Allow configurable audience claim (#975)

src/PostgREST/App.hs

@@ -76,7 +76,7 @@ postgrest conf refDbStructure pool worker =
         response <- case userApiRequest (configSchema conf) req body of
           Left err -> return $ apiRequestError err
           Right apiRequest -> do
-            eClaims <- jwtClaims jwtSecret (toS $ iJWT apiRequest)
+            eClaims <- jwtClaims jwtSecret (configJwtAudience conf) (toS $ iJWT apiRequest)
 
             let authed = containsRole eClaims
                 handleReq = runWithClaims conf eClaims (app dbStructure conf) apiRequest

src/PostgREST/Auth.hs

@@ -39,16 +39,16 @@ data JWTAttempt = JWTInvalid JWTError
                 deriving (Eq, Show)
 
 {-|
-  Receives the JWT secret (from config) and a JWT and returns a map
+  Receives the JWT secret and audience (from config) and a JWT and returns a map
   of JWT claims.
 -}
-jwtClaims :: Maybe JWK -> BL.ByteString -> IO JWTAttempt
-jwtClaims _ "" = return $ JWTClaims M.empty
-jwtClaims secret payload =
+jwtClaims :: Maybe JWK -> Text -> BL.ByteString  -> IO JWTAttempt
+jwtClaims _ "" "" = return $ JWTClaims M.empty
+jwtClaims secret audience payload =
   case secret of
     Nothing -> return JWTMissingSecret
     Just jwk -> do
-      let validation = defaultJWTValidationSettings
+      let validation = set audiencePredicate (==  fromString audience) defaultJWTValidationSettings
       eJwt <- runExceptT $ do
         jwt <- decodeCompact payload
         validateJWSJWT validation jwk jwt

src/PostgREST/Config.hs

@@ -59,6 +59,7 @@ data AppConfig = AppConfig {
 
   , configJwtSecret         :: Maybe B.ByteString
   , configJwtSecretIsBase64 :: Bool
+  , configJwtAudience       :: Text
 
   , configPool              :: Int
   , configMaxRows           :: Maybe Integer
@@ -117,6 +118,7 @@ readOptions = do
           <*> (fromMaybe 3000 . join . fmap coerceInt <$> C.key "server-port")
           <*> (fmap encodeUtf8 . mfilter (/= "") <$> C.key "jwt-secret")
           <*> (fromMaybe False . join . fmap coerceBool <$> C.key "secret-is-base64")
+          <*> (fromMaybe "" <$> C.key "jwt-aud")
           <*> (fromMaybe 10 . join . fmap coerceInt <$> C.key "db-pool")
           <*> (join . fmap coerceInt <$> C.key "max-rows")
           <*> (mfilter (/= "") <$> C.key "pre-request")
@@ -177,6 +179,7 @@ readOptions = do
         |## (use "@filename" to load from separate file)
         |# jwt-secret = "foo"
         |# secret-is-base64 = false
+        |# jwt-aud = "your_audience_claim"
         |
         |## limit rows in response
         |# max-rows = 1000