authenticator.hpp

Go to the documentation of this file.

// §10 safe-by-default request authenticator.
//
// This is THE entry point for turning an inbound credential into an AxiamUser.
//
// <axiam/jwks.hpp> ships a deliberately minimal primitive
// (JwksVerifier::verify_signature_only_unchecked) that proves a token was signed
// by the org's Ed25519 key and stops there. A valid signature is not an
// authentication decision: the JWKS endpoint is org-wide, so a signature alone
// says nothing about whether the token has expired, has started being valid, or
// was minted for THIS tenant. Wiring the raw primitive into a route guard
// therefore accepts expired and cross-tenant tokens.
//
// TokenAuthenticator closes that gap. Every successful authenticate() has
// established, in order:
//
//   1. the compact JWS is well formed and `alg` is EdDSA;
//   2. the signature verifies against the cached JWKS;
//   3. `exp` is present, is an integer, and has not passed (allowing a small,
//      named clock skew);
//   4. `nbf`, when present, is an integer and has arrived (same skew);
//   5. `tenant_id` is present, is a non-empty string, and equals the tenant this
//      authenticator was configured with;
//   6. optionally, `iss` / `aud` match configured expectations.
//
// Anything missing, malformed or mismatched is a failure — the authenticator
// fails closed and never returns a partially-checked identity.
#pragma once
 
#include <chrono>
#include <cstdint>
#include <functional>
#include <optional>
#include <string>
 
#include "axiam/client.hpp"
#include "axiam/errors.hpp"
#include "axiam/guard.hpp"
#include "axiam/jwks.hpp"
 
namespace axiam {
 
using NowFn = std::function<std::int64_t()>;
 
inline constexpr std::chrono::seconds kDefaultClockSkew{30};
inline constexpr std::chrono::seconds kMaxClockSkew{60};
 
struct AuthenticatorOptions {
    std::chrono::seconds clock_skew{kDefaultClockSkew};
 
    std::optional<std::string> expected_issuer;
 
    std::optional<std::string> expected_audience;
 
    NowFn now;
};
 
class TokenAuthenticator {
public:
    TokenAuthenticator(JwksVerifier& jwks, std::string expected_tenant_id,
                       AuthenticatorOptions options = {});
 
    AxiamUser authenticate(const std::string& token) const;
 
    std::optional<AxiamUser> try_authenticate(const std::string& token) const;
 
    const std::string& expected_tenant_id() const noexcept { return tenant_id_; }
 
    static std::optional<std::string> bearer_from_authorization(const std::string& header_value);
 
    static std::optional<std::string> token_from_cookie_header(const std::string& cookie_header);
 
    template <typename Request>
    typename AxiamGuard<Request>::Authenticator guard_authenticator(
        std::function<std::optional<std::string>(const Request&)> extract_token) const {
        const TokenAuthenticator* self = this;
        return [self, extract_token](const Request& req) -> std::optional<AxiamUser> {
            auto token = extract_token(req);
            if (!token.has_value()) return std::nullopt;
            return self->try_authenticate(*token);
        };
    }
 
private:
    JwksVerifier* jwks_;
    std::string tenant_id_;
    AuthenticatorOptions options_;
};
 
inline TokenAuthenticator make_authenticator(Client& client, std::string expected_tenant_id,
                                             AuthenticatorOptions options = {}) {
    return TokenAuthenticator(client.jwks(), std::move(expected_tenant_id), std::move(options));
}
 
}  // namespace axiam