Merge pull request #7772 from penpot/niwinz-develop-auth-bugfix

✨ Improvements to the auth internal flows changes

backend/resources/log4j2-devenv-repl.xml

@@ -25,8 +25,7 @@
     <Logger name="app.storage.tmp" level="info" />
     <Logger name="app.worker" level="trace" />
     <Logger name="app.msgbus" level="info" />
-    <Logger name="app.http.websocket" level="info" />
+    <Logger name="app.http" level="info" />
-    <Logger name="app.http.sse" level="info" />
     <Logger name="app.util.websocket" level="info" />
     <Logger name="app.redis" level="info" />
     <Logger name="app.rpc.rlimit" level="info" />

backend/resources/log4j2-devenv.xml

@@ -25,8 +25,7 @@
     <Logger name="app.storage.tmp" level="info" />
     <Logger name="app.worker" level="trace" />
     <Logger name="app.msgbus" level="info" />
-    <Logger name="app.http.websocket" level="info" />
+    <Logger name="app.http" level="info" />
-    <Logger name="app.http.sse" level="info" />
     <Logger name="app.util.websocket" level="info" />
     <Logger name="app.redis" level="info" />
     <Logger name="app.rpc.rlimit" level="info" />

backend/src/app/http/middleware.clj

@@ -14,6 +14,7 @@
    [app.config :as cf]
    [app.http :as-alias http]
    [app.http.errors :as errors]
+   [app.tokens :as tokens]
    [app.util.pointer-map :as pmap]
    [cuerdas.core :as str]
    [yetti.adapter :as yt]
@@ -272,9 +273,24 @@
         process-request
         (fn [request]
           (if-let [{:keys [type token] :as auth} (get-token request)]
-            (if-let [decode-fn (get decoders type)]
+            (let [decode-fn (get decoders type)]
-              (assoc request ::http/auth-data (assoc auth :claims (decode-fn token)))
+              (if (= type :cookie)
-              (assoc request ::http/auth-data auth))
+                (let [metadata (tokens/decode-header token)]
+                  ;; NOTE: we only proceed to decode claims on new
+                  ;; cookie tokens. The old cookies dont need to be
+                  ;; decoded because they use the token string as ID
+                  (if (and (= (:kid metadata) 1)
+                           (= (:ver metadata) 1)
+                           (some? decode-fn))
+                    (assoc request ::http/auth-data (assoc auth
+                                                           :claims (decode-fn token)
+                                                           :metadata metadata))
+                    (assoc request ::http/auth-data (assoc auth :metadata {:ver 0}))))
+
+                (if decode-fn
+                  (assoc request ::http/auth-data (assoc auth :claims (decode-fn token)))
+                  (assoc request ::http/auth-data auth))))
+
             request))]
 
     (fn [request]

backend/src/app/http/session.clj

@@ -93,15 +93,15 @@
     (update-session [_ session]
       (let [modified-at (ct/now)]
         (if (string? (:id session))
-          (let [params (-> session
+          (db/insert! pool :http-session-v2
-                           (assoc :id (uuid/next))
+                      (-> session
-                           (assoc :created-at modified-at)
+                          (assoc :id (uuid/next))
-                           (assoc :modified-at modified-at))]
+                          (assoc :created-at modified-at)
-            (db/insert! pool :http-session-v2 params))
+                          (assoc :modified-at modified-at)))
-
           (db/update! pool :http-session-v2
                       {:modified-at modified-at}
-                      {:id (:id session)}))))
+                      {:id (:id session)}
+                      {::db/return-keys true}))))
 
     (delete-session [_ id]
       (if (string? id)
@@ -158,14 +158,15 @@
 
 (defn- assign-token
   [cfg session]
-  (let [token (tokens/generate cfg
+  (let [claims {:iss "authentication"
-                               {:iss "authentication"
+                :aud "penpot"
-                                :aud "penpot"
+                :sid (:id session)
-                                :sid (:id session)
+                :iat (:modified-at session)
-                                :iat (:modified-at session)
+                :uid (:profile-id session)
-                                :uid (:profile-id session)
+                :sso-provider-id (:sso-provider-id session)
-                                :sso-provider-id (:sso-provider-id session)
+                :sso-session-id (:sso-session-id session)}
-                                :sso-session-id (:sso-session-id session)})]
+        header {:kid 1 :ver 1}
+        token  (tokens/generate cfg claims header)]
     (assoc session :token token)))
 
 (defn create-fn
@@ -225,13 +226,14 @@
   [handler {:keys [::manager] :as cfg}]
   (assert (manager? manager) "expected valid session manager")
   (fn [request]
-    (let [{:keys [type token claims]} (get request ::http/auth-data)]
+    (let [{:keys [type token claims metadata]} (get request ::http/auth-data)]
       (cond
         (= type :cookie)
-        (let [session (if-let [sid (:sid claims)]
+        (let [session (case (:ver metadata)
-                        (read-session manager sid)
                         ;; BACKWARD COMPATIBILITY WITH OLD TOKENS
-                        (read-session manager token))
+                        0 (read-session manager token)
+                        1 (some->> (:sid claims) (read-session manager))
+                        nil)
 
               request (cond-> request
                         (some? session)
@@ -240,7 +242,7 @@
 
               response (handler request)]
 
-          (if (renew-session? session)
+          (if (and session (renew-session? session))
             (let [session (->> session
                                (update-session manager)
                                (assign-token cfg))]
@@ -248,11 +250,11 @@
             response))
 
         (= type :bearer)
-        (let [session (if-let [sid (:sid claims)]
+        (let [session (case (:ver metadata)
-                        (read-session manager sid)
                         ;; BACKWARD COMPATIBILITY WITH OLD TOKENS
-                        (read-session manager token))
+                        0 (read-session manager token)
-
+                        1 (some->> (:sid claims) (read-session manager))
+                        nil)
               request (cond-> request
                         (some? session)
                         (-> (assoc ::profile-id (:profile-id session))

backend/src/app/loggers/database.clj

@@ -49,7 +49,7 @@
           ctx  (-> context
                    (assoc :tenant (cf/get :tenant))
                    (assoc :host (cf/get :host))
-                   (assoc :public-uri (cf/get :public-uri))
+                   (assoc :public-uri (str (cf/get :public-uri)))
                    (assoc :logger/name logger)
                    (assoc :logger/level level)
                    (dissoc :request/params :value :params :data))]

backend/src/app/tokens.clj

@@ -15,19 +15,25 @@
    [buddy.sign.jwe :as jwe]))
 
 (defn generate
-  [{:keys [::setup/props] :as cfg} claims]
+  ([cfg claims] (generate cfg claims nil))
-  (assert (contains? cfg ::setup/props))
+  ([{:keys [::setup/props] :as cfg} claims header]
+   (assert (contains? props :tokens-key) "expect props to have tokens-key")
 
-  (let [tokens-key
+   (let [tokens-key
-        (get props :tokens-key)
+         (get props :tokens-key)
 
-        payload
+         payload
-        (-> claims
+         (-> claims
-            (update :iat (fn [v] (or v (ct/now))))
+             (update :iat (fn [v] (or v (ct/now))))
-            (d/without-nils)
+             (d/without-nils)
-            (t/encode))]
+             (t/encode))]
 
-    (jwe/encrypt payload tokens-key {:alg :a256kw :enc :a256gcm})))
+     (jwe/encrypt payload tokens-key {:alg :a256kw :enc :a256gcm :header header}))))
+
+(defn decode-header
+  [token]
+  (ex/ignoring
+   (jwe/decode-header token)))
 
 (defn decode
   [{:keys [::setup/props] :as cfg} token]