refactor: move parseSecret out of App.postgrest

parseSecret only needs to be computed once, after the config is read.

src/PostgREST/App.hs

@@ -43,7 +43,7 @@ import PostgREST.ApiRequest       (Action (..), ApiRequest (..),
                                    InvokeMethod (..), Target (..),
                                    mutuallyAgreeable, userApiRequest)
 import PostgREST.Auth             (attemptJwtClaims, containsRole,
-                                   jwtClaims, parseSecret)
+                                   jwtClaims)
 import PostgREST.Config           (AppConfig (..))
 import PostgREST.DbRequestBuilder (mutateRequest, readRequest,
                                    returningCols)
@@ -69,8 +69,7 @@ import Protolude.Conv             (toS)
 
 postgrest :: AppConfig -> IORef (Maybe DbStructure) -> P.Pool -> IO UTCTime -> IO () -> Application
 postgrest conf refDbStructure pool getTime worker =
-  let middle = (if configQuiet conf then id else logStdout) . defaultMiddle
-      jwtSecret = parseSecret <$> configJwtSecret conf in
+  let middle = (if configQuiet conf then id else logStdout) . defaultMiddle in
   middle $ \ req respond -> do
     time <- getTime
     body <- strictRequestBody req
@@ -86,7 +85,7 @@ postgrest conf refDbStructure pool getTime worker =
             Left err -> return . errorResponseFor $ err
             Right (apiRequest, maybeCols) -> do
               -- The jwt must be checked before touching the db.
-              attempt <- attemptJwtClaims jwtSecret (configJwtAudience conf) (toS $ iJWT apiRequest) time (rightToMaybe $ configRoleClaimKey conf)
+              attempt <- attemptJwtClaims (configJWKS conf) (configJwtAudience conf) (toS $ iJWT apiRequest) time (rightToMaybe $ configRoleClaimKey conf)
               case jwtClaims attempt of
                 Left errJwt -> return . errorResponseFor $ errJwt
                 Right claims -> do

src/PostgREST/Auth.hs

@@ -58,14 +58,14 @@ jwtClaims attempt =
 -}
 attemptJwtClaims :: Maybe JWKSet -> Maybe StringOrURI -> LByteString -> UTCTime -> Maybe JSPath -> IO JWTAttempt
 attemptJwtClaims _ _ "" _ _ = return $ JWTClaims M.empty
-attemptJwtClaims secret audience payload time jspath =
-  case secret of
+attemptJwtClaims maybeSecret audience payload time jspath =
+  case maybeSecret of
     Nothing -> return JWTMissingSecret
-    Just s -> do
+    Just secret -> do
       let validation = set allowedSkew 1 $ defaultJWTValidationSettings (maybe (const True) (==) audience)
       eJwt <- runExceptT $ do
         jwt <- decodeCompact payload
-        verifyClaimsAt validation s time jwt
+        verifyClaimsAt validation secret time jwt
       return $ case eJwt of
         Left e    -> JWTInvalid e
         Right jwt -> JWTClaims $ claims2map jwt jspath

src/PostgREST/Config.hs

@@ -29,6 +29,7 @@ module PostgREST.Config ( prettyVersion
                         )
        where
 
+import Crypto.JWT (JWKSet)
 import qualified Data.ByteString              as B
 import qualified Data.ByteString.Base64     as B64
 import qualified Data.ByteString.Char8        as BS
@@ -97,7 +98,7 @@ data AppConfig = AppConfig {
   , configRootSpec          :: Maybe Text
   , configRawMediaTypes     :: [B.ByteString]
 
-  , configPath              :: Maybe FilePath
+  , configJWKS              :: Maybe JWKSet
   }
 
 configPoolTimeout' :: (Fractional a) => AppConfig -> a
@@ -230,14 +231,14 @@ readAppConfig cfgPath = do
     , Handler (\(C.ParseError err) -> exitErr $ "Error parsing config file:\n" <> err)
     ]
 
-  case C.runParser (parseConfig cfgPath) conf of
+  case C.runParser parseConfig conf of
     Left err ->
       exitErr $ "Error parsing config file:\n\t" <> err
     Right appConf ->
       return appConf
 
   where
-    parseConfig path =
+    parseConfig =
       AppConfig
         <$> reqString "db-uri"
         <*> reqString "db-anon-role"
@@ -262,7 +263,7 @@ readAppConfig cfgPath = do
         <*> (maybe ["public"] splitOnCommas <$> optValue "db-extra-search-path")
         <*> optString "root-spec"
         <*> (maybe [] (fmap encodeUtf8 . splitOnCommas) <$> optValue "raw-media-types")
-        <*> pure (Just path)
+        <*> pure Nothing
 
     parseSocketFileMode :: C.Key -> C.Parser C.Config (Either Text FileMode)
     parseSocketFileMode k =