback.
|
||||
*
|
||||
* @param event The event name (e.g., "invalidate").
|
||||
* @param handler The callback function to remove.
|
||||
*/
|
||||
off(event: AuthSdkEvent, handler: InvalidationHandler): void {
|
||||
const eventListeners = this.listeners.get(event);
|
||||
if (eventListeners) {
|
||||
eventListeners.delete(handler);
|
||||
if (eventListeners.size === 0) {
|
||||
this.listeners.delete(event);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Internal method to emit an event safely to all registered listeners.
|
||||
*/
|
||||
private emit(event: AuthSdkEvent, token: string): void {
|
||||
const eventListeners = this.listeners.get(event);
|
||||
if (eventListeners) {
|
||||
for (const handler of eventListeners) {
|
||||
try {
|
||||
const result = handler(token);
|
||||
if (result instanceof Promise) {
|
||||
result.catch((err) => {
|
||||
console.error("[AuthSdk] Error in 'invalidate' listener:", err);
|
||||
});
|
||||
}
|
||||
} catch (err) {
|
||||
console.error("[AuthSdk] Error in 'invalidate' listener:", err);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Internal handler for RESP3 push invalidation messages.
|
||||
* Exposed internally/to tests via the Valkey event listener.
|
||||
*/
|
||||
_handleValkeyPush(msg: unknown): void {
|
||||
if (
|
||||
Array.isArray(msg) && msg.length >= 2 && msg[0] === "invalidate"
|
||||
) {
|
||||
const keysToInvalidate = msg[1];
|
||||
if (Array.isArray(keysToInvalidate)) {
|
||||
for (const key of keysToInvalidate) {
|
||||
// SIDE EFFECT: Delete the invalidated key from the local Map
|
||||
this.l1Cache.delete(key);
|
||||
// Emit invalidate event for real-time consumers
|
||||
this.emit("invalidate", key);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
private initValkeyClient() {
|
||||
this.valkeyClient = new Redis(this.config.valkeyUrl!, {
|
||||
enableOfflineQueue: false,
|
||||
@ -185,7 +102,19 @@ export class AuthSdk {
|
||||
});
|
||||
|
||||
// Listen for RESP3 push invalidation messages
|
||||
this.valkeyClient.on("push", (msg: unknown) => this._handleValkeyPush(msg));
|
||||
this.valkeyClient.on("push", (msg: unknown) => {
|
||||
if (
|
||||
Array.isArray(msg) && msg.length >= 2 && msg[0] === "invalidate"
|
||||
) {
|
||||
const keysToInvalidate = msg[1];
|
||||
if (Array.isArray(keysToInvalidate)) {
|
||||
for (const key of keysToInvalidate) {
|
||||
// SIDE EFFECT: Delete the invalidated key from the local Map
|
||||
this.l1Cache.delete(key);
|
||||
}
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
this.valkeyClient.on("error", (err: unknown) => {
|
||||
console.error("Valkey SDK Client error:", err);
|
||||
|
||||
@ -1,25 +1,10 @@
|
||||
import { assertEquals } from "jsr:@std/assert";
|
||||
import { Extension, X509CertificateGenerator } from "npm:@peculiar/x509";
|
||||
import {
|
||||
deriveArgon2idKey,
|
||||
extractSpiffeIdFromCert,
|
||||
fetchSpiffeIdentity,
|
||||
} from "./spire_ffi.ts";
|
||||
import { extractSpiffeIdFromCert, fetchSpiffeIdentity } from "./spire_ffi.ts";
|
||||
|
||||
Deno.test("SPIRE FFI Test - fetchSpiffeIdentity mock", async () => {
|
||||
// If the library is loaded, the real fetch_svid is called and expects a socket.
|
||||
// Because we don't have a real socket, it throws a transport error.
|
||||
// We can handle both the mocked (no lib) and loaded (lib, but socket absent) scenarios.
|
||||
try {
|
||||
const result = await fetchSpiffeIdentity();
|
||||
assertEquals(result.spiffe_id, "spiffe://local.dev/mock");
|
||||
} catch (e) {
|
||||
if (e instanceof Error && e.message.includes("transport error")) {
|
||||
// Expected if library loaded but SPIRE agent not running.
|
||||
} else {
|
||||
throw e;
|
||||
}
|
||||
}
|
||||
const result = await fetchSpiffeIdentity();
|
||||
assertEquals(result.spiffe_id, "spiffe://local.dev/mock");
|
||||
});
|
||||
|
||||
Deno.test("SPIRE FFI Test - extractSpiffeIdFromCert null/invalid cases", () => {
|
||||
@ -62,17 +47,3 @@ Deno.test("SPIRE FFI Test - extractSpiffeIdFromCert valid SPIFFE certificate", a
|
||||
const extracted = extractSpiffeIdFromCert(pem);
|
||||
assertEquals(extracted, spiffeUri);
|
||||
});
|
||||
|
||||
Deno.test("SPIRE FFI Test - deriveArgon2idKey", async () => {
|
||||
const password = new Uint8Array([1, 2, 3, 4, 5]);
|
||||
const salt = new Uint8Array([10, 20, 30, 40, 50, 60, 70, 80]);
|
||||
|
||||
const key = await deriveArgon2idKey(password, salt);
|
||||
|
||||
assertEquals(key.length, 32);
|
||||
|
||||
// If the mock was used, it will be filled with 0xaa
|
||||
// If the real library was used, it will be a hash.
|
||||
// We can just verify it returned a 32-byte array successfully.
|
||||
assertEquals(key instanceof Uint8Array, true);
|
||||
});
|
||||
|
||||
@ -27,20 +27,6 @@ try {
|
||||
parameters: ["pointer"],
|
||||
result: "void",
|
||||
},
|
||||
argon2id_derive: {
|
||||
parameters: [
|
||||
"pointer",
|
||||
"usize",
|
||||
"pointer",
|
||||
"usize",
|
||||
"u32",
|
||||
"u32",
|
||||
"pointer",
|
||||
"usize",
|
||||
],
|
||||
result: "i32",
|
||||
nonblocking: true,
|
||||
},
|
||||
});
|
||||
} catch (_e) {
|
||||
console.warn(
|
||||
@ -198,57 +184,6 @@ export let extractSpiffeIdFromCert = function extractSpiffeIdFromCert(
|
||||
return null;
|
||||
};
|
||||
|
||||
export async function deriveArgon2idKey(
|
||||
password: Uint8Array,
|
||||
salt: Uint8Array,
|
||||
): Promise<Uint8Array> {
|
||||
const outBuf = new Uint8Array(32);
|
||||
|
||||
if (!dylib) {
|
||||
console.warn(
|
||||
`[SPIRE FFI] Dynamic library (${libPath}) is not loaded. Mocking Argon2id derivation for local development.`,
|
||||
);
|
||||
outBuf.fill(0xaa);
|
||||
return outBuf;
|
||||
}
|
||||
|
||||
const iterations = 12;
|
||||
const memoryKb = 65536;
|
||||
|
||||
const passwordPtr = Deno.UnsafePointer.of(password);
|
||||
const saltPtr = Deno.UnsafePointer.of(salt);
|
||||
const outPtr = Deno.UnsafePointer.of(outBuf);
|
||||
|
||||
const argon2id_derive = dylib.symbols
|
||||
.argon2id_derive as unknown as ((
|
||||
passwordPtr: Deno.PointerValue,
|
||||
passwordLen: number | bigint,
|
||||
saltPtr: Deno.PointerValue,
|
||||
saltLen: number | bigint,
|
||||
iterations: number,
|
||||
memoryKb: number,
|
||||
outPtr: Deno.PointerValue,
|
||||
outLen: number | bigint,
|
||||
) => Promise<number>);
|
||||
|
||||
const res = await argon2id_derive(
|
||||
passwordPtr,
|
||||
password.length,
|
||||
saltPtr,
|
||||
salt.length,
|
||||
iterations,
|
||||
memoryKb,
|
||||
outPtr,
|
||||
outBuf.length,
|
||||
);
|
||||
|
||||
if (res !== 0) {
|
||||
throw new Error(`Argon2id derivation failed: ${res}`);
|
||||
}
|
||||
|
||||
return outBuf;
|
||||
}
|
||||
|
||||
export const spireWrapper = {
|
||||
get extractSpiffeIdFromCert() {
|
||||
return extractSpiffeIdFromCert;
|
||||
|
||||
106
spire_ffi/Cargo.lock
generated
106
spire_ffi/Cargo.lock
generated
@ -17,18 +17,6 @@ version = "1.0.104"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
|
||||
|
||||
[[package]]
|
||||
name = "argon2"
|
||||
version = "0.5.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "3c3610892ee6e0cbce8ae2700349fcf8f98adb0dbfbee85aec3c9179d29cc072"
|
||||
dependencies = [
|
||||
"base64ct",
|
||||
"blake2",
|
||||
"cpufeatures",
|
||||
"password-hash",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "async-stream"
|
||||
version = "0.3.6"
|
||||
@ -119,12 +107,6 @@ version = "0.21.7"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567"
|
||||
|
||||
[[package]]
|
||||
name = "base64ct"
|
||||
version = "1.8.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
|
||||
|
||||
[[package]]
|
||||
name = "bitflags"
|
||||
version = "1.3.2"
|
||||
@ -137,24 +119,6 @@ version = "2.13.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
|
||||
|
||||
[[package]]
|
||||
name = "blake2"
|
||||
version = "0.10.6"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "46502ad458c9a52b69d4d4d32775c788b7a1b85e8bc9d482d92250fc0e3f8efe"
|
||||
dependencies = [
|
||||
"digest",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "block-buffer"
|
||||
version = "0.10.4"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
|
||||
dependencies = [
|
||||
"generic-array",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "bytes"
|
||||
version = "1.12.1"
|
||||
@ -167,36 +131,6 @@ version = "1.0.4"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
|
||||
|
||||
[[package]]
|
||||
name = "cpufeatures"
|
||||
version = "0.2.17"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
|
||||
dependencies = [
|
||||
"libc",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "crypto-common"
|
||||
version = "0.1.7"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
|
||||
dependencies = [
|
||||
"generic-array",
|
||||
"typenum",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "digest"
|
||||
version = "0.10.7"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
|
||||
dependencies = [
|
||||
"block-buffer",
|
||||
"crypto-common",
|
||||
"subtle",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "either"
|
||||
version = "1.18.0"
|
||||
@ -276,16 +210,6 @@ dependencies = [
|
||||
"slab",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "generic-array"
|
||||
version = "0.14.7"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
|
||||
dependencies = [
|
||||
"typenum",
|
||||
"version_check",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "getrandom"
|
||||
version = "0.2.17"
|
||||
@ -586,17 +510,6 @@ dependencies = [
|
||||
"windows-link",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "password-hash"
|
||||
version = "0.5.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "346f04948ba92c43e8469c1ee6736c7563d71012b17d40745260fe106aac2166"
|
||||
dependencies = [
|
||||
"base64ct",
|
||||
"rand_core",
|
||||
"subtle",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "percent-encoding"
|
||||
version = "2.3.2"
|
||||
@ -917,7 +830,6 @@ dependencies = [
|
||||
name = "spire_ffi"
|
||||
version = "0.1.0"
|
||||
dependencies = [
|
||||
"argon2",
|
||||
"hyper 1.11.0",
|
||||
"hyper-util",
|
||||
"prost",
|
||||
@ -932,12 +844,6 @@ dependencies = [
|
||||
"tower-service",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "subtle"
|
||||
version = "2.6.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
|
||||
|
||||
[[package]]
|
||||
name = "syn"
|
||||
version = "2.0.119"
|
||||
@ -1152,24 +1058,12 @@ version = "0.2.5"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
|
||||
|
||||
[[package]]
|
||||
name = "typenum"
|
||||
version = "1.20.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
|
||||
|
||||
[[package]]
|
||||
name = "unicode-ident"
|
||||
version = "1.0.24"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
|
||||
|
||||
[[package]]
|
||||
name = "version_check"
|
||||
version = "0.9.5"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
|
||||
|
||||
[[package]]
|
||||
name = "want"
|
||||
version = "0.3.1"
|
||||
|
||||
@ -8,7 +8,6 @@ license = "MIT OR Apache-2.0"
|
||||
crate-type = ["cdylib"]
|
||||
|
||||
[dependencies]
|
||||
argon2 = { version = "0.5", features = ["std"] }
|
||||
tonic = "0.11"
|
||||
prost = "0.12"
|
||||
tokio = { version = "1.37", features = ["full"] }
|
||||
|
||||
@ -44,49 +44,6 @@ impl SvidResponseC {
|
||||
}
|
||||
}
|
||||
|
||||
#[no_mangle]
|
||||
pub extern "C" fn argon2id_derive(
|
||||
password_ptr: *const u8,
|
||||
password_len: usize,
|
||||
salt_ptr: *const u8,
|
||||
salt_len: usize,
|
||||
iterations: u32,
|
||||
memory_kb: u32,
|
||||
out_ptr: *mut u8,
|
||||
out_len: usize,
|
||||
) -> i32 {
|
||||
if password_ptr.is_null() || salt_ptr.is_null() || out_ptr.is_null() || out_len == 0 {
|
||||
return -1;
|
||||
}
|
||||
|
||||
let password = unsafe { std::slice::from_raw_parts(password_ptr, password_len) };
|
||||
let salt = unsafe { std::slice::from_raw_parts(salt_ptr, salt_len) };
|
||||
let out = unsafe { std::slice::from_raw_parts_mut(out_ptr, out_len) };
|
||||
|
||||
let params = argon2::Params::new(
|
||||
memory_kb,
|
||||
iterations,
|
||||
argon2::Params::DEFAULT_P_COST,
|
||||
Some(out_len),
|
||||
);
|
||||
|
||||
let params = match params {
|
||||
Ok(p) => p,
|
||||
Err(_) => return -1,
|
||||
};
|
||||
|
||||
let argon2 = argon2::Argon2::new(
|
||||
argon2::Algorithm::Argon2id,
|
||||
argon2::Version::V0x13,
|
||||
params,
|
||||
);
|
||||
|
||||
match argon2.hash_password_into(password, salt, out) {
|
||||
Ok(_) => 0,
|
||||
Err(_) => -2,
|
||||
}
|
||||
}
|
||||
|
||||
async fn fetch_svid_async(socket_path: &str) -> Result<SvidResponseC, Box<dyn std::error::Error>> {
|
||||
let path = Path::new(socket_path).to_path_buf();
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user