From 05447bae33b6e6c53dc030c8daca6a1707d5ffd9 Mon Sep 17 00:00:00 2001
From: steve-chavez <stevechavezast@gmail.com>
Date: Mon, 13 May 2024 12:16:06 -0500
Subject: [PATCH] nix: add postgrest-gen-jwt/secret for manual tests

```
$ postgrest-gen-secret
uMd97XSQzNkA1CWhMZ7u88Pj0RNyhrpo

$ postgrest-gen-jwt postgrest_test_author
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJyb2xlIjoicG9zdGdyZXN0X3Rlc3RfYXV0aG9yIn0.Xod-F15qsGL0WhdOCr2j3DdKuTw9QJERVgoFD3vGaWA
```

Also modifies postgrest-run to include a default PGRST_JWT_SECRET for
quicker manual tests.
---
 nix/tools/cabalTools.nix |  2 ++
 nix/tools/devTools.nix   | 49 +++++++++++++++++++++++++++++++++++++++-
 2 files changed, 50 insertions(+), 1 deletion(-)

diff --git a/nix/tools/cabalTools.nix b/nix/tools/cabalTools.nix
index 0174d7fa3..638082b50 100644
--- a/nix/tools/cabalTools.nix
+++ b/nix/tools/cabalTools.nix
@@ -43,6 +43,7 @@ let
             "ARG_USE_ENV([PGRST_DB_ANON_ROLE], [postgrest_test_anonymous], [PostgREST anonymous role])"
             "ARG_USE_ENV([PGRST_DB_POOL], [1], [PostgREST pool size])"
             "ARG_USE_ENV([PGRST_DB_POOL_ACQUISITION_TIMEOUT], [1], [PostgREST pool timeout])"
+            "ARG_USE_ENV([PGRST_JWT_SECRET], [reallyreallyreallyreallyverysafe], [PostgREST JWT secret])"
             "ARG_LEFTOVERS([PostgREST arguments])"
           ];
         workingDir = "/";
@@ -52,6 +53,7 @@ let
         export PGRST_DB_ANON_ROLE
         export PGRST_DB_POOL
         export PGRST_DB_POOL_ACQUISITION_TIMEOUT
+        export PGRST_JWT_SECRET
 
         exec ${cabal-install}/bin/cabal v2-run ${devCabalOptions} --verbose=0 -- \
           postgrest "''${_arg_leftovers[@]}"
diff --git a/nix/tools/devTools.nix b/nix/tools/devTools.nix
index 229d6b1f1..f7f211e23 100644
--- a/nix/tools/devTools.nix
+++ b/nix/tools/devTools.nix
@@ -15,6 +15,7 @@
 , withTools
 , haskellPackages
 , ctags
+, openssl
 }:
 let
   watch =
@@ -319,7 +320,7 @@ let
   genCtags =
     checkedShellScript
       {
-        name = "postgrest-ctags";
+        name = "postgrest-gen-ctags";
         docs = "Generate ctags for Haskell and Python code";
         workingDir = "/";
       }
@@ -327,6 +328,50 @@ let
         ${ctags}/bin/ctags -a -R --fields=+l --languages=python --python-kinds=-iv -f ./tags test/io/
         ${haskellPackages.hasktags}/bin/hasktags -a -R -c -f ./tags .
       '';
+
+  genJwt =
+    checkedShellScript
+      {
+        name = "postgrest-gen-jwt";
+        docs = "Generate a JWT";
+        args = [
+          "ARG_POSITIONAL_SINGLE([role], [role for the jwt payload])"
+          "ARG_OPTIONAL_SINGLE([secret],, [secret used to sign the JWT], [reallyreallyreallyreallyverysafe])"
+        ];
+      }
+      ''
+        # From https://stackoverflow.com/questions/59002949/how-to-create-a-json-web-token-jwt-using-openssl-shell-commands
+
+        # Construct the header
+        jwt_header=$(echo -n '{"alg":"HS256","typ":"JWT"}' | base64 | sed s/\+/-/g | sed 's/\//_/g' | sed -E s/=+$//)
+
+        # Construct the payload
+        payload=$(echo -n "{\"role\":\"$_arg_role\"}" | base64 | sed s/\+/-/g |sed 's/\//_/g' |  sed -E s/=+$//)
+
+        # Convert secret to hex
+        hexsecret=$(echo -n "$_arg_secret" | xxd -p | paste -sd "")
+
+        # Calculate hmac signature -- note option to pass in the key as hex bytes
+        hmac_signature=$(echo -n "$jwt_header.$payload" |  ${openssl}/bin/openssl dgst -sha256 -mac HMAC -macopt hexkey:"$hexsecret" -binary \
+          | base64  | sed s/\+/-/g | sed 's/\//_/g' | sed -E s/=+$//)
+
+        # Create the full token
+        jwt="$jwt_header.$payload.$hmac_signature"
+
+        echo -n "$jwt"
+      '';
+
+  genSecret =
+    checkedShellScript
+      {
+        name = "postgrest-gen-secret";
+        docs = "Generate a JWT secret";
+      }
+      ''
+        export LC_CTYPE=C
+
+        LC_ALL=C tr -dc 'A-Za-z0-9' </dev/urandom | head -c32
+      '';
 in
 buildToolbox
 {
@@ -341,6 +386,8 @@ buildToolbox
       hsieMinimalImports
       parallelCurl
       genCtags
+      genJwt
+      genSecret
       pushCachix
       watch;
   };