You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@apisix.apache.org by "fishioon (via GitHub)" <gi...@apache.org> on 2023/09/25 02:51:11 UTC
[GitHub] [apisix] fishioon opened a new pull request, #10252: [WIP]feat: add jwe decrypt plugin
fishioon opened a new pull request, #10252:
URL: https://github.com/apache/apisix/pull/10252
### Description
<!-- Please include a summary of the change and which issue is fixed. -->
<!-- Please also include relevant motivation and context. -->
Fixes # (issue)
### Checklist
- [ ] I have explained the need for this PR and the problem it solves
- [ ] I have explained the changes or the new features added to this PR
- [ ] I have added tests corresponding to this change
- [ ] I have updated the documentation to reflect this change
- [ ] I have verified that this change is backward compatible (If not, please discuss on the [APISIX mailing list](https://github.com/apache/apisix/tree/master#community) first)
<!--
Note
1. Mark the PR as draft until it's ready to be reviewed.
2. Always add/update tests for any changes unless you have a good reason.
3. Always update the documentation to reflect the changes made in the PR.
4. Make a new commit to resolve conversations instead of `push -f`.
5. To resolve merge conflicts, merge master instead of rebasing.
6. Use "request review" to notify the reviewer after making changes.
7. Only a reviewer can mark a conversation as resolved.
-->
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add jwe decrypt plugin [apisix]
Posted by "monkeyDluffy6017 (via GitHub)" <gi...@apache.org>.
monkeyDluffy6017 commented on code in PR #10252:
URL: https://github.com/apache/apisix/pull/10252#discussion_r1410367545
##########
t/plugin/jwe-decrypt.t:
##########
@@ -0,0 +1,400 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+use t::APISIX 'no_plan';
+
+repeat_each(2);
+no_long_string();
+no_root_location();
+no_shuffle();
+
+add_block_preprocessor(sub {
+ my ($block) = @_;
+
+ if (!defined $block->request) {
+ $block->set_value("request", "GET /t");
+ }
+});
+
+run_tests;
+
+__DATA__
+
+=== TEST 1: sanity
+--- config
+ location /t {
+ content_by_lua_block {
+ local plugin = require("apisix.plugins.jwe-decrypt")
+ local core = require("apisix.core")
+ local conf = {key = "123", secret = "12345678901234567890123456789012"}
+
+ local ok, err = plugin.check_schema(conf, core.schema.TYPE_CONSUMER)
+ if not ok then
+ ngx.say(err)
+ end
+
+ ngx.say(require("toolkit.json").encode(conf))
+ }
+ }
+--- response_body_like eval
+qr/{"key":"123","secret":"[a-zA-Z0-9+\\\/]+={0,2}"}/
+
+
+
+=== TEST 2: wrong type of string
+--- config
+ location /t {
+ content_by_lua_block {
+ local core = require("apisix.core")
+ local plugin = require("apisix.plugins.jwe-decrypt")
+ local ok, err = plugin.check_schema({key = 123, secret = "12345678901234567890123456789012"}, core.schema.TYPE_CONSUMER)
+ if not ok then
+ ngx.say(err)
+ end
+
+ ngx.say("done")
+ }
+ }
+--- response_body
+property "key" validation failed: wrong type: expected string, got number
+done
+
+
+
+=== TEST 3: wrong type of string
+--- config
+ location /t {
+ content_by_lua_block {
+ local core = require("apisix.core")
+ local plugin = require("apisix.plugins.jwe-decrypt")
+ local ok, err = plugin.check_schema({key = "123", secret = "123456"}, core.schema.TYPE_CONSUMER)
+ if not ok then
+ ngx.say(err)
+ end
+
+ ngx.say("done")
+ }
+ }
+--- response_body
+property "secret" validation failed: string too short, expected at least 32, got 6
+done
+
+
+
+=== TEST 4: add consumer with username and plugins
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/consumers',
+ ngx.HTTP_PUT,
+ [[{
+ "username": "jack",
+ "plugins": {
+ "jwe-decrypt": {
+ "key": "user-key",
+ "secret": "12345678901234567890123456789012",
+ "header": "Authorization",
+ "forward_header": "Authorization"
+ }
+ }
+ }]]
+ )
+
+ if code >= 300 then
+ ngx.status = code
+ end
+ ngx.say(body)
+ }
+ }
+--- response_body
+passed
+
+
+
+=== TEST 5: enable jwt auth plugin using admin api
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/routes/1',
+ ngx.HTTP_PUT,
+ [[{
+ "plugins": {
+ "jwe-decrypt": {
+ "header": "Authorization",
+ "forward_header": "Authorization"
+ }
+ },
+ "upstream": {
+ "nodes": {
+ "127.0.0.1:1980": 1
+ },
+ "type": "roundrobin"
+ },
+ "uri": "/hello"
+ }]]
+ )
+
+ if code >= 300 then
+ ngx.status = code
+ end
+ ngx.say(body)
+ }
+ }
+--- response_body
+passed
+
+
+
+=== TEST 6: create public API route (jwe-decrypt sign)
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/routes/2',
+ ngx.HTTP_PUT,
+ [[{
+ "plugins": {
+ "public-api": {}
+ },
+ "uri": "/apisix/plugin/jwe/encrypt"
+ }]]
+ )
+
+ if code >= 300 then
+ ngx.status = code
+ end
+ ngx.say(body)
+ }
+ }
+--- response_body
+passed
+
+
+
+=== TEST 7: sign / verify in argument
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, err, token = t('/apisix/plugin/jwe/encrypt?key=user-key&payload=hello',
+ ngx.HTTP_GET
+ )
+
+ if code > 200 then
+ ngx.status = code
+ ngx.say(err)
+ return
+ end
+
+ code, err, body = t('/hello',
+ ngx.HTTP_GET,
+ nil,
+ nil,
+ { Authorization = token }
+ )
+
+ ngx.print(body)
+ }
+ }
+--- response_body
+hello world
+
+
+
+=== TEST 8: test for unsupported method
+--- request
+PATCH /apisix/plugin/jwe/encrypt?key=user-key
+--- error_code: 404
+
+
+
+=== TEST 9: verify, missing token
+--- request
+GET /hello
+--- error_code: 403
+--- response_body
+{"message":"missing JWE token in request"}
+
+
+
+=== TEST 10: verify: invalid JWE token
+--- request
+GET /hello
+--- more_headers
+Authorization: invalid-eyJhbGciOiJkaXIiLCJraWQiOiJ1c2VyLWtleSIsImVuYyI6IkEyNTZHQ00ifQ..MTIzNDU2Nzg5MDEy.6JeRgm02rpOJdg.4nkSYJgwMKYgTeacatgmRw
+--- error_code: 400
+--- response_body
+{"message":"JWE token invalid"}
+
+
+
+=== TEST 11: verify (in header)
+--- request
+GET /hello
+--- more_headers
+Authorization: Bearer eyJhbGciOiJkaXIiLCJraWQiOiJ1c2VyLWtleSIsImVuYyI6IkEyNTZHQ00ifQ..MTIzNDU2Nzg5MDEy.6JeRgm02rpOJdg.4nkSYJgwMKYgTeacatgmRw
+--- response_body
+hello world
+
+
+
+=== TEST 12: verify (in header without Bearer)
+--- request
+GET /hello
+--- more_headers
+Authorization: eyJhbGciOiJkaXIiLCJraWQiOiJ1c2VyLWtleSIsImVuYyI6IkEyNTZHQ00ifQ..MTIzNDU2Nzg5MDEy.6JeRgm02rpOJdg.4nkSYJgwMKYgTeacatgmRw
+--- response_body
+hello world
+
+
+
+=== TEST 13: verify (header with bearer)
+--- request
+GET /hello
+--- more_headers
+Authorization: bearer eyJhbGciOiJkaXIiLCJraWQiOiJ1c2VyLWtleSIsImVuYyI6IkEyNTZHQ00ifQ..MTIzNDU2Nzg5MDEy.6JeRgm02rpOJdg.4nkSYJgwMKYgTeacatgmRw
+--- response_body
+hello world
+
+
+
+=== TEST 14: verify (invalid bearer token)
+--- request
+GET /hello
+--- more_headers
+Authorization: bearer invalid-eyJhbGciOiJkaXIiLCJraWQiOiJ1c2VyLWtleSIsImVuYyI6IkEyNTZHQ00ifQ..MTIzNDU2Nzg5MDEy.6JeRgm02rpOJdg.4nkSYJgwMKYgTeacatgmRw
+--- error_code: 400
+--- response_body
+{"message":"JWE token invalid"}
+
+
+
+=== TEST 15: delete a exist consumer
+--- config
+ location /t {
+ content_by_lua_block {
+ ngx.sleep(1)
Review Comment:
Why sleep here?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add jwe decrypt plugin [apisix]
Posted by "monkeyDluffy6017 (via GitHub)" <gi...@apache.org>.
monkeyDluffy6017 commented on code in PR #10252:
URL: https://github.com/apache/apisix/pull/10252#discussion_r1406985161
##########
apisix/plugins/jwe-decrypt.lua:
##########
@@ -0,0 +1,234 @@
+--
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License. You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+--
+local core = require("apisix.core")
+local consumer_mod = require("apisix.consumer")
+local base64 = require("ngx.base64")
+local ngx = ngx
+local sub_str = string.sub
+local plugin_name = "jwe-decrypt"
+local cipher = require("resty.openssl.cipher").new("aes-256-gcm")
+
+local schema = {
+ type = "object",
+ properties = {
+ header = {
+ type = "string",
+ default = "Authorization"
+ },
+ forward_header = {
+ type = "string",
+ default = "Authorization"
+ },
+ strict = {
+ type = "boolean",
+ default = true
+ }
+ },
+}
+
+local consumer_schema = {
+ type = "object",
+ -- can't use additionalProperties with dependencies
+ properties = {
+ key = { type = "string" },
+ secret = { type = "string", minLength = 32 },
+ base64_secret = { type = "boolean" },
+ },
+ required = { "key", "secret" },
+}
+
+
+local _M = {
+ version = 0.1,
+ priority = 2509,
+ type = 'auth',
+ name = plugin_name,
+ schema = schema,
+ consumer_schema = consumer_schema
+}
+
+
+function _M.check_schema(conf, schema_type)
+ core.log.info("input conf: ", core.json.delay_encode(conf))
+
+ local ok, err
+ if schema_type == core.schema.TYPE_CONSUMER then
+ ok, err = core.schema.check(consumer_schema, conf)
+ else
+ return core.schema.check(schema, conf)
Review Comment:
The code isn't this way before, it has been modified, so i will resolve this comment
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add jwe decrypt plugin [apisix]
Posted by "Revolyssup (via GitHub)" <gi...@apache.org>.
Revolyssup commented on code in PR #10252:
URL: https://github.com/apache/apisix/pull/10252#discussion_r1377058391
##########
t/plugin/jwe-decrypt.t:
##########
@@ -0,0 +1,392 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+use t::APISIX 'no_plan';
+
+repeat_each(2);
+no_long_string();
+no_root_location();
+no_shuffle();
+
+add_block_preprocessor(sub {
+ my ($block) = @_;
+
+ if (!defined $block->request) {
+ $block->set_value("request", "GET /t");
+ }
+});
+
+run_tests;
+
+__DATA__
+
+=== TEST 1: sanity
+--- config
+ location /t {
+ content_by_lua_block {
+ local plugin = require("apisix.plugins.jwe-decrypt")
+ local core = require("apisix.core")
+ local conf = {key = "123", secret = "12345678901234567890123456789012"}
+
+ local ok, err = plugin.check_schema(conf, core.schema.TYPE_CONSUMER)
+ if not ok then
+ ngx.say(err)
+ end
+
+ ngx.say(require("toolkit.json").encode(conf))
+ }
+ }
+--- response_body_like eval
+qr/{"key":"123","secret":"[a-zA-Z0-9+\\\/]+={0,2}"}/
+
+
+
+=== TEST 2: wrong type of string
+--- config
+ location /t {
+ content_by_lua_block {
+ local core = require("apisix.core")
+ local plugin = require("apisix.plugins.jwe-decrypt")
+ local ok, err = plugin.check_schema({key = 123, secret = "12345678901234567890123456789012"}, core.schema.TYPE_CONSUMER)
+ if not ok then
+ ngx.say(err)
+ end
+
+ ngx.say("done")
+ }
+ }
+--- response_body
+property "key" validation failed: wrong type: expected string, got number
+done
+
+
+
+=== TEST 3: wrong type of string
+--- config
+ location /t {
+ content_by_lua_block {
+ local core = require("apisix.core")
+ local plugin = require("apisix.plugins.jwe-decrypt")
+ local ok, err = plugin.check_schema({key = "123", secret = "123456"}, core.schema.TYPE_CONSUMER)
+ if not ok then
+ ngx.say(err)
+ end
+
+ ngx.say("done")
+ }
+ }
+--- response_body
+property "secret" validation failed: string too short, expected at least 32, got 6
+done
+
+
+
+=== TEST 4: add consumer with username and plugins
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/consumers',
+ ngx.HTTP_PUT,
+ [[{
+ "username": "jack",
+ "plugins": {
+ "jwe-decrypt": {
+ "key": "user-key",
+ "secret": "12345678901234567890123456789012"
+ }
+ }
+ }]]
+ )
+
+ if code >= 300 then
+ ngx.status = code
+ end
+ ngx.say(body)
+ }
+ }
+--- response_body
+passed
+
+
+
+=== TEST 5: enable jwt auth plugin using admin api
Review Comment:
@fishioon Did you mean to say "enable jwt-decrypt plugin" here?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add jwe decrypt plugin [apisix]
Posted by "monkeyDluffy6017 (via GitHub)" <gi...@apache.org>.
monkeyDluffy6017 commented on code in PR #10252:
URL: https://github.com/apache/apisix/pull/10252#discussion_r1381994989
##########
apisix/plugins/jwe-decrypt.lua:
##########
@@ -0,0 +1,234 @@
+--
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License. You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+--
+local core = require("apisix.core")
+local consumer_mod = require("apisix.consumer")
+local base64 = require("ngx.base64")
+local ngx = ngx
+local sub_str = string.sub
+local plugin_name = "jwe-decrypt"
+local cipher = require("resty.openssl.cipher").new("aes-256-gcm")
+
+local schema = {
+ type = "object",
+ properties = {
+ header = {
+ type = "string",
+ default = "Authorization"
+ },
+ forward_header = {
+ type = "string",
+ default = "Authorization"
+ },
+ strict = {
+ type = "boolean",
+ default = true
+ }
+ },
+}
+
+local consumer_schema = {
+ type = "object",
+ -- can't use additionalProperties with dependencies
+ properties = {
+ key = { type = "string" },
+ secret = { type = "string", minLength = 32 },
+ base64_secret = { type = "boolean" },
+ },
+ required = { "key", "secret" },
+}
+
+
+local _M = {
+ version = 0.1,
+ priority = 2509,
+ type = 'auth',
+ name = plugin_name,
+ schema = schema,
+ consumer_schema = consumer_schema
+}
+
+
+function _M.check_schema(conf, schema_type)
+ core.log.info("input conf: ", core.json.delay_encode(conf))
+
+ local ok, err
+ if schema_type == core.schema.TYPE_CONSUMER then
+ ok, err = core.schema.check(consumer_schema, conf)
+ else
+ return core.schema.check(schema, conf)
+ end
+
+ if not ok then
+ return false, err
+ end
+
+ return true
+end
+
+local function get_secret(conf)
+ local secret = conf.secret
+
+ if conf.base64_secret then
+ return base64.decode_base64(secret)
+ end
+
+ return secret
+end
+
Review Comment:
Two blanks are needed between functions, please make similar changes elsewhere
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add jwe decrypt plugin [apisix]
Posted by "kayx23 (via GitHub)" <gi...@apache.org>.
kayx23 commented on code in PR #10252:
URL: https://github.com/apache/apisix/pull/10252#discussion_r1377073022
##########
docs/en/latest/plugins/jwe-decrypt.md:
##########
@@ -0,0 +1,194 @@
+---
+title: jwe-decrypt
+keywords:
+ - Apache APISIX
+ - API Gateway
+ - Plugin
+ - JWE Decrypt
+ - jwe-decrypt
+description: This document contains information about the Apache APISIX jwe-decrypt Plugin.
+---
+
+<!--
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+-->
+
+## Description
+
+The `jwe-decrypt` Plugin is used to decrypt [JWE](https://datatracker.ietf.org/doc/html/rfc7516) authentication header to a [Service](../terminology/service.md) or a [Route](../terminology/route.md).
+
+A [Consumer](../terminology/consumer.md) of the service then needs to provide a key decrypt the request.
+
+## Attributes
+
+For Consumer:
+
+| Name | Type | Required | Default | Valid values | Description |
+|---------------|---------|-------------------------------------------------------|---------|-----------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| key | string | True | | | Unique key for a Consumer. |
+| secret | string | True | | | The decrypt key. This field supports saving the value in Secret Manager using the [APISIX Secret](../terminology/secret.md) resource. |
+| base64_secret | boolean | False | false | | Set to true if the secret is base64 encoded. |
+
+For Route:
+
+| Name | Type | Required | Default | Description |
+|--------|--------|----------|---------------|---------------------------------------------------------------------|
+| header | string | False | authorization | The header to get the token from. |
+| forward_header | string | False | authorization | Set the header name pass the plaintext to the Upstream. |
+
+## API
+
+This Plugin adds `/apisix/plugin/jwe/encrypt` as an endpoint.
+
+:::note
+
+You may need to use the [public-api](public-api.md) plugin to expose this endpoint.
Review Comment:
Not "you may", you do.
I think this info can be moved out of the admonition and just append it to the sentence above.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add jwe decrypt plugin [apisix]
Posted by "monkeyDluffy6017 (via GitHub)" <gi...@apache.org>.
monkeyDluffy6017 commented on code in PR #10252:
URL: https://github.com/apache/apisix/pull/10252#discussion_r1410369749
##########
t/plugin/jwe-decrypt.t:
##########
@@ -0,0 +1,400 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+use t::APISIX 'no_plan';
+
+repeat_each(2);
+no_long_string();
+no_root_location();
+no_shuffle();
+
+add_block_preprocessor(sub {
+ my ($block) = @_;
+
+ if (!defined $block->request) {
+ $block->set_value("request", "GET /t");
+ }
+});
+
+run_tests;
+
+__DATA__
+
+=== TEST 1: sanity
+--- config
+ location /t {
+ content_by_lua_block {
+ local plugin = require("apisix.plugins.jwe-decrypt")
+ local core = require("apisix.core")
+ local conf = {key = "123", secret = "12345678901234567890123456789012"}
+
+ local ok, err = plugin.check_schema(conf, core.schema.TYPE_CONSUMER)
+ if not ok then
+ ngx.say(err)
+ end
+
+ ngx.say(require("toolkit.json").encode(conf))
+ }
+ }
+--- response_body_like eval
+qr/{"key":"123","secret":"[a-zA-Z0-9+\\\/]+={0,2}"}/
+
+
+
+=== TEST 2: wrong type of string
+--- config
+ location /t {
+ content_by_lua_block {
+ local core = require("apisix.core")
+ local plugin = require("apisix.plugins.jwe-decrypt")
+ local ok, err = plugin.check_schema({key = 123, secret = "12345678901234567890123456789012"}, core.schema.TYPE_CONSUMER)
+ if not ok then
+ ngx.say(err)
+ end
+
+ ngx.say("done")
+ }
+ }
+--- response_body
+property "key" validation failed: wrong type: expected string, got number
+done
+
+
+
+=== TEST 3: wrong type of string
+--- config
+ location /t {
+ content_by_lua_block {
+ local core = require("apisix.core")
+ local plugin = require("apisix.plugins.jwe-decrypt")
+ local ok, err = plugin.check_schema({key = "123", secret = "123456"}, core.schema.TYPE_CONSUMER)
+ if not ok then
+ ngx.say(err)
+ end
+
+ ngx.say("done")
+ }
+ }
+--- response_body
+property "secret" validation failed: string too short, expected at least 32, got 6
+done
+
+
+
+=== TEST 4: add consumer with username and plugins
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/consumers',
+ ngx.HTTP_PUT,
+ [[{
+ "username": "jack",
+ "plugins": {
+ "jwe-decrypt": {
+ "key": "user-key",
+ "secret": "12345678901234567890123456789012",
+ "header": "Authorization",
+ "forward_header": "Authorization"
+ }
+ }
+ }]]
+ )
+
+ if code >= 300 then
+ ngx.status = code
+ end
+ ngx.say(body)
+ }
+ }
+--- response_body
+passed
+
+
+
+=== TEST 5: enable jwt auth plugin using admin api
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/routes/1',
+ ngx.HTTP_PUT,
+ [[{
+ "plugins": {
+ "jwe-decrypt": {
+ "header": "Authorization",
+ "forward_header": "Authorization"
+ }
+ },
+ "upstream": {
+ "nodes": {
+ "127.0.0.1:1980": 1
+ },
+ "type": "roundrobin"
+ },
+ "uri": "/hello"
+ }]]
+ )
+
+ if code >= 300 then
+ ngx.status = code
+ end
+ ngx.say(body)
+ }
+ }
+--- response_body
+passed
+
+
+
+=== TEST 6: create public API route (jwe-decrypt sign)
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/routes/2',
+ ngx.HTTP_PUT,
+ [[{
+ "plugins": {
+ "public-api": {}
+ },
+ "uri": "/apisix/plugin/jwe/encrypt"
+ }]]
+ )
+
+ if code >= 300 then
+ ngx.status = code
+ end
+ ngx.say(body)
+ }
+ }
+--- response_body
+passed
+
+
+
+=== TEST 7: sign / verify in argument
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, err, token = t('/apisix/plugin/jwe/encrypt?key=user-key&payload=hello',
+ ngx.HTTP_GET
+ )
+
+ if code > 200 then
+ ngx.status = code
+ ngx.say(err)
+ return
+ end
+
+ code, err, body = t('/hello',
+ ngx.HTTP_GET,
+ nil,
+ nil,
+ { Authorization = token }
+ )
+
+ ngx.print(body)
+ }
+ }
+--- response_body
+hello world
+
+
+
+=== TEST 8: test for unsupported method
+--- request
+PATCH /apisix/plugin/jwe/encrypt?key=user-key
+--- error_code: 404
+
+
+
+=== TEST 9: verify, missing token
+--- request
+GET /hello
+--- error_code: 403
+--- response_body
+{"message":"missing JWE token in request"}
+
+
+
+=== TEST 10: verify: invalid JWE token
+--- request
+GET /hello
+--- more_headers
+Authorization: invalid-eyJhbGciOiJkaXIiLCJraWQiOiJ1c2VyLWtleSIsImVuYyI6IkEyNTZHQ00ifQ..MTIzNDU2Nzg5MDEy.6JeRgm02rpOJdg.4nkSYJgwMKYgTeacatgmRw
+--- error_code: 400
+--- response_body
+{"message":"JWE token invalid"}
+
+
+
+=== TEST 11: verify (in header)
+--- request
+GET /hello
+--- more_headers
+Authorization: Bearer eyJhbGciOiJkaXIiLCJraWQiOiJ1c2VyLWtleSIsImVuYyI6IkEyNTZHQ00ifQ..MTIzNDU2Nzg5MDEy.6JeRgm02rpOJdg.4nkSYJgwMKYgTeacatgmRw
+--- response_body
+hello world
+
+
+
+=== TEST 12: verify (in header without Bearer)
+--- request
+GET /hello
+--- more_headers
+Authorization: eyJhbGciOiJkaXIiLCJraWQiOiJ1c2VyLWtleSIsImVuYyI6IkEyNTZHQ00ifQ..MTIzNDU2Nzg5MDEy.6JeRgm02rpOJdg.4nkSYJgwMKYgTeacatgmRw
+--- response_body
+hello world
+
+
+
+=== TEST 13: verify (header with bearer)
+--- request
+GET /hello
+--- more_headers
+Authorization: bearer eyJhbGciOiJkaXIiLCJraWQiOiJ1c2VyLWtleSIsImVuYyI6IkEyNTZHQ00ifQ..MTIzNDU2Nzg5MDEy.6JeRgm02rpOJdg.4nkSYJgwMKYgTeacatgmRw
+--- response_body
+hello world
+
+
+
+=== TEST 14: verify (invalid bearer token)
+--- request
+GET /hello
+--- more_headers
+Authorization: bearer invalid-eyJhbGciOiJkaXIiLCJraWQiOiJ1c2VyLWtleSIsImVuYyI6IkEyNTZHQ00ifQ..MTIzNDU2Nzg5MDEy.6JeRgm02rpOJdg.4nkSYJgwMKYgTeacatgmRw
+--- error_code: 400
+--- response_body
+{"message":"JWE token invalid"}
+
+
+
+=== TEST 15: delete a exist consumer
+--- config
+ location /t {
+ content_by_lua_block {
+ ngx.sleep(1)
+
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/consumers',
+ ngx.HTTP_PUT,
+ [[{
+ "username": "jack",
+ "plugins": {
+ "jwe-decrypt": {
+ "key": "user-key",
+ "secret": "12345678901234567890123456789012"
+ }
+ }
+ }]]
+ )
+ ngx.say("code: ", code < 300, " body: ", body)
+
+ code, body = t('/apisix/admin/consumers',
+ ngx.HTTP_PUT,
+ [[{
+ "username": "chen",
+ "plugins": {
+ "jwe-decrypt": {
+ "key": "chen-key",
+ "secret": "12345678901234567890123456789021"
+ }
+ }
+ }]]
+ )
+ ngx.say("code: ", code < 300, " body: ", body)
+
+ code, body = t('/apisix/admin/consumers/jack',
+ ngx.HTTP_DELETE)
+ ngx.say("code: ", code < 300, " body: ", body)
+
+ ngx.sleep(1)
Review Comment:
Why sleep?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add jwe decrypt plugin [apisix]
Posted by "moonming (via GitHub)" <gi...@apache.org>.
moonming commented on PR #10252:
URL: https://github.com/apache/apisix/pull/10252#issuecomment-1807378386
@fishioon do you have time to fix comments?
@monkeyDluffy6017 can we merge this PR first then create a new to fix comments?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add jwe decrypt plugin [apisix]
Posted by "fishioon (via GitHub)" <gi...@apache.org>.
fishioon commented on PR #10252:
URL: https://github.com/apache/apisix/pull/10252#issuecomment-1807489990
> @fishioon do you have time to fix comments? @monkeyDluffy6017 can we merge this PR first then create a new to fix comments?
OK, fix them tonight.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add jwe decrypt plugin [apisix]
Posted by "monkeyDluffy6017 (via GitHub)" <gi...@apache.org>.
monkeyDluffy6017 commented on PR #10252:
URL: https://github.com/apache/apisix/pull/10252#issuecomment-1751588661
Good job! please make the ci pass, thanks!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add jwe decrypt plugin [apisix]
Posted by "monkeyDluffy6017 (via GitHub)" <gi...@apache.org>.
monkeyDluffy6017 commented on code in PR #10252:
URL: https://github.com/apache/apisix/pull/10252#discussion_r1410275714
##########
apisix/plugins/jwe-decrypt.lua:
##########
@@ -0,0 +1,250 @@
+--
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License. You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+--
+local core = require("apisix.core")
+local consumer_mod = require("apisix.consumer")
+local base64 = require("ngx.base64")
+local aes = require("resty.aes")
+local ngx = ngx
+local sub_str = string.sub
+local cipher = aes.cipher(256, "gcm")
+
+local plugin_name = "jwe-decrypt"
+
+local schema = {
+ type = "object",
+ properties = {
+ header = {
+ type = "string",
+ default = "Authorization"
+ },
+ forward_header = {
+ type = "string",
+ default = "Authorization"
+ },
+ strict = {
+ type = "boolean",
+ default = true
+ }
+ },
+ required = { "header", "forward_header" },
+}
+
+local consumer_schema = {
+ type = "object",
+ properties = {
+ key = { type = "string" },
+ secret = { type = "string", minLength = 32 },
+ is_base64_encoded = { type = "boolean" },
Review Comment:
```suggestion
is_base64_encoded = { type = "boolean" },
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add jwe decrypt plugin [apisix]
Posted by "monkeyDluffy6017 (via GitHub)" <gi...@apache.org>.
monkeyDluffy6017 commented on code in PR #10252:
URL: https://github.com/apache/apisix/pull/10252#discussion_r1410356281
##########
t/plugin/jwe-decrypt.t:
##########
@@ -0,0 +1,400 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+use t::APISIX 'no_plan';
+
+repeat_each(2);
+no_long_string();
+no_root_location();
+no_shuffle();
+
+add_block_preprocessor(sub {
+ my ($block) = @_;
+
+ if (!defined $block->request) {
+ $block->set_value("request", "GET /t");
+ }
+});
+
+run_tests;
+
+__DATA__
+
+=== TEST 1: sanity
+--- config
+ location /t {
+ content_by_lua_block {
+ local plugin = require("apisix.plugins.jwe-decrypt")
+ local core = require("apisix.core")
+ local conf = {key = "123", secret = "12345678901234567890123456789012"}
+
+ local ok, err = plugin.check_schema(conf, core.schema.TYPE_CONSUMER)
+ if not ok then
+ ngx.say(err)
+ end
+
+ ngx.say(require("toolkit.json").encode(conf))
+ }
+ }
+--- response_body_like eval
+qr/{"key":"123","secret":"[a-zA-Z0-9+\\\/]+={0,2}"}/
+
+
+
+=== TEST 2: wrong type of string
+--- config
+ location /t {
+ content_by_lua_block {
+ local core = require("apisix.core")
+ local plugin = require("apisix.plugins.jwe-decrypt")
+ local ok, err = plugin.check_schema({key = 123, secret = "12345678901234567890123456789012"}, core.schema.TYPE_CONSUMER)
+ if not ok then
+ ngx.say(err)
+ end
+
+ ngx.say("done")
+ }
+ }
+--- response_body
+property "key" validation failed: wrong type: expected string, got number
+done
+
+
+
+=== TEST 3: wrong type of string
+--- config
+ location /t {
+ content_by_lua_block {
+ local core = require("apisix.core")
+ local plugin = require("apisix.plugins.jwe-decrypt")
+ local ok, err = plugin.check_schema({key = "123", secret = "123456"}, core.schema.TYPE_CONSUMER)
+ if not ok then
+ ngx.say(err)
+ end
+
+ ngx.say("done")
+ }
+ }
+--- response_body
+property "secret" validation failed: string too short, expected at least 32, got 6
+done
+
+
+
+=== TEST 4: add consumer with username and plugins
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/consumers',
+ ngx.HTTP_PUT,
+ [[{
+ "username": "jack",
+ "plugins": {
+ "jwe-decrypt": {
+ "key": "user-key",
+ "secret": "12345678901234567890123456789012",
+ "header": "Authorization",
+ "forward_header": "Authorization"
Review Comment:
Why do yo set `header` and `forward_header` here? it's supposed to set on `routes`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add jwe decrypt plugin [apisix]
Posted by "monkeyDluffy6017 (via GitHub)" <gi...@apache.org>.
monkeyDluffy6017 commented on code in PR #10252:
URL: https://github.com/apache/apisix/pull/10252#discussion_r1381992172
##########
apisix/plugins/jwe-decrypt.lua:
##########
@@ -0,0 +1,234 @@
+--
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License. You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+--
+local core = require("apisix.core")
+local consumer_mod = require("apisix.consumer")
+local base64 = require("ngx.base64")
+local ngx = ngx
+local sub_str = string.sub
+local plugin_name = "jwe-decrypt"
+local cipher = require("resty.openssl.cipher").new("aes-256-gcm")
+
+local schema = {
+ type = "object",
+ properties = {
+ header = {
+ type = "string",
+ default = "Authorization"
+ },
+ forward_header = {
+ type = "string",
+ default = "Authorization"
+ },
+ strict = {
+ type = "boolean",
+ default = true
+ }
+ },
+}
+
+local consumer_schema = {
+ type = "object",
+ -- can't use additionalProperties with dependencies
+ properties = {
+ key = { type = "string" },
+ secret = { type = "string", minLength = 32 },
+ base64_secret = { type = "boolean" },
+ },
+ required = { "key", "secret" },
+}
+
+
+local _M = {
+ version = 0.1,
+ priority = 2509,
+ type = 'auth',
+ name = plugin_name,
+ schema = schema,
+ consumer_schema = consumer_schema
+}
+
+
+function _M.check_schema(conf, schema_type)
+ core.log.info("input conf: ", core.json.delay_encode(conf))
+
+ local ok, err
+ if schema_type == core.schema.TYPE_CONSUMER then
+ ok, err = core.schema.check(consumer_schema, conf)
+ else
+ return core.schema.check(schema, conf)
Review Comment:
It is very strange here, how about `ok, err = core.schema.check(schema, conf)`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add jwe decrypt plugin [apisix]
Posted by "shreemaan-abhishek (via GitHub)" <gi...@apache.org>.
shreemaan-abhishek commented on code in PR #10252:
URL: https://github.com/apache/apisix/pull/10252#discussion_r1404764972
##########
apisix/plugins/jwe-decrypt.lua:
##########
@@ -0,0 +1,234 @@
+--
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License. You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+--
+local core = require("apisix.core")
+local consumer_mod = require("apisix.consumer")
+local base64 = require("ngx.base64")
+local ngx = ngx
+local sub_str = string.sub
+local plugin_name = "jwe-decrypt"
+local cipher = require("resty.openssl.cipher").new("aes-256-gcm")
Review Comment:
Is there any issue in using the current method?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add jwe decrypt plugin [apisix]
Posted by "kayx23 (via GitHub)" <gi...@apache.org>.
kayx23 commented on PR #10252:
URL: https://github.com/apache/apisix/pull/10252#issuecomment-1825193933
Updated the doc in the last commit. Reviewers please take a look as well to see if any comments. Thanks.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add jwe decrypt plugin [apisix]
Posted by "monkeyDluffy6017 (via GitHub)" <gi...@apache.org>.
monkeyDluffy6017 commented on PR #10252:
URL: https://github.com/apache/apisix/pull/10252#issuecomment-1759269971
@fishioon please make the ci pass
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add jwe decrypt plugin [apisix]
Posted by "monkeyDluffy6017 (via GitHub)" <gi...@apache.org>.
monkeyDluffy6017 commented on code in PR #10252:
URL: https://github.com/apache/apisix/pull/10252#discussion_r1381979739
##########
apisix/plugins/jwe-decrypt.lua:
##########
@@ -0,0 +1,234 @@
+--
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License. You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+--
+local core = require("apisix.core")
+local consumer_mod = require("apisix.consumer")
+local base64 = require("ngx.base64")
+local ngx = ngx
+local sub_str = string.sub
+local plugin_name = "jwe-decrypt"
+local cipher = require("resty.openssl.cipher").new("aes-256-gcm")
+
+local schema = {
+ type = "object",
+ properties = {
+ header = {
+ type = "string",
+ default = "Authorization"
+ },
+ forward_header = {
+ type = "string",
+ default = "Authorization"
+ },
+ strict = {
+ type = "boolean",
+ default = true
+ }
+ },
+}
+
+local consumer_schema = {
+ type = "object",
+ -- can't use additionalProperties with dependencies
Review Comment:
remove this comment
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add jwe decrypt plugin [apisix]
Posted by "shreemaan-abhishek (via GitHub)" <gi...@apache.org>.
shreemaan-abhishek commented on PR #10252:
URL: https://github.com/apache/apisix/pull/10252#issuecomment-1820442564
sure
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add jwe decrypt plugin [apisix]
Posted by "monkeyDluffy6017 (via GitHub)" <gi...@apache.org>.
monkeyDluffy6017 commented on code in PR #10252:
URL: https://github.com/apache/apisix/pull/10252#discussion_r1410372257
##########
t/plugin/jwe-decrypt.t:
##########
@@ -0,0 +1,400 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+use t::APISIX 'no_plan';
+
+repeat_each(2);
+no_long_string();
+no_root_location();
+no_shuffle();
+
+add_block_preprocessor(sub {
+ my ($block) = @_;
+
+ if (!defined $block->request) {
+ $block->set_value("request", "GET /t");
+ }
+});
+
+run_tests;
+
+__DATA__
+
+=== TEST 1: sanity
+--- config
+ location /t {
+ content_by_lua_block {
+ local plugin = require("apisix.plugins.jwe-decrypt")
+ local core = require("apisix.core")
+ local conf = {key = "123", secret = "12345678901234567890123456789012"}
+
+ local ok, err = plugin.check_schema(conf, core.schema.TYPE_CONSUMER)
+ if not ok then
+ ngx.say(err)
+ end
+
+ ngx.say(require("toolkit.json").encode(conf))
+ }
+ }
+--- response_body_like eval
+qr/{"key":"123","secret":"[a-zA-Z0-9+\\\/]+={0,2}"}/
+
+
+
+=== TEST 2: wrong type of string
+--- config
+ location /t {
+ content_by_lua_block {
+ local core = require("apisix.core")
+ local plugin = require("apisix.plugins.jwe-decrypt")
+ local ok, err = plugin.check_schema({key = 123, secret = "12345678901234567890123456789012"}, core.schema.TYPE_CONSUMER)
+ if not ok then
+ ngx.say(err)
+ end
+
+ ngx.say("done")
+ }
+ }
+--- response_body
+property "key" validation failed: wrong type: expected string, got number
+done
+
+
+
+=== TEST 3: wrong type of string
+--- config
+ location /t {
+ content_by_lua_block {
+ local core = require("apisix.core")
+ local plugin = require("apisix.plugins.jwe-decrypt")
+ local ok, err = plugin.check_schema({key = "123", secret = "123456"}, core.schema.TYPE_CONSUMER)
+ if not ok then
+ ngx.say(err)
+ end
+
+ ngx.say("done")
+ }
+ }
+--- response_body
+property "secret" validation failed: string too short, expected at least 32, got 6
+done
+
+
+
+=== TEST 4: add consumer with username and plugins
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/consumers',
+ ngx.HTTP_PUT,
+ [[{
+ "username": "jack",
+ "plugins": {
+ "jwe-decrypt": {
+ "key": "user-key",
+ "secret": "12345678901234567890123456789012",
+ "header": "Authorization",
+ "forward_header": "Authorization"
+ }
+ }
+ }]]
+ )
+
+ if code >= 300 then
+ ngx.status = code
+ end
+ ngx.say(body)
+ }
+ }
+--- response_body
+passed
+
+
+
+=== TEST 5: enable jwt auth plugin using admin api
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/routes/1',
+ ngx.HTTP_PUT,
+ [[{
+ "plugins": {
+ "jwe-decrypt": {
+ "header": "Authorization",
+ "forward_header": "Authorization"
+ }
+ },
+ "upstream": {
+ "nodes": {
+ "127.0.0.1:1980": 1
+ },
+ "type": "roundrobin"
+ },
+ "uri": "/hello"
+ }]]
+ )
+
+ if code >= 300 then
+ ngx.status = code
+ end
+ ngx.say(body)
+ }
+ }
+--- response_body
+passed
+
+
+
+=== TEST 6: create public API route (jwe-decrypt sign)
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/routes/2',
+ ngx.HTTP_PUT,
+ [[{
+ "plugins": {
+ "public-api": {}
+ },
+ "uri": "/apisix/plugin/jwe/encrypt"
+ }]]
+ )
+
+ if code >= 300 then
+ ngx.status = code
+ end
+ ngx.say(body)
+ }
+ }
+--- response_body
+passed
+
+
+
+=== TEST 7: sign / verify in argument
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, err, token = t('/apisix/plugin/jwe/encrypt?key=user-key&payload=hello',
+ ngx.HTTP_GET
+ )
+
+ if code > 200 then
+ ngx.status = code
+ ngx.say(err)
+ return
+ end
+
+ code, err, body = t('/hello',
+ ngx.HTTP_GET,
+ nil,
+ nil,
+ { Authorization = token }
+ )
+
+ ngx.print(body)
+ }
+ }
+--- response_body
+hello world
+
+
+
+=== TEST 8: test for unsupported method
+--- request
+PATCH /apisix/plugin/jwe/encrypt?key=user-key
+--- error_code: 404
+
+
+
+=== TEST 9: verify, missing token
+--- request
+GET /hello
+--- error_code: 403
+--- response_body
+{"message":"missing JWE token in request"}
+
+
+
+=== TEST 10: verify: invalid JWE token
+--- request
+GET /hello
+--- more_headers
+Authorization: invalid-eyJhbGciOiJkaXIiLCJraWQiOiJ1c2VyLWtleSIsImVuYyI6IkEyNTZHQ00ifQ..MTIzNDU2Nzg5MDEy.6JeRgm02rpOJdg.4nkSYJgwMKYgTeacatgmRw
+--- error_code: 400
+--- response_body
+{"message":"JWE token invalid"}
+
+
+
+=== TEST 11: verify (in header)
+--- request
+GET /hello
+--- more_headers
+Authorization: Bearer eyJhbGciOiJkaXIiLCJraWQiOiJ1c2VyLWtleSIsImVuYyI6IkEyNTZHQ00ifQ..MTIzNDU2Nzg5MDEy.6JeRgm02rpOJdg.4nkSYJgwMKYgTeacatgmRw
+--- response_body
+hello world
+
+
+
+=== TEST 12: verify (in header without Bearer)
+--- request
+GET /hello
+--- more_headers
+Authorization: eyJhbGciOiJkaXIiLCJraWQiOiJ1c2VyLWtleSIsImVuYyI6IkEyNTZHQ00ifQ..MTIzNDU2Nzg5MDEy.6JeRgm02rpOJdg.4nkSYJgwMKYgTeacatgmRw
+--- response_body
+hello world
+
+
+
+=== TEST 13: verify (header with bearer)
+--- request
+GET /hello
+--- more_headers
+Authorization: bearer eyJhbGciOiJkaXIiLCJraWQiOiJ1c2VyLWtleSIsImVuYyI6IkEyNTZHQ00ifQ..MTIzNDU2Nzg5MDEy.6JeRgm02rpOJdg.4nkSYJgwMKYgTeacatgmRw
+--- response_body
+hello world
+
+
+
+=== TEST 14: verify (invalid bearer token)
+--- request
+GET /hello
+--- more_headers
+Authorization: bearer invalid-eyJhbGciOiJkaXIiLCJraWQiOiJ1c2VyLWtleSIsImVuYyI6IkEyNTZHQ00ifQ..MTIzNDU2Nzg5MDEy.6JeRgm02rpOJdg.4nkSYJgwMKYgTeacatgmRw
+--- error_code: 400
+--- response_body
+{"message":"JWE token invalid"}
+
+
+
+=== TEST 15: delete a exist consumer
+--- config
+ location /t {
+ content_by_lua_block {
+ ngx.sleep(1)
+
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/consumers',
+ ngx.HTTP_PUT,
+ [[{
+ "username": "jack",
+ "plugins": {
+ "jwe-decrypt": {
+ "key": "user-key",
+ "secret": "12345678901234567890123456789012"
+ }
+ }
+ }]]
+ )
+ ngx.say("code: ", code < 300, " body: ", body)
+
+ code, body = t('/apisix/admin/consumers',
+ ngx.HTTP_PUT,
+ [[{
+ "username": "chen",
+ "plugins": {
+ "jwe-decrypt": {
+ "key": "chen-key",
+ "secret": "12345678901234567890123456789021"
+ }
+ }
+ }]]
+ )
+ ngx.say("code: ", code < 300, " body: ", body)
+
+ code, body = t('/apisix/admin/consumers/jack',
+ ngx.HTTP_DELETE)
+ ngx.say("code: ", code < 300, " body: ", body)
+
+ ngx.sleep(1)
+ code, body = t('/apisix/plugin/jwe/encrypt?key=chen-key&payload=hello',
+ ngx.HTTP_GET)
+ ngx.say("code: ", code < 300, " body: ", body)
+ }
+ }
+--- response_body
+code: true body: passed
+code: true body: passed
+code: true body: passed
+code: true body: passed
+
+
+
+=== TEST 16: add consumer with username and plugins with base64 secret
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/consumers',
+ ngx.HTTP_PUT,
+ [[{
+ "username": "jack",
+ "plugins": {
+ "jwe-decrypt": {
+ "key": "user-key",
+ "secret": "fo4XKdZ1xSrIZyms4q2BwPrW5lMpls9qqy5tiAk2esc=",
+ " is_base64_encoded": true
+ }
+ }
+ }]]
+ )
+
+ if code >= 300 then
+ ngx.status = code
+ end
+ ngx.say(body)
+ }
+ }
+--- response_body
+passed
+
+
+
+=== TEST 17: enable jwt auth plugin with base64 secret
Review Comment:
```suggestion
=== TEST 17: enable jwt decrypt plugin with base64 secret
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add jwe decrypt plugin [apisix]
Posted by "monkeyDluffy6017 (via GitHub)" <gi...@apache.org>.
monkeyDluffy6017 commented on code in PR #10252:
URL: https://github.com/apache/apisix/pull/10252#discussion_r1410370793
##########
t/plugin/jwe-decrypt.t:
##########
@@ -0,0 +1,400 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+use t::APISIX 'no_plan';
+
+repeat_each(2);
+no_long_string();
+no_root_location();
+no_shuffle();
+
+add_block_preprocessor(sub {
+ my ($block) = @_;
+
+ if (!defined $block->request) {
+ $block->set_value("request", "GET /t");
+ }
+});
+
+run_tests;
+
+__DATA__
+
+=== TEST 1: sanity
+--- config
+ location /t {
+ content_by_lua_block {
+ local plugin = require("apisix.plugins.jwe-decrypt")
+ local core = require("apisix.core")
+ local conf = {key = "123", secret = "12345678901234567890123456789012"}
+
+ local ok, err = plugin.check_schema(conf, core.schema.TYPE_CONSUMER)
+ if not ok then
+ ngx.say(err)
+ end
+
+ ngx.say(require("toolkit.json").encode(conf))
+ }
+ }
+--- response_body_like eval
+qr/{"key":"123","secret":"[a-zA-Z0-9+\\\/]+={0,2}"}/
+
+
+
+=== TEST 2: wrong type of string
+--- config
+ location /t {
+ content_by_lua_block {
+ local core = require("apisix.core")
+ local plugin = require("apisix.plugins.jwe-decrypt")
+ local ok, err = plugin.check_schema({key = 123, secret = "12345678901234567890123456789012"}, core.schema.TYPE_CONSUMER)
+ if not ok then
+ ngx.say(err)
+ end
+
+ ngx.say("done")
+ }
+ }
+--- response_body
+property "key" validation failed: wrong type: expected string, got number
+done
+
+
+
+=== TEST 3: wrong type of string
+--- config
+ location /t {
+ content_by_lua_block {
+ local core = require("apisix.core")
+ local plugin = require("apisix.plugins.jwe-decrypt")
+ local ok, err = plugin.check_schema({key = "123", secret = "123456"}, core.schema.TYPE_CONSUMER)
+ if not ok then
+ ngx.say(err)
+ end
+
+ ngx.say("done")
+ }
+ }
+--- response_body
+property "secret" validation failed: string too short, expected at least 32, got 6
+done
+
+
+
+=== TEST 4: add consumer with username and plugins
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/consumers',
+ ngx.HTTP_PUT,
+ [[{
+ "username": "jack",
+ "plugins": {
+ "jwe-decrypt": {
+ "key": "user-key",
+ "secret": "12345678901234567890123456789012",
+ "header": "Authorization",
+ "forward_header": "Authorization"
+ }
+ }
+ }]]
+ )
+
+ if code >= 300 then
+ ngx.status = code
+ end
+ ngx.say(body)
+ }
+ }
+--- response_body
+passed
+
+
+
+=== TEST 5: enable jwt auth plugin using admin api
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/routes/1',
+ ngx.HTTP_PUT,
+ [[{
+ "plugins": {
+ "jwe-decrypt": {
+ "header": "Authorization",
+ "forward_header": "Authorization"
+ }
+ },
+ "upstream": {
+ "nodes": {
+ "127.0.0.1:1980": 1
+ },
+ "type": "roundrobin"
+ },
+ "uri": "/hello"
+ }]]
+ )
+
+ if code >= 300 then
+ ngx.status = code
+ end
+ ngx.say(body)
+ }
+ }
+--- response_body
+passed
+
+
+
+=== TEST 6: create public API route (jwe-decrypt sign)
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/routes/2',
+ ngx.HTTP_PUT,
+ [[{
+ "plugins": {
+ "public-api": {}
+ },
+ "uri": "/apisix/plugin/jwe/encrypt"
+ }]]
+ )
+
+ if code >= 300 then
+ ngx.status = code
+ end
+ ngx.say(body)
+ }
+ }
+--- response_body
+passed
+
+
+
+=== TEST 7: sign / verify in argument
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, err, token = t('/apisix/plugin/jwe/encrypt?key=user-key&payload=hello',
+ ngx.HTTP_GET
+ )
+
+ if code > 200 then
+ ngx.status = code
+ ngx.say(err)
+ return
+ end
+
+ code, err, body = t('/hello',
+ ngx.HTTP_GET,
+ nil,
+ nil,
+ { Authorization = token }
+ )
+
+ ngx.print(body)
+ }
+ }
+--- response_body
+hello world
+
+
+
+=== TEST 8: test for unsupported method
+--- request
+PATCH /apisix/plugin/jwe/encrypt?key=user-key
+--- error_code: 404
+
+
+
+=== TEST 9: verify, missing token
+--- request
+GET /hello
+--- error_code: 403
+--- response_body
+{"message":"missing JWE token in request"}
+
+
+
+=== TEST 10: verify: invalid JWE token
+--- request
+GET /hello
+--- more_headers
+Authorization: invalid-eyJhbGciOiJkaXIiLCJraWQiOiJ1c2VyLWtleSIsImVuYyI6IkEyNTZHQ00ifQ..MTIzNDU2Nzg5MDEy.6JeRgm02rpOJdg.4nkSYJgwMKYgTeacatgmRw
+--- error_code: 400
+--- response_body
+{"message":"JWE token invalid"}
+
+
+
+=== TEST 11: verify (in header)
+--- request
+GET /hello
+--- more_headers
+Authorization: Bearer eyJhbGciOiJkaXIiLCJraWQiOiJ1c2VyLWtleSIsImVuYyI6IkEyNTZHQ00ifQ..MTIzNDU2Nzg5MDEy.6JeRgm02rpOJdg.4nkSYJgwMKYgTeacatgmRw
+--- response_body
+hello world
+
+
+
+=== TEST 12: verify (in header without Bearer)
+--- request
+GET /hello
+--- more_headers
+Authorization: eyJhbGciOiJkaXIiLCJraWQiOiJ1c2VyLWtleSIsImVuYyI6IkEyNTZHQ00ifQ..MTIzNDU2Nzg5MDEy.6JeRgm02rpOJdg.4nkSYJgwMKYgTeacatgmRw
+--- response_body
+hello world
+
+
+
+=== TEST 13: verify (header with bearer)
+--- request
+GET /hello
+--- more_headers
+Authorization: bearer eyJhbGciOiJkaXIiLCJraWQiOiJ1c2VyLWtleSIsImVuYyI6IkEyNTZHQ00ifQ..MTIzNDU2Nzg5MDEy.6JeRgm02rpOJdg.4nkSYJgwMKYgTeacatgmRw
+--- response_body
+hello world
+
+
+
+=== TEST 14: verify (invalid bearer token)
+--- request
+GET /hello
+--- more_headers
+Authorization: bearer invalid-eyJhbGciOiJkaXIiLCJraWQiOiJ1c2VyLWtleSIsImVuYyI6IkEyNTZHQ00ifQ..MTIzNDU2Nzg5MDEy.6JeRgm02rpOJdg.4nkSYJgwMKYgTeacatgmRw
+--- error_code: 400
+--- response_body
+{"message":"JWE token invalid"}
+
+
+
+=== TEST 15: delete a exist consumer
+--- config
+ location /t {
+ content_by_lua_block {
+ ngx.sleep(1)
+
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/consumers',
+ ngx.HTTP_PUT,
+ [[{
+ "username": "jack",
+ "plugins": {
+ "jwe-decrypt": {
+ "key": "user-key",
+ "secret": "12345678901234567890123456789012"
+ }
+ }
+ }]]
+ )
+ ngx.say("code: ", code < 300, " body: ", body)
+
+ code, body = t('/apisix/admin/consumers',
+ ngx.HTTP_PUT,
+ [[{
+ "username": "chen",
+ "plugins": {
+ "jwe-decrypt": {
+ "key": "chen-key",
+ "secret": "12345678901234567890123456789021"
+ }
+ }
+ }]]
+ )
+ ngx.say("code: ", code < 300, " body: ", body)
+
+ code, body = t('/apisix/admin/consumers/jack',
+ ngx.HTTP_DELETE)
+ ngx.say("code: ", code < 300, " body: ", body)
+
+ ngx.sleep(1)
+ code, body = t('/apisix/plugin/jwe/encrypt?key=chen-key&payload=hello',
+ ngx.HTTP_GET)
+ ngx.say("code: ", code < 300, " body: ", body)
+ }
+ }
+--- response_body
+code: true body: passed
+code: true body: passed
+code: true body: passed
+code: true body: passed
+
+
+
+=== TEST 16: add consumer with username and plugins with base64 secret
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/consumers',
+ ngx.HTTP_PUT,
+ [[{
+ "username": "jack",
+ "plugins": {
+ "jwe-decrypt": {
+ "key": "user-key",
+ "secret": "fo4XKdZ1xSrIZyms4q2BwPrW5lMpls9qqy5tiAk2esc=",
+ " is_base64_encoded": true
Review Comment:
```suggestion
"is_base64_encoded": true
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add jwe decrypt plugin [apisix]
Posted by "monkeyDluffy6017 (via GitHub)" <gi...@apache.org>.
monkeyDluffy6017 commented on code in PR #10252:
URL: https://github.com/apache/apisix/pull/10252#discussion_r1381421624
##########
apisix/plugins/jwe-decrypt.lua:
##########
@@ -0,0 +1,234 @@
+--
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License. You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+--
+local core = require("apisix.core")
+local consumer_mod = require("apisix.consumer")
+local base64 = require("ngx.base64")
+local ngx = ngx
+local sub_str = string.sub
+local plugin_name = "jwe-decrypt"
Review Comment:
The plugin name are best placed after the `require` block and before the schema
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add jwe decrypt plugin [apisix]
Posted by "monkeyDluffy6017 (via GitHub)" <gi...@apache.org>.
monkeyDluffy6017 commented on code in PR #10252:
URL: https://github.com/apache/apisix/pull/10252#discussion_r1382016749
##########
apisix/plugins/jwe-decrypt.lua:
##########
@@ -0,0 +1,234 @@
+--
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License. You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+--
+local core = require("apisix.core")
+local consumer_mod = require("apisix.consumer")
+local base64 = require("ngx.base64")
+local ngx = ngx
+local sub_str = string.sub
+local plugin_name = "jwe-decrypt"
+local cipher = require("resty.openssl.cipher").new("aes-256-gcm")
+
+local schema = {
+ type = "object",
+ properties = {
+ header = {
+ type = "string",
+ default = "Authorization"
+ },
+ forward_header = {
+ type = "string",
Review Comment:
The `header` and `forward_header` should be required
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add jwe decrypt plugin [apisix]
Posted by "monkeyDluffy6017 (via GitHub)" <gi...@apache.org>.
monkeyDluffy6017 commented on code in PR #10252:
URL: https://github.com/apache/apisix/pull/10252#discussion_r1381980960
##########
apisix/plugins/jwe-decrypt.lua:
##########
@@ -0,0 +1,234 @@
+--
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License. You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+--
+local core = require("apisix.core")
+local consumer_mod = require("apisix.consumer")
+local base64 = require("ngx.base64")
+local ngx = ngx
+local sub_str = string.sub
+local plugin_name = "jwe-decrypt"
+local cipher = require("resty.openssl.cipher").new("aes-256-gcm")
+
+local schema = {
+ type = "object",
+ properties = {
+ header = {
Review Comment:
Four indent is required, please pay attention to other places
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add jwe decrypt plugin [apisix]
Posted by "monkeyDluffy6017 (via GitHub)" <gi...@apache.org>.
monkeyDluffy6017 commented on PR #10252:
URL: https://github.com/apache/apisix/pull/10252#issuecomment-1769796046
Thanks for you contribution! We will check this pr later
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add jwe decrypt plugin [apisix]
Posted by "shreemaan-abhishek (via GitHub)" <gi...@apache.org>.
shreemaan-abhishek commented on code in PR #10252:
URL: https://github.com/apache/apisix/pull/10252#discussion_r1363405717
##########
apisix/plugins/jwe-decrypt.lua:
##########
@@ -0,0 +1,234 @@
+--
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License. You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+--
+local core = require("apisix.core")
+local consumer_mod = require("apisix.consumer")
+local base64 = require("ngx.base64")
+local ngx = ngx
+local sub_str = string.sub
+local plugin_name = "jwe-decrypt"
+local cipher = require("resty.openssl.cipher").new("aes-256-gcm")
+
+local schema = {
+ type = "object",
+ properties = {
+ header = {
+ type = "string",
+ default = "Authorization"
+ },
+ forward_header = {
+ type = "string",
+ default = "Authorization"
+ },
+ strict = {
+ type = "boolean",
+ default = true
+ }
+ },
+}
+
+local consumer_schema = {
Review Comment:
why not use existing schema for consumer?https://github.com/apache/apisix/blob/master/apisix/schema_def.lua
##########
t/plugin/jwe-decrypt.t:
##########
Review Comment:
please add a test case that demonstrates that this plugin works correctly with secrets defined using the APISIX secret resource.
##########
apisix/plugins/jwe-decrypt.lua:
##########
@@ -0,0 +1,234 @@
+--
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License. You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+--
+local core = require("apisix.core")
+local consumer_mod = require("apisix.consumer")
+local base64 = require("ngx.base64")
+local ngx = ngx
+local sub_str = string.sub
+local plugin_name = "jwe-decrypt"
+local cipher = require("resty.openssl.cipher").new("aes-256-gcm")
+
+local schema = {
+ type = "object",
+ properties = {
+ header = {
+ type = "string",
+ default = "Authorization"
+ },
+ forward_header = {
+ type = "string",
+ default = "Authorization"
+ },
+ strict = {
+ type = "boolean",
+ default = true
+ }
+ },
+}
+
+local consumer_schema = {
+ type = "object",
+ -- can't use additionalProperties with dependencies
+ properties = {
+ key = { type = "string" },
+ secret = { type = "string", minLength = 32 },
+ base64_secret = { type = "boolean" },
+ },
+ required = { "key", "secret" },
+}
+
+
+local _M = {
+ version = 0.1,
+ priority = 2509,
+ type = 'auth',
+ name = plugin_name,
+ schema = schema,
+ consumer_schema = consumer_schema
+}
+
+
+function _M.check_schema(conf, schema_type)
+ core.log.info("input conf: ", core.json.delay_encode(conf))
+
+ local ok, err
+ if schema_type == core.schema.TYPE_CONSUMER then
+ ok, err = core.schema.check(consumer_schema, conf)
+ else
+ return core.schema.check(schema, conf)
+ end
+
+ if not ok then
+ return false, err
+ end
+
+ return true
+end
+
+local function get_secret(conf)
+ local secret = conf.secret
+
+ if conf.base64_secret then
+ return base64.decode_base64(secret)
+ end
+
+ return secret
+end
+
+local function load_jwe_token(jwe_token)
+ local o = { valid = false }
+ o.header, o.enckey, o.iv, o.ciphertext, o.tag = jwe_token:match("(.-)%.(.-)%.(.-)%.(.-)%.(.*)")
+ if not o.header then
+ return o
+ end
+ local he = base64.decode_base64url(o.header)
+ if not he then
+ return o
+ end
+ o.header_obj = core.json.decode(he)
+ if not o.header_obj then
+ return o
+ end
+ o.valid = true
+ return o
+end
+
+local function jwe_decrypt_with_obj(o, consumer)
+ local secret = get_secret(consumer.auth_conf)
+ local dec = base64.decode_base64url
+ return cipher:decrypt(secret, dec(o.iv), dec(o.ciphertext), false, o.header, dec(o.tag))
+end
+
+local function jwe_encrypt(o, consumer)
+ local secret = get_secret(consumer.auth_conf)
+ local enc = base64.encode_base64url
+ o.ciphertext = cipher:encrypt(secret, o.iv, o.plaintext, false, o.header)
+ o.tag = cipher:get_aead_tag()
+ return o.header .. ".." .. enc(o.iv) .. "." .. enc(o.ciphertext) .. "." .. enc(o.tag)
+end
+
+
+local function get_consumer(key)
+ local consumer_conf = consumer_mod.plugin(plugin_name)
+ if not consumer_conf then
+ return nil
+ end
+ local consumers = consumer_mod.consumers_kv(plugin_name, consumer_conf, "key")
+ if not consumers then
+ return nil
+ end
+ core.log.info("consumers: ", core.json.delay_encode(consumers))
+ return consumers[key]
+end
+
+local function fetch_jwe_token(conf, ctx)
+ local token = core.request.header(ctx, conf.header)
+ if token then
+ local prefix = sub_str(token, 1, 7)
+ if prefix == 'Bearer ' or prefix == 'bearer ' then
+ return sub_str(token, 8)
+ end
+
+ return token
+ end
+end
+
+function _M.rewrite(conf, ctx)
+ -- fetch token and hide credentials if necessary
+ local jwe_token, err = fetch_jwe_token(conf, ctx)
+ if not jwe_token and conf.strict then
+ core.log.info("failed to fetch JWE token: ", err)
+ return 403, { message = "missing JWE token in request" }
+ end
+
+ local jwe_obj = load_jwe_token(jwe_token)
+
+ if not jwe_obj.valid then
+ return 400, { message = "JWE token invalid" }
+ end
+
+ if not jwe_obj.header_obj.kid then
+ return 400, { message = "missing kid in JWE token" }
+ end
+
+ local consumer = get_consumer(jwe_obj.header_obj.kid)
+ if not consumer then
+ return 400, { message = "invalid kid in JWE token" }
+ end
+
+ local plaintext, err = jwe_decrypt_with_obj(jwe_obj, consumer)
+ if err ~= nil then
+ return 400, { message = "failed to decrypt JWE token" }
+ end
+ core.request.set_header(ctx, conf.forward_header, plaintext)
+end
+
+local function gen_token()
+ local args = core.request.get_uri_args()
+ if not args or not args.key then
+ return core.response.exit(400)
+ end
+
+ local key = args.key
+ local payload = args.payload
+ if payload then
+ payload = ngx.unescape_uri(payload)
+ end
+
+ local consumer = get_consumer(key)
+ if not consumer then
+ return core.response.exit(404)
+ end
+
+ core.log.info("consumer: ", core.json.delay_encode(consumer))
+
+ local iv = args.iv
Review Comment:
what does `iv` mean?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add jwe decrypt plugin [apisix]
Posted by "monkeyDluffy6017 (via GitHub)" <gi...@apache.org>.
monkeyDluffy6017 commented on code in PR #10252:
URL: https://github.com/apache/apisix/pull/10252#discussion_r1381987552
##########
apisix/plugins/jwe-decrypt.lua:
##########
@@ -0,0 +1,234 @@
+--
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License. You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+--
+local core = require("apisix.core")
+local consumer_mod = require("apisix.consumer")
+local base64 = require("ngx.base64")
+local ngx = ngx
+local sub_str = string.sub
+local plugin_name = "jwe-decrypt"
+local cipher = require("resty.openssl.cipher").new("aes-256-gcm")
+
+local schema = {
+ type = "object",
+ properties = {
+ header = {
+ type = "string",
+ default = "Authorization"
+ },
+ forward_header = {
+ type = "string",
+ default = "Authorization"
+ },
+ strict = {
+ type = "boolean",
+ default = true
+ }
+ },
+}
+
+local consumer_schema = {
+ type = "object",
+ -- can't use additionalProperties with dependencies
+ properties = {
+ key = { type = "string" },
+ secret = { type = "string", minLength = 32 },
+ base64_secret = { type = "boolean" },
Review Comment:
I suggest use `is_base64_encoded` instead of `base64_secret`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add jwe decrypt plugin [apisix]
Posted by "monkeyDluffy6017 (via GitHub)" <gi...@apache.org>.
monkeyDluffy6017 commented on code in PR #10252:
URL: https://github.com/apache/apisix/pull/10252#discussion_r1382004478
##########
apisix/plugins/jwe-decrypt.lua:
##########
@@ -0,0 +1,234 @@
+--
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License. You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+--
+local core = require("apisix.core")
+local consumer_mod = require("apisix.consumer")
+local base64 = require("ngx.base64")
+local ngx = ngx
+local sub_str = string.sub
+local plugin_name = "jwe-decrypt"
+local cipher = require("resty.openssl.cipher").new("aes-256-gcm")
+
+local schema = {
+ type = "object",
+ properties = {
+ header = {
+ type = "string",
+ default = "Authorization"
+ },
+ forward_header = {
+ type = "string",
+ default = "Authorization"
+ },
+ strict = {
+ type = "boolean",
+ default = true
+ }
+ },
+}
+
+local consumer_schema = {
+ type = "object",
+ -- can't use additionalProperties with dependencies
+ properties = {
+ key = { type = "string" },
+ secret = { type = "string", minLength = 32 },
+ base64_secret = { type = "boolean" },
+ },
+ required = { "key", "secret" },
+}
+
+
+local _M = {
+ version = 0.1,
+ priority = 2509,
+ type = 'auth',
+ name = plugin_name,
+ schema = schema,
+ consumer_schema = consumer_schema
+}
+
+
+function _M.check_schema(conf, schema_type)
+ core.log.info("input conf: ", core.json.delay_encode(conf))
+
+ local ok, err
+ if schema_type == core.schema.TYPE_CONSUMER then
+ ok, err = core.schema.check(consumer_schema, conf)
+ else
+ return core.schema.check(schema, conf)
+ end
+
+ if not ok then
+ return false, err
+ end
+
+ return true
+end
+
+local function get_secret(conf)
+ local secret = conf.secret
+
+ if conf.base64_secret then
+ return base64.decode_base64(secret)
+ end
+
+ return secret
+end
+
+local function load_jwe_token(jwe_token)
+ local o = { valid = false }
+ o.header, o.enckey, o.iv, o.ciphertext, o.tag = jwe_token:match("(.-)%.(.-)%.(.-)%.(.-)%.(.*)")
+ if not o.header then
+ return o
+ end
+ local he = base64.decode_base64url(o.header)
+ if not he then
+ return o
+ end
+ o.header_obj = core.json.decode(he)
+ if not o.header_obj then
+ return o
+ end
+ o.valid = true
+ return o
+end
+
+local function jwe_decrypt_with_obj(o, consumer)
+ local secret = get_secret(consumer.auth_conf)
+ local dec = base64.decode_base64url
+ return cipher:decrypt(secret, dec(o.iv), dec(o.ciphertext), false, o.header, dec(o.tag))
+end
+
+local function jwe_encrypt(o, consumer)
+ local secret = get_secret(consumer.auth_conf)
+ local enc = base64.encode_base64url
+ o.ciphertext = cipher:encrypt(secret, o.iv, o.plaintext, false, o.header)
+ o.tag = cipher:get_aead_tag()
+ return o.header .. ".." .. enc(o.iv) .. "." .. enc(o.ciphertext) .. "." .. enc(o.tag)
+end
+
+
+local function get_consumer(key)
+ local consumer_conf = consumer_mod.plugin(plugin_name)
+ if not consumer_conf then
+ return nil
+ end
+ local consumers = consumer_mod.consumers_kv(plugin_name, consumer_conf, "key")
+ if not consumers then
+ return nil
+ end
+ core.log.info("consumers: ", core.json.delay_encode(consumers))
+ return consumers[key]
+end
+
+local function fetch_jwe_token(conf, ctx)
+ local token = core.request.header(ctx, conf.header)
+ if token then
+ local prefix = sub_str(token, 1, 7)
+ if prefix == 'Bearer ' or prefix == 'bearer ' then
+ return sub_str(token, 8)
+ end
+
+ return token
+ end
+end
+
+function _M.rewrite(conf, ctx)
+ -- fetch token and hide credentials if necessary
+ local jwe_token, err = fetch_jwe_token(conf, ctx)
+ if not jwe_token and conf.strict then
+ core.log.info("failed to fetch JWE token: ", err)
+ return 403, { message = "missing JWE token in request" }
+ end
+
+ local jwe_obj = load_jwe_token(jwe_token)
+
+ if not jwe_obj.valid then
+ return 400, { message = "JWE token invalid" }
+ end
+
+ if not jwe_obj.header_obj.kid then
+ return 400, { message = "missing kid in JWE token" }
+ end
+
+ local consumer = get_consumer(jwe_obj.header_obj.kid)
+ if not consumer then
+ return 400, { message = "invalid kid in JWE token" }
+ end
+
+ local plaintext, err = jwe_decrypt_with_obj(jwe_obj, consumer)
+ if err ~= nil then
+ return 400, { message = "failed to decrypt JWE token" }
+ end
+ core.request.set_header(ctx, conf.forward_header, plaintext)
+end
+
+local function gen_token()
+ local args = core.request.get_uri_args()
+ if not args or not args.key then
+ return core.response.exit(400)
+ end
+
+ local key = args.key
+ local payload = args.payload
+ if payload then
+ payload = ngx.unescape_uri(payload)
+ end
+
+ local consumer = get_consumer(key)
+ if not consumer then
+ return core.response.exit(404)
+ end
+
+ core.log.info("consumer: ", core.json.delay_encode(consumer))
+
+ local iv = args.iv
Review Comment:
The `iv` is short for `initialization vector`, it's used for encrypt @shreemaan-abhishek
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add jwe decrypt plugin [apisix]
Posted by "monkeyDluffy6017 (via GitHub)" <gi...@apache.org>.
monkeyDluffy6017 commented on PR #10252:
URL: https://github.com/apache/apisix/pull/10252#issuecomment-1809477853
@fishioon please check all review comments, and leave a `done` if you fix that, and ping us if you are ready
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] membphis commented on pull request #10252: WIP: feat: add jwe decrypt plugin
Posted by "membphis (via GitHub)" <gi...@apache.org>.
membphis commented on PR #10252:
URL: https://github.com/apache/apisix/pull/10252#issuecomment-1734710271
missing test cases and ci failed, pls fix them first
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add jwe decrypt plugin [apisix]
Posted by "fishioon (via GitHub)" <gi...@apache.org>.
fishioon commented on PR #10252:
URL: https://github.com/apache/apisix/pull/10252#issuecomment-1759749063
> @fishioon please make the ci pass
done
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] monkeyDluffy6017 commented on pull request #10252: WIP: feat: add jwe decrypt plugin
Posted by "monkeyDluffy6017 (via GitHub)" <gi...@apache.org>.
monkeyDluffy6017 commented on PR #10252:
URL: https://github.com/apache/apisix/pull/10252#issuecomment-1732857541
@fishioon click here when you are ready
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add jwe decrypt plugin [apisix]
Posted by "monkeyDluffy6017 (via GitHub)" <gi...@apache.org>.
monkeyDluffy6017 commented on code in PR #10252:
URL: https://github.com/apache/apisix/pull/10252#discussion_r1382020386
##########
apisix/plugins/jwe-decrypt.lua:
##########
@@ -0,0 +1,234 @@
+--
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License. You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+--
+local core = require("apisix.core")
+local consumer_mod = require("apisix.consumer")
+local base64 = require("ngx.base64")
+local ngx = ngx
+local sub_str = string.sub
+local plugin_name = "jwe-decrypt"
+local cipher = require("resty.openssl.cipher").new("aes-256-gcm")
Review Comment:
Why not use https://github.com/openresty/lua-resty-string?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add jwe decrypt plugin [apisix]
Posted by "monkeyDluffy6017 (via GitHub)" <gi...@apache.org>.
monkeyDluffy6017 commented on code in PR #10252:
URL: https://github.com/apache/apisix/pull/10252#discussion_r1382013494
##########
apisix/plugins/jwe-decrypt.lua:
##########
@@ -0,0 +1,234 @@
+--
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License. You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+--
+local core = require("apisix.core")
+local consumer_mod = require("apisix.consumer")
+local base64 = require("ngx.base64")
+local ngx = ngx
+local sub_str = string.sub
+local plugin_name = "jwe-decrypt"
+local cipher = require("resty.openssl.cipher").new("aes-256-gcm")
+
+local schema = {
+ type = "object",
+ properties = {
+ header = {
+ type = "string",
+ default = "Authorization"
+ },
+ forward_header = {
+ type = "string",
+ default = "Authorization"
+ },
+ strict = {
+ type = "boolean",
+ default = true
+ }
+ },
+}
+
+local consumer_schema = {
+ type = "object",
+ -- can't use additionalProperties with dependencies
+ properties = {
+ key = { type = "string" },
+ secret = { type = "string", minLength = 32 },
+ base64_secret = { type = "boolean" },
+ },
+ required = { "key", "secret" },
+}
+
+
+local _M = {
+ version = 0.1,
+ priority = 2509,
+ type = 'auth',
+ name = plugin_name,
+ schema = schema,
+ consumer_schema = consumer_schema
+}
+
+
+function _M.check_schema(conf, schema_type)
+ core.log.info("input conf: ", core.json.delay_encode(conf))
+
+ local ok, err
+ if schema_type == core.schema.TYPE_CONSUMER then
+ ok, err = core.schema.check(consumer_schema, conf)
+ else
+ return core.schema.check(schema, conf)
+ end
+
+ if not ok then
+ return false, err
+ end
+
+ return true
+end
+
+local function get_secret(conf)
+ local secret = conf.secret
+
+ if conf.base64_secret then
+ return base64.decode_base64(secret)
+ end
+
+ return secret
+end
+
+local function load_jwe_token(jwe_token)
+ local o = { valid = false }
+ o.header, o.enckey, o.iv, o.ciphertext, o.tag = jwe_token:match("(.-)%.(.-)%.(.-)%.(.-)%.(.*)")
+ if not o.header then
+ return o
+ end
+ local he = base64.decode_base64url(o.header)
+ if not he then
+ return o
+ end
+ o.header_obj = core.json.decode(he)
+ if not o.header_obj then
+ return o
+ end
+ o.valid = true
+ return o
+end
+
+local function jwe_decrypt_with_obj(o, consumer)
+ local secret = get_secret(consumer.auth_conf)
+ local dec = base64.decode_base64url
+ return cipher:decrypt(secret, dec(o.iv), dec(o.ciphertext), false, o.header, dec(o.tag))
+end
+
+local function jwe_encrypt(o, consumer)
+ local secret = get_secret(consumer.auth_conf)
+ local enc = base64.encode_base64url
+ o.ciphertext = cipher:encrypt(secret, o.iv, o.plaintext, false, o.header)
+ o.tag = cipher:get_aead_tag()
+ return o.header .. ".." .. enc(o.iv) .. "." .. enc(o.ciphertext) .. "." .. enc(o.tag)
+end
+
+
+local function get_consumer(key)
+ local consumer_conf = consumer_mod.plugin(plugin_name)
+ if not consumer_conf then
+ return nil
+ end
+ local consumers = consumer_mod.consumers_kv(plugin_name, consumer_conf, "key")
+ if not consumers then
+ return nil
+ end
+ core.log.info("consumers: ", core.json.delay_encode(consumers))
+ return consumers[key]
+end
+
+local function fetch_jwe_token(conf, ctx)
+ local token = core.request.header(ctx, conf.header)
+ if token then
+ local prefix = sub_str(token, 1, 7)
+ if prefix == 'Bearer ' or prefix == 'bearer ' then
+ return sub_str(token, 8)
+ end
+
+ return token
+ end
+end
+
+function _M.rewrite(conf, ctx)
+ -- fetch token and hide credentials if necessary
+ local jwe_token, err = fetch_jwe_token(conf, ctx)
+ if not jwe_token and conf.strict then
+ core.log.info("failed to fetch JWE token: ", err)
+ return 403, { message = "missing JWE token in request" }
+ end
+
+ local jwe_obj = load_jwe_token(jwe_token)
+
Review Comment:
remove redundant blank
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add jwe decrypt plugin [apisix]
Posted by "monkeyDluffy6017 (via GitHub)" <gi...@apache.org>.
monkeyDluffy6017 commented on code in PR #10252:
URL: https://github.com/apache/apisix/pull/10252#discussion_r1402867487
##########
apisix/plugins/jwe-decrypt.lua:
##########
@@ -0,0 +1,234 @@
+--
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License. You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+--
+local core = require("apisix.core")
+local consumer_mod = require("apisix.consumer")
+local base64 = require("ngx.base64")
+local ngx = ngx
+local sub_str = string.sub
+local plugin_name = "jwe-decrypt"
+local cipher = require("resty.openssl.cipher").new("aes-256-gcm")
Review Comment:
@fishioon have you noticed this comment?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add jwe decrypt plugin [apisix]
Posted by "fishioon (via GitHub)" <gi...@apache.org>.
fishioon commented on PR #10252:
URL: https://github.com/apache/apisix/pull/10252#issuecomment-1833542447
> @fishioon please resolve the review comments
@shreemaan-abhishek Help me!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add jwe decrypt plugin [apisix]
Posted by "shreemaan-abhishek (via GitHub)" <gi...@apache.org>.
shreemaan-abhishek commented on code in PR #10252:
URL: https://github.com/apache/apisix/pull/10252#discussion_r1410688456
##########
t/plugin/jwt-auth.t:
##########
@@ -103,7 +103,7 @@ passed
-=== TEST 4: enable jwt auth plugin using admin api
+=== TEST 4: enable jwt-decrypt plugin using admin api
Review Comment:
🤦🏼 by mistake
##########
t/plugin/jwt-auth.t:
##########
@@ -103,7 +103,7 @@ passed
-=== TEST 4: enable jwt auth plugin using admin api
+=== TEST 4: enable jwt-decrypt plugin using admin api
Review Comment:
🤦🏼 by mistake
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add jwe decrypt plugin [apisix]
Posted by "monkeyDluffy6017 (via GitHub)" <gi...@apache.org>.
monkeyDluffy6017 merged PR #10252:
URL: https://github.com/apache/apisix/pull/10252
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add jwe decrypt plugin [apisix]
Posted by "Revolyssup (via GitHub)" <gi...@apache.org>.
Revolyssup commented on PR #10252:
URL: https://github.com/apache/apisix/pull/10252#issuecomment-1786455329
@kayx23 Can you review the Doc here?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add jwe decrypt plugin [apisix]
Posted by "monkeyDluffy6017 (via GitHub)" <gi...@apache.org>.
monkeyDluffy6017 commented on code in PR #10252:
URL: https://github.com/apache/apisix/pull/10252#discussion_r1381454663
##########
apisix/plugins/jwe-decrypt.lua:
##########
@@ -0,0 +1,234 @@
+--
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License. You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+--
+local core = require("apisix.core")
+local consumer_mod = require("apisix.consumer")
+local base64 = require("ngx.base64")
+local ngx = ngx
+local sub_str = string.sub
+local plugin_name = "jwe-decrypt"
+local cipher = require("resty.openssl.cipher").new("aes-256-gcm")
+
+local schema = {
+ type = "object",
+ properties = {
+ header = {
+ type = "string",
+ default = "Authorization"
+ },
+ forward_header = {
+ type = "string",
+ default = "Authorization"
+ },
+ strict = {
+ type = "boolean",
+ default = true
+ }
+ },
+}
+
+local consumer_schema = {
Review Comment:
@shreemaan-abhishek you could refer to this: /apisix/plugin/jwe/encrypt
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add jwe decrypt plugin [apisix]
Posted by "moonming (via GitHub)" <gi...@apache.org>.
moonming commented on code in PR #10252:
URL: https://github.com/apache/apisix/pull/10252#discussion_r1403916807
##########
docs/en/latest/plugins/jwe-decrypt.md:
##########
@@ -0,0 +1,194 @@
+---
+title: jwe-decrypt
+keywords:
+ - Apache APISIX
+ - API Gateway
+ - Plugin
+ - JWE Decrypt
+ - jwe-decrypt
+description: This document contains information about the Apache APISIX jwe-decrypt Plugin.
+---
+
+<!--
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+-->
+
+## Description
+
+The `jwe-decrypt` Plugin is used to decrypt [JWE](https://datatracker.ietf.org/doc/html/rfc7516) authentication header to a [Service](../terminology/service.md) or a [Route](../terminology/route.md).
+
+A [Consumer](../terminology/consumer.md) of the service then needs to provide a key decrypt the request.
+
+## Attributes
+
+For Consumer:
+
+| Name | Type | Required | Default | Valid values | Description |
+|---------------|---------|-------------------------------------------------------|---------|-----------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| key | string | True | | | Unique key for a Consumer. |
+| secret | string | True | | | The decrypt key. This field supports saving the value in Secret Manager using the [APISIX Secret](../terminology/secret.md) resource. |
+| base64_secret | boolean | False | false | | Set to true if the secret is base64 encoded. |
+
+For Route:
+
+| Name | Type | Required | Default | Description |
+|--------|--------|----------|---------------|---------------------------------------------------------------------|
+| header | string | False | authorization | The header to get the token from. |
+| forward_header | string | False | authorization | Set the header name pass the plaintext to the Upstream. |
+
+## API
+
+This Plugin adds `/apisix/plugin/jwe/encrypt` as an endpoint.
+
+:::note
+
+You may need to use the [public-api](public-api.md) plugin to expose this endpoint.
Review Comment:
@kayx23 You can modify the document directly on this PR:)
looks @fishioon is busy now.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add jwe decrypt plugin [apisix]
Posted by "kayx23 (via GitHub)" <gi...@apache.org>.
kayx23 commented on code in PR #10252:
URL: https://github.com/apache/apisix/pull/10252#discussion_r1403919297
##########
docs/en/latest/plugins/jwe-decrypt.md:
##########
@@ -0,0 +1,194 @@
+---
+title: jwe-decrypt
+keywords:
+ - Apache APISIX
+ - API Gateway
+ - Plugin
+ - JWE Decrypt
+ - jwe-decrypt
+description: This document contains information about the Apache APISIX jwe-decrypt Plugin.
+---
+
+<!--
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+-->
+
+## Description
+
+The `jwe-decrypt` Plugin is used to decrypt [JWE](https://datatracker.ietf.org/doc/html/rfc7516) authentication header to a [Service](../terminology/service.md) or a [Route](../terminology/route.md).
+
+A [Consumer](../terminology/consumer.md) of the service then needs to provide a key decrypt the request.
+
+## Attributes
+
+For Consumer:
+
+| Name | Type | Required | Default | Valid values | Description |
+|---------------|---------|-------------------------------------------------------|---------|-----------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| key | string | True | | | Unique key for a Consumer. |
+| secret | string | True | | | The decrypt key. This field supports saving the value in Secret Manager using the [APISIX Secret](../terminology/secret.md) resource. |
+| base64_secret | boolean | False | false | | Set to true if the secret is base64 encoded. |
+
+For Route:
+
+| Name | Type | Required | Default | Description |
+|--------|--------|----------|---------------|---------------------------------------------------------------------|
+| header | string | False | authorization | The header to get the token from. |
+| forward_header | string | False | authorization | Set the header name pass the plaintext to the Upstream. |
+
+## API
+
+This Plugin adds `/apisix/plugin/jwe/encrypt` as an endpoint.
+
+:::note
+
+You may need to use the [public-api](public-api.md) plugin to expose this endpoint.
Review Comment:
@moonming ok will do
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add jwe decrypt plugin [apisix]
Posted by "shreemaan-abhishek (via GitHub)" <gi...@apache.org>.
shreemaan-abhishek commented on code in PR #10252:
URL: https://github.com/apache/apisix/pull/10252#discussion_r1404763505
##########
apisix/plugins/jwe-decrypt.lua:
##########
@@ -0,0 +1,234 @@
+--
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License. You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+--
+local core = require("apisix.core")
+local consumer_mod = require("apisix.consumer")
+local base64 = require("ngx.base64")
+local ngx = ngx
+local sub_str = string.sub
+local plugin_name = "jwe-decrypt"
+local cipher = require("resty.openssl.cipher").new("aes-256-gcm")
+
+local schema = {
+ type = "object",
+ properties = {
+ header = {
+ type = "string",
+ default = "Authorization"
+ },
+ forward_header = {
+ type = "string",
+ default = "Authorization"
+ },
+ strict = {
+ type = "boolean",
+ default = true
+ }
+ },
+}
+
+local consumer_schema = {
+ type = "object",
+ -- can't use additionalProperties with dependencies
+ properties = {
+ key = { type = "string" },
+ secret = { type = "string", minLength = 32 },
+ base64_secret = { type = "boolean" },
+ },
+ required = { "key", "secret" },
+}
+
+
+local _M = {
+ version = 0.1,
+ priority = 2509,
+ type = 'auth',
+ name = plugin_name,
+ schema = schema,
+ consumer_schema = consumer_schema
+}
+
+
+function _M.check_schema(conf, schema_type)
+ core.log.info("input conf: ", core.json.delay_encode(conf))
+
+ local ok, err
+ if schema_type == core.schema.TYPE_CONSUMER then
+ ok, err = core.schema.check(consumer_schema, conf)
+ else
+ return core.schema.check(schema, conf)
Review Comment:
why? in rest of the places apisix follows the same way.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add jwe decrypt plugin [apisix]
Posted by "monkeyDluffy6017 (via GitHub)" <gi...@apache.org>.
monkeyDluffy6017 commented on code in PR #10252:
URL: https://github.com/apache/apisix/pull/10252#discussion_r1410375573
##########
t/plugin/jwe-decrypt.t:
##########
@@ -0,0 +1,400 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+use t::APISIX 'no_plan';
+
+repeat_each(2);
+no_long_string();
+no_root_location();
+no_shuffle();
+
+add_block_preprocessor(sub {
+ my ($block) = @_;
+
+ if (!defined $block->request) {
+ $block->set_value("request", "GET /t");
+ }
+});
+
+run_tests;
+
+__DATA__
+
+=== TEST 1: sanity
+--- config
+ location /t {
+ content_by_lua_block {
+ local plugin = require("apisix.plugins.jwe-decrypt")
+ local core = require("apisix.core")
+ local conf = {key = "123", secret = "12345678901234567890123456789012"}
+
+ local ok, err = plugin.check_schema(conf, core.schema.TYPE_CONSUMER)
+ if not ok then
+ ngx.say(err)
+ end
+
+ ngx.say(require("toolkit.json").encode(conf))
+ }
+ }
+--- response_body_like eval
+qr/{"key":"123","secret":"[a-zA-Z0-9+\\\/]+={0,2}"}/
+
+
+
+=== TEST 2: wrong type of string
+--- config
+ location /t {
+ content_by_lua_block {
+ local core = require("apisix.core")
+ local plugin = require("apisix.plugins.jwe-decrypt")
+ local ok, err = plugin.check_schema({key = 123, secret = "12345678901234567890123456789012"}, core.schema.TYPE_CONSUMER)
+ if not ok then
+ ngx.say(err)
+ end
+
+ ngx.say("done")
+ }
+ }
+--- response_body
+property "key" validation failed: wrong type: expected string, got number
+done
+
+
+
+=== TEST 3: wrong type of string
+--- config
+ location /t {
+ content_by_lua_block {
+ local core = require("apisix.core")
+ local plugin = require("apisix.plugins.jwe-decrypt")
+ local ok, err = plugin.check_schema({key = "123", secret = "123456"}, core.schema.TYPE_CONSUMER)
+ if not ok then
+ ngx.say(err)
+ end
+
+ ngx.say("done")
+ }
+ }
+--- response_body
+property "secret" validation failed: string too short, expected at least 32, got 6
+done
+
+
+
+=== TEST 4: add consumer with username and plugins
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/consumers',
+ ngx.HTTP_PUT,
+ [[{
+ "username": "jack",
+ "plugins": {
+ "jwe-decrypt": {
+ "key": "user-key",
+ "secret": "12345678901234567890123456789012",
+ "header": "Authorization",
+ "forward_header": "Authorization"
+ }
+ }
+ }]]
+ )
+
+ if code >= 300 then
+ ngx.status = code
+ end
+ ngx.say(body)
+ }
+ }
+--- response_body
+passed
+
+
+
+=== TEST 5: enable jwt auth plugin using admin api
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/routes/1',
+ ngx.HTTP_PUT,
+ [[{
+ "plugins": {
+ "jwe-decrypt": {
+ "header": "Authorization",
+ "forward_header": "Authorization"
+ }
+ },
+ "upstream": {
+ "nodes": {
+ "127.0.0.1:1980": 1
+ },
+ "type": "roundrobin"
+ },
+ "uri": "/hello"
+ }]]
+ )
+
+ if code >= 300 then
+ ngx.status = code
+ end
+ ngx.say(body)
+ }
+ }
+--- response_body
+passed
+
+
+
+=== TEST 6: create public API route (jwe-decrypt sign)
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/routes/2',
+ ngx.HTTP_PUT,
+ [[{
+ "plugins": {
+ "public-api": {}
+ },
+ "uri": "/apisix/plugin/jwe/encrypt"
+ }]]
+ )
+
+ if code >= 300 then
+ ngx.status = code
+ end
+ ngx.say(body)
+ }
+ }
+--- response_body
+passed
+
+
+
+=== TEST 7: sign / verify in argument
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, err, token = t('/apisix/plugin/jwe/encrypt?key=user-key&payload=hello',
+ ngx.HTTP_GET
+ )
+
+ if code > 200 then
+ ngx.status = code
+ ngx.say(err)
+ return
+ end
+
+ code, err, body = t('/hello',
+ ngx.HTTP_GET,
+ nil,
+ nil,
+ { Authorization = token }
+ )
+
+ ngx.print(body)
+ }
+ }
+--- response_body
+hello world
+
+
+
+=== TEST 8: test for unsupported method
+--- request
+PATCH /apisix/plugin/jwe/encrypt?key=user-key
+--- error_code: 404
+
+
+
+=== TEST 9: verify, missing token
+--- request
+GET /hello
+--- error_code: 403
+--- response_body
+{"message":"missing JWE token in request"}
+
+
+
+=== TEST 10: verify: invalid JWE token
+--- request
+GET /hello
+--- more_headers
+Authorization: invalid-eyJhbGciOiJkaXIiLCJraWQiOiJ1c2VyLWtleSIsImVuYyI6IkEyNTZHQ00ifQ..MTIzNDU2Nzg5MDEy.6JeRgm02rpOJdg.4nkSYJgwMKYgTeacatgmRw
+--- error_code: 400
+--- response_body
+{"message":"JWE token invalid"}
+
+
+
+=== TEST 11: verify (in header)
+--- request
+GET /hello
+--- more_headers
+Authorization: Bearer eyJhbGciOiJkaXIiLCJraWQiOiJ1c2VyLWtleSIsImVuYyI6IkEyNTZHQ00ifQ..MTIzNDU2Nzg5MDEy.6JeRgm02rpOJdg.4nkSYJgwMKYgTeacatgmRw
+--- response_body
+hello world
+
+
+
+=== TEST 12: verify (in header without Bearer)
+--- request
+GET /hello
+--- more_headers
+Authorization: eyJhbGciOiJkaXIiLCJraWQiOiJ1c2VyLWtleSIsImVuYyI6IkEyNTZHQ00ifQ..MTIzNDU2Nzg5MDEy.6JeRgm02rpOJdg.4nkSYJgwMKYgTeacatgmRw
+--- response_body
+hello world
+
+
+
+=== TEST 13: verify (header with bearer)
+--- request
+GET /hello
+--- more_headers
+Authorization: bearer eyJhbGciOiJkaXIiLCJraWQiOiJ1c2VyLWtleSIsImVuYyI6IkEyNTZHQ00ifQ..MTIzNDU2Nzg5MDEy.6JeRgm02rpOJdg.4nkSYJgwMKYgTeacatgmRw
+--- response_body
+hello world
+
+
+
+=== TEST 14: verify (invalid bearer token)
+--- request
+GET /hello
+--- more_headers
+Authorization: bearer invalid-eyJhbGciOiJkaXIiLCJraWQiOiJ1c2VyLWtleSIsImVuYyI6IkEyNTZHQ00ifQ..MTIzNDU2Nzg5MDEy.6JeRgm02rpOJdg.4nkSYJgwMKYgTeacatgmRw
+--- error_code: 400
+--- response_body
+{"message":"JWE token invalid"}
+
+
+
+=== TEST 15: delete a exist consumer
+--- config
+ location /t {
+ content_by_lua_block {
+ ngx.sleep(1)
+
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/consumers',
+ ngx.HTTP_PUT,
+ [[{
+ "username": "jack",
+ "plugins": {
+ "jwe-decrypt": {
+ "key": "user-key",
+ "secret": "12345678901234567890123456789012"
+ }
+ }
+ }]]
+ )
+ ngx.say("code: ", code < 300, " body: ", body)
+
+ code, body = t('/apisix/admin/consumers',
+ ngx.HTTP_PUT,
+ [[{
+ "username": "chen",
+ "plugins": {
+ "jwe-decrypt": {
+ "key": "chen-key",
+ "secret": "12345678901234567890123456789021"
+ }
+ }
+ }]]
+ )
+ ngx.say("code: ", code < 300, " body: ", body)
+
+ code, body = t('/apisix/admin/consumers/jack',
+ ngx.HTTP_DELETE)
+ ngx.say("code: ", code < 300, " body: ", body)
+
+ ngx.sleep(1)
+ code, body = t('/apisix/plugin/jwe/encrypt?key=chen-key&payload=hello',
+ ngx.HTTP_GET)
+ ngx.say("code: ", code < 300, " body: ", body)
+ }
+ }
+--- response_body
+code: true body: passed
+code: true body: passed
+code: true body: passed
+code: true body: passed
+
+
+
+=== TEST 16: add consumer with username and plugins with base64 secret
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/consumers',
+ ngx.HTTP_PUT,
+ [[{
+ "username": "jack",
+ "plugins": {
+ "jwe-decrypt": {
+ "key": "user-key",
+ "secret": "fo4XKdZ1xSrIZyms4q2BwPrW5lMpls9qqy5tiAk2esc=",
+ " is_base64_encoded": true
+ }
+ }
+ }]]
+ )
+
+ if code >= 300 then
+ ngx.status = code
+ end
+ ngx.say(body)
+ }
+ }
+--- response_body
+passed
+
+
+
+=== TEST 17: enable jwt auth plugin with base64 secret
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/routes/1',
+ ngx.HTTP_PUT,
+ [[{
+ "plugins": {
+ "jwe-decrypt": {
+ "header": "Authorization",
+ "forward_header": "Authorization"
+ }
+ },
+ "upstream": {
+ "nodes": {
+ "127.0.0.1:1980": 1
+ },
+ "type": "roundrobin"
+ },
+ "uri": "/hello"
+ }]]
+ )
+ if code >= 300 then
+ ngx.status = code
+ end
+ ngx.say(body)
+ }
+ }
+--- response_body
+passed
Review Comment:
No real request test?
```
=== TEST 11: verify (in header)
--- request
GET /hello
--- more_headers
Authorization: Bearer eyJhbGciOiJkaXIiLCJraWQiOiJ1c2VyLWtleSIsImVuYyI6IkEyNTZHQ00ifQ..MTIzNDU2Nzg5MDEy.6JeRgm02rpOJdg.4nkSYJgwMKYgTeacatgmRw
--- response_body
hello world
```
##########
t/plugin/jwe-decrypt.t:
##########
@@ -0,0 +1,400 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+use t::APISIX 'no_plan';
+
+repeat_each(2);
+no_long_string();
+no_root_location();
+no_shuffle();
+
+add_block_preprocessor(sub {
+ my ($block) = @_;
+
+ if (!defined $block->request) {
+ $block->set_value("request", "GET /t");
+ }
+});
+
+run_tests;
+
+__DATA__
+
+=== TEST 1: sanity
+--- config
+ location /t {
+ content_by_lua_block {
+ local plugin = require("apisix.plugins.jwe-decrypt")
+ local core = require("apisix.core")
+ local conf = {key = "123", secret = "12345678901234567890123456789012"}
+
+ local ok, err = plugin.check_schema(conf, core.schema.TYPE_CONSUMER)
+ if not ok then
+ ngx.say(err)
+ end
+
+ ngx.say(require("toolkit.json").encode(conf))
+ }
+ }
+--- response_body_like eval
+qr/{"key":"123","secret":"[a-zA-Z0-9+\\\/]+={0,2}"}/
+
+
+
+=== TEST 2: wrong type of string
+--- config
+ location /t {
+ content_by_lua_block {
+ local core = require("apisix.core")
+ local plugin = require("apisix.plugins.jwe-decrypt")
+ local ok, err = plugin.check_schema({key = 123, secret = "12345678901234567890123456789012"}, core.schema.TYPE_CONSUMER)
+ if not ok then
+ ngx.say(err)
+ end
+
+ ngx.say("done")
+ }
+ }
+--- response_body
+property "key" validation failed: wrong type: expected string, got number
+done
+
+
+
+=== TEST 3: wrong type of string
+--- config
+ location /t {
+ content_by_lua_block {
+ local core = require("apisix.core")
+ local plugin = require("apisix.plugins.jwe-decrypt")
+ local ok, err = plugin.check_schema({key = "123", secret = "123456"}, core.schema.TYPE_CONSUMER)
+ if not ok then
+ ngx.say(err)
+ end
+
+ ngx.say("done")
+ }
+ }
+--- response_body
+property "secret" validation failed: string too short, expected at least 32, got 6
+done
+
+
+
+=== TEST 4: add consumer with username and plugins
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/consumers',
+ ngx.HTTP_PUT,
+ [[{
+ "username": "jack",
+ "plugins": {
+ "jwe-decrypt": {
+ "key": "user-key",
+ "secret": "12345678901234567890123456789012",
+ "header": "Authorization",
+ "forward_header": "Authorization"
+ }
+ }
+ }]]
+ )
+
+ if code >= 300 then
+ ngx.status = code
+ end
+ ngx.say(body)
+ }
+ }
+--- response_body
+passed
+
+
+
+=== TEST 5: enable jwt auth plugin using admin api
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/routes/1',
+ ngx.HTTP_PUT,
+ [[{
+ "plugins": {
+ "jwe-decrypt": {
+ "header": "Authorization",
+ "forward_header": "Authorization"
+ }
+ },
+ "upstream": {
+ "nodes": {
+ "127.0.0.1:1980": 1
+ },
+ "type": "roundrobin"
+ },
+ "uri": "/hello"
+ }]]
+ )
+
+ if code >= 300 then
+ ngx.status = code
+ end
+ ngx.say(body)
+ }
+ }
+--- response_body
+passed
+
+
+
+=== TEST 6: create public API route (jwe-decrypt sign)
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/routes/2',
+ ngx.HTTP_PUT,
+ [[{
+ "plugins": {
+ "public-api": {}
+ },
+ "uri": "/apisix/plugin/jwe/encrypt"
+ }]]
+ )
+
+ if code >= 300 then
+ ngx.status = code
+ end
+ ngx.say(body)
+ }
+ }
+--- response_body
+passed
+
+
+
+=== TEST 7: sign / verify in argument
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, err, token = t('/apisix/plugin/jwe/encrypt?key=user-key&payload=hello',
+ ngx.HTTP_GET
+ )
+
+ if code > 200 then
+ ngx.status = code
+ ngx.say(err)
+ return
+ end
+
+ code, err, body = t('/hello',
+ ngx.HTTP_GET,
+ nil,
+ nil,
+ { Authorization = token }
+ )
+
+ ngx.print(body)
+ }
+ }
+--- response_body
+hello world
+
+
+
+=== TEST 8: test for unsupported method
+--- request
+PATCH /apisix/plugin/jwe/encrypt?key=user-key
+--- error_code: 404
+
+
+
+=== TEST 9: verify, missing token
+--- request
+GET /hello
+--- error_code: 403
+--- response_body
+{"message":"missing JWE token in request"}
+
+
+
+=== TEST 10: verify: invalid JWE token
+--- request
+GET /hello
+--- more_headers
+Authorization: invalid-eyJhbGciOiJkaXIiLCJraWQiOiJ1c2VyLWtleSIsImVuYyI6IkEyNTZHQ00ifQ..MTIzNDU2Nzg5MDEy.6JeRgm02rpOJdg.4nkSYJgwMKYgTeacatgmRw
+--- error_code: 400
+--- response_body
+{"message":"JWE token invalid"}
+
+
+
+=== TEST 11: verify (in header)
+--- request
+GET /hello
+--- more_headers
+Authorization: Bearer eyJhbGciOiJkaXIiLCJraWQiOiJ1c2VyLWtleSIsImVuYyI6IkEyNTZHQ00ifQ..MTIzNDU2Nzg5MDEy.6JeRgm02rpOJdg.4nkSYJgwMKYgTeacatgmRw
+--- response_body
+hello world
+
+
+
+=== TEST 12: verify (in header without Bearer)
+--- request
+GET /hello
+--- more_headers
+Authorization: eyJhbGciOiJkaXIiLCJraWQiOiJ1c2VyLWtleSIsImVuYyI6IkEyNTZHQ00ifQ..MTIzNDU2Nzg5MDEy.6JeRgm02rpOJdg.4nkSYJgwMKYgTeacatgmRw
+--- response_body
+hello world
+
+
+
+=== TEST 13: verify (header with bearer)
+--- request
+GET /hello
+--- more_headers
+Authorization: bearer eyJhbGciOiJkaXIiLCJraWQiOiJ1c2VyLWtleSIsImVuYyI6IkEyNTZHQ00ifQ..MTIzNDU2Nzg5MDEy.6JeRgm02rpOJdg.4nkSYJgwMKYgTeacatgmRw
+--- response_body
+hello world
+
+
+
+=== TEST 14: verify (invalid bearer token)
+--- request
+GET /hello
+--- more_headers
+Authorization: bearer invalid-eyJhbGciOiJkaXIiLCJraWQiOiJ1c2VyLWtleSIsImVuYyI6IkEyNTZHQ00ifQ..MTIzNDU2Nzg5MDEy.6JeRgm02rpOJdg.4nkSYJgwMKYgTeacatgmRw
+--- error_code: 400
+--- response_body
+{"message":"JWE token invalid"}
+
+
+
+=== TEST 15: delete a exist consumer
+--- config
+ location /t {
+ content_by_lua_block {
+ ngx.sleep(1)
+
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/consumers',
+ ngx.HTTP_PUT,
+ [[{
+ "username": "jack",
+ "plugins": {
+ "jwe-decrypt": {
+ "key": "user-key",
+ "secret": "12345678901234567890123456789012"
+ }
+ }
+ }]]
+ )
+ ngx.say("code: ", code < 300, " body: ", body)
+
+ code, body = t('/apisix/admin/consumers',
+ ngx.HTTP_PUT,
+ [[{
+ "username": "chen",
+ "plugins": {
+ "jwe-decrypt": {
+ "key": "chen-key",
+ "secret": "12345678901234567890123456789021"
+ }
+ }
+ }]]
+ )
+ ngx.say("code: ", code < 300, " body: ", body)
+
+ code, body = t('/apisix/admin/consumers/jack',
+ ngx.HTTP_DELETE)
+ ngx.say("code: ", code < 300, " body: ", body)
+
+ ngx.sleep(1)
+ code, body = t('/apisix/plugin/jwe/encrypt?key=chen-key&payload=hello',
+ ngx.HTTP_GET)
+ ngx.say("code: ", code < 300, " body: ", body)
+ }
+ }
+--- response_body
+code: true body: passed
+code: true body: passed
+code: true body: passed
+code: true body: passed
+
+
+
+=== TEST 16: add consumer with username and plugins with base64 secret
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/consumers',
+ ngx.HTTP_PUT,
+ [[{
+ "username": "jack",
+ "plugins": {
+ "jwe-decrypt": {
+ "key": "user-key",
+ "secret": "fo4XKdZ1xSrIZyms4q2BwPrW5lMpls9qqy5tiAk2esc=",
+ " is_base64_encoded": true
+ }
+ }
+ }]]
+ )
+
+ if code >= 300 then
+ ngx.status = code
+ end
+ ngx.say(body)
+ }
+ }
+--- response_body
+passed
+
+
+
+=== TEST 17: enable jwt auth plugin with base64 secret
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/routes/1',
+ ngx.HTTP_PUT,
+ [[{
+ "plugins": {
+ "jwe-decrypt": {
+ "header": "Authorization",
+ "forward_header": "Authorization"
+ }
+ },
+ "upstream": {
+ "nodes": {
+ "127.0.0.1:1980": 1
+ },
+ "type": "roundrobin"
+ },
+ "uri": "/hello"
+ }]]
+ )
+ if code >= 300 then
+ ngx.status = code
+ end
+ ngx.say(body)
+ }
+ }
+--- response_body
+passed
Review Comment:
No real request test?
```
=== TEST 18: verify (in header)
--- request
GET /hello
--- more_headers
Authorization: Bearer eyJhbGciOiJkaXIiLCJraWQiOiJ1c2VyLWtleSIsImVuYyI6IkEyNTZHQ00ifQ..MTIzNDU2Nzg5MDEy.6JeRgm02rpOJdg.4nkSYJgwMKYgTeacatgmRw
--- response_body
hello world
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add jwe decrypt plugin [apisix]
Posted by "monkeyDluffy6017 (via GitHub)" <gi...@apache.org>.
monkeyDluffy6017 commented on code in PR #10252:
URL: https://github.com/apache/apisix/pull/10252#discussion_r1410266010
##########
apisix/plugins/jwe-decrypt.lua:
##########
@@ -0,0 +1,250 @@
+--
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License. You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+--
+local core = require("apisix.core")
+local consumer_mod = require("apisix.consumer")
+local base64 = require("ngx.base64")
+local aes = require("resty.aes")
+local ngx = ngx
+local sub_str = string.sub
+local cipher = aes.cipher(256, "gcm")
+
+local plugin_name = "jwe-decrypt"
+
+local schema = {
+ type = "object",
+ properties = {
+ header = {
+ type = "string",
+ default = "Authorization"
+ },
+ forward_header = {
+ type = "string",
+ default = "Authorization"
+ },
+ strict = {
+ type = "boolean",
+ default = true
+ }
+ },
+ required = { "header", "forward_header" },
+}
+
+local consumer_schema = {
+ type = "object",
+ properties = {
+ key = { type = "string" },
+ secret = { type = "string", minLength = 32 },
+ is_base64_encoded = { type = "boolean" },
+ },
+ required = { "key", "secret" },
+}
+
+
+local _M = {
+ version = 0.1,
+ priority = 2509,
+ type = 'auth',
+ name = plugin_name,
+ schema = schema,
+ consumer_schema = consumer_schema
+}
+
+
+function _M.check_schema(conf, schema_type)
+ if schema_type == core.schema.TYPE_CONSUMER then
+ return core.schema.check(consumer_schema, conf)
+ end
+ return core.schema.check(schema, conf)
+end
+
+
+local function get_secret(conf)
+ local secret = conf.secret
+
+ if conf. is_base64_encoded then
Review Comment:
```suggestion
if conf.is_base64_encoded then
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] monkeyDluffy6017 commented on pull request #10252: WIP: feat: add jwe decrypt plugin
Posted by "monkeyDluffy6017 (via GitHub)" <gi...@apache.org>.
monkeyDluffy6017 commented on PR #10252:
URL: https://github.com/apache/apisix/pull/10252#issuecomment-1732979752
please make the ci pass
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add jwe decrypt plugin [apisix]
Posted by "monkeyDluffy6017 (via GitHub)" <gi...@apache.org>.
monkeyDluffy6017 commented on code in PR #10252:
URL: https://github.com/apache/apisix/pull/10252#discussion_r1381990368
##########
apisix/plugins/jwe-decrypt.lua:
##########
@@ -0,0 +1,234 @@
+--
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License. You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+--
+local core = require("apisix.core")
+local consumer_mod = require("apisix.consumer")
+local base64 = require("ngx.base64")
+local ngx = ngx
+local sub_str = string.sub
+local plugin_name = "jwe-decrypt"
+local cipher = require("resty.openssl.cipher").new("aes-256-gcm")
+
+local schema = {
+ type = "object",
+ properties = {
+ header = {
+ type = "string",
+ default = "Authorization"
+ },
+ forward_header = {
+ type = "string",
+ default = "Authorization"
+ },
+ strict = {
+ type = "boolean",
+ default = true
+ }
+ },
+}
+
+local consumer_schema = {
+ type = "object",
+ -- can't use additionalProperties with dependencies
+ properties = {
+ key = { type = "string" },
+ secret = { type = "string", minLength = 32 },
+ base64_secret = { type = "boolean" },
+ },
+ required = { "key", "secret" },
+}
+
+
+local _M = {
+ version = 0.1,
+ priority = 2509,
+ type = 'auth',
+ name = plugin_name,
+ schema = schema,
+ consumer_schema = consumer_schema
+}
+
+
+function _M.check_schema(conf, schema_type)
+ core.log.info("input conf: ", core.json.delay_encode(conf))
Review Comment:
remove this log
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add jwe decrypt plugin [apisix]
Posted by "monkeyDluffy6017 (via GitHub)" <gi...@apache.org>.
monkeyDluffy6017 commented on PR #10252:
URL: https://github.com/apache/apisix/pull/10252#issuecomment-1818108236
@shreemaan-abhishek Could you help to handle this pr ?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add jwe decrypt plugin [apisix]
Posted by "monkeyDluffy6017 (via GitHub)" <gi...@apache.org>.
monkeyDluffy6017 commented on code in PR #10252:
URL: https://github.com/apache/apisix/pull/10252#discussion_r1406985945
##########
apisix/plugins/jwe-decrypt.lua:
##########
@@ -0,0 +1,234 @@
+--
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License. You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+--
+local core = require("apisix.core")
+local consumer_mod = require("apisix.consumer")
+local base64 = require("ngx.base64")
+local ngx = ngx
+local sub_str = string.sub
+local plugin_name = "jwe-decrypt"
+local cipher = require("resty.openssl.cipher").new("aes-256-gcm")
Review Comment:
if we use `lua-resty-string`, we don't need to import any new library
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add jwe decrypt plugin [apisix]
Posted by "shreemaan-abhishek (via GitHub)" <gi...@apache.org>.
shreemaan-abhishek commented on PR #10252:
URL: https://github.com/apache/apisix/pull/10252#issuecomment-1825118904
I will push this PR to completion now @fishioon. Thank you for your contribution.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add jwe decrypt plugin [apisix]
Posted by "shreemaan-abhishek (via GitHub)" <gi...@apache.org>.
shreemaan-abhishek commented on code in PR #10252:
URL: https://github.com/apache/apisix/pull/10252#discussion_r1363565220
##########
t/plugin/jwe-decrypt.t:
##########
Review Comment:
please add a test case that demonstrates that this plugin works correctly with secrets defined using the APISIX secret resource.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add jwe decrypt plugin [apisix]
Posted by "monkeyDluffy6017 (via GitHub)" <gi...@apache.org>.
monkeyDluffy6017 commented on PR #10252:
URL: https://github.com/apache/apisix/pull/10252#issuecomment-1833404400
@fishioon please resolve the review comments
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add jwe decrypt plugin [apisix]
Posted by "monkeyDluffy6017 (via GitHub)" <gi...@apache.org>.
monkeyDluffy6017 commented on PR #10252:
URL: https://github.com/apache/apisix/pull/10252#issuecomment-1784587272
@moonming I will check this in two days
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add jwe decrypt plugin [apisix]
Posted by "shreemaan-abhishek (via GitHub)" <gi...@apache.org>.
shreemaan-abhishek commented on PR #10252:
URL: https://github.com/apache/apisix/pull/10252#issuecomment-1811972905
@fishioon CI failing.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add jwe decrypt plugin [apisix]
Posted by "monkeyDluffy6017 (via GitHub)" <gi...@apache.org>.
monkeyDluffy6017 commented on PR #10252:
URL: https://github.com/apache/apisix/pull/10252#issuecomment-1809477255
@moonming I think the author didn't fix all review comments
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add jwe decrypt plugin [apisix]
Posted by "fishioon (via GitHub)" <gi...@apache.org>.
fishioon commented on PR #10252:
URL: https://github.com/apache/apisix/pull/10252#issuecomment-1815628133
> @fishioon CI failing.
Can you help me fix the failed ci?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add jwe decrypt plugin [apisix]
Posted by "monkeyDluffy6017 (via GitHub)" <gi...@apache.org>.
monkeyDluffy6017 commented on code in PR #10252:
URL: https://github.com/apache/apisix/pull/10252#discussion_r1403918998
##########
apisix/plugins/jwe-decrypt.lua:
##########
@@ -0,0 +1,234 @@
+--
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License. You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+--
+local core = require("apisix.core")
+local consumer_mod = require("apisix.consumer")
+local base64 = require("ngx.base64")
+local ngx = ngx
+local sub_str = string.sub
+local plugin_name = "jwe-decrypt"
+local cipher = require("resty.openssl.cipher").new("aes-256-gcm")
Review Comment:
@shreemaan-abhishek
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add jwe decrypt plugin [apisix]
Posted by "moonming (via GitHub)" <gi...@apache.org>.
moonming commented on PR #10252:
URL: https://github.com/apache/apisix/pull/10252#issuecomment-1809458318
@monkeyDluffy6017 @shreemaan-abhishek please review again
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add jwe decrypt plugin [apisix]
Posted by "monkeyDluffy6017 (via GitHub)" <gi...@apache.org>.
monkeyDluffy6017 commented on code in PR #10252:
URL: https://github.com/apache/apisix/pull/10252#discussion_r1410273045
##########
t/plugin/jwt-auth.t:
##########
@@ -103,7 +103,7 @@ passed
-=== TEST 4: enable jwt auth plugin using admin api
+=== TEST 4: enable jwt-decrypt plugin using admin api
Review Comment:
Why do you change this?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add jwe decrypt plugin [apisix]
Posted by "moonming (via GitHub)" <gi...@apache.org>.
moonming commented on PR #10252:
URL: https://github.com/apache/apisix/pull/10252#issuecomment-1784341454
@monkeyDluffy6017 can we this PR?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add jwe decrypt plugin [apisix]
Posted by "Revolyssup (via GitHub)" <gi...@apache.org>.
Revolyssup commented on PR #10252:
URL: https://github.com/apache/apisix/pull/10252#issuecomment-1784599762
@fishioon You need to also update the chinese doc. You can give me permission on your branch and I can help you out with this.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add jwe decrypt plugin [apisix]
Posted by "fishioon (via GitHub)" <gi...@apache.org>.
fishioon commented on PR #10252:
URL: https://github.com/apache/apisix/pull/10252#issuecomment-1784639760
> @fishioon You need to also update the chinese doc. You can give me permission on your branch and I can help you out with this.
How to do it?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org