Support binary (b64) JWT secrets (#772)

src/PostgREST/App.hs

@@ -29,7 +29,7 @@ import           Network.HTTP.Types.Status
 import           Network.HTTP.Types.URI    (renderSimpleQuery)
 import           Network.Wai
 import           Network.Wai.Middleware.RequestLogger (logStdout)
-import           Web.JWT                   (secret)
+import           Web.JWT                   (binarySecret)
 
 import           Data.Aeson
 import           Data.Aeson.Types          (emptyArray)
@@ -83,7 +83,7 @@ postgrest conf refDbStructure pool getTime =
     response <- case userApiRequest (configSchema conf) req body of
       Left err -> return $ apiRequestErrResponse err
       Right apiRequest -> do
-        let jwtSecret = secret <$> configJwtSecret conf
+        let jwtSecret = binarySecret <$> configJwtSecret conf
             eClaims = jwtClaims jwtSecret (iJWT apiRequest) time
             authed = containsRole eClaims
             handleReq = runWithClaims conf eClaims (app dbStructure conf) apiRequest

src/PostgREST/Config.hs

@@ -23,12 +23,14 @@ module PostgREST.Config ( prettyVersion
 
 import           System.IO.Error             (IOError)
 import           Control.Applicative
+import qualified Data.ByteString             as B
 import qualified Data.ByteString.Char8       as BS
 import qualified Data.CaseInsensitive        as CI
 import qualified Data.Configurator           as C
 import qualified Data.Configurator.Types     as C
 import           Data.List                   (lookup)
 import           Data.Text                   (strip, intercalate, lines)
+import           Data.Text.Encoding          (encodeUtf8)
 import           Data.Text.IO                (hPutStrLn)
 import           Data.Version                (versionBranch)
 import           Network.Wai
@@ -36,24 +38,27 @@ import           Network.Wai.Middleware.Cors (CorsResourcePolicy (..))
 import           Options.Applicative hiding  (str)
 import           Paths_postgrest             (version)
 import           Text.Heredoc
-import           Text.PrettyPrint.ANSI.Leijen hiding ((<>))
+import           Text.PrettyPrint.ANSI.Leijen hiding ((<>), (<$>))
 
 import           Protolude hiding            (intercalate
                                              , (<>))
 
 -- | Config file settings for the server
 data AppConfig = AppConfig {
-    configDatabase  :: Text
-  , configAnonRole  :: Text
-  , configProxyUri  :: Maybe Text
-  , configSchema    :: Text
-  , configHost      :: Text
-  , configPort      :: Int
-  , configJwtSecret :: Maybe Text
-  , configPool      :: Int
-  , configMaxRows   :: Maybe Integer
-  , configReqCheck  :: Maybe Text
-  , configQuiet     :: Bool
+    configDatabase          :: Text
+  , configAnonRole          :: Text
+  , configProxyUri          :: Maybe Text
+  , configSchema            :: Text
+  , configHost              :: Text
+  , configPort              :: Int
+
+  , configJwtSecret         :: Maybe B.ByteString
+  , configJwtSecretIsBase64 :: Bool
+
+  , configPool              :: Int
+  , configMaxRows           :: Maybe Integer
+  , configReqCheck          :: Maybe Text
+  , configQuiet             :: Bool
   }
 
 defaultCorsPolicy :: CorsResourcePolicy
@@ -105,12 +110,13 @@ readOptions = do
     cProxy    <- C.lookup conf "server-proxy-uri"
     -- jwt ---------------
     cJwtSec   <- C.lookup conf "jwt-secret"
+    cJwtB64   <- C.lookupDefault False conf "secret-is-base64"
     -- safety ------------
     cMaxRows  <- C.lookup conf "max-rows"
     cReqCheck <- C.lookup conf "pre-request"
 
     return $ AppConfig cDbUri cDbAnon cProxy cDbSchema cHost cPort
-          cJwtSec cPool cMaxRows cReqCheck False
+          (encodeUtf8 <$> cJwtSec) cJwtB64 cPool cMaxRows cReqCheck False
 
  where
   opts = info (helper <*> pathParser) $
@@ -156,6 +162,7 @@ readOptions = do
         |## choose a secret to enable JWT auth
         |## (use "@filename" to load from separate file)
         |# jwt-secret = "foo"
+        |# secret-is-base64 = false
         |
         |## limit rows in response
         |# max-rows = 1000