Commit Graph
8 Commits
Author SHA1 Message Date
Michał KłeczekandLaurence Isla 66161104bf refactor: Remove redundant VANull constructor in Auth.JWT module 2025-10-22 00:40:30 +00:00
Michał KłeczekandLaurence Isla 5a4e2e4dec refactor: Encapsulate aud config
This change is an initial step to change JWT aud configuration to regular expression.
Exporting function
audMatchesCfg :: AppConfig -> Text -> Bool
from Config module allows changing the way how JWT aud is configured to be isolated and not affect code in Auth.JWT
2025-10-22 00:40:30 +00:00
Michal KleczekandGitHub 77ff11de95 feat: JWT cache implementation based on sieve algorithm (#4084)
Changes:

1. Refactoring and some cleanup of JWT handling code:
* Instead of caching AuthResult cache decoded claims (which signature was verified). Validating claims and determining role is done after cache lookup
* Cleaned up API so that usage of it is simplified: lookupJwtCache cache key >>= parseClaims configJwtAud time
* Handling of JwtCacheState initialization and updates of configuration is encapsulated in Auth.JwtCache module

2. Generic high performance (hopefully) scalable, dynamically resizeable cache implementation based on stm, stm-hamt and sieve algorithm. It also integrates with PostgREST measurements infrastructure providing usage stats (ie. hit ratio, evictions count)
2025-07-29 18:51:41 -05:00
Michał KłeczekandSteve Chavez a409a2cb94 Extracted JWT validation functions to a separate module.
This change introduces a PostgREST.Auth.Jwt module containing JWT validation functions.

The reason to extract them from Auth is to enable JwtCache module to reuse them without introducing module dependency cycle.
2025-06-02 12:26:39 -05:00
Michal KleczekandGitHub 4d8502371d fix: purge JWT cache asynchronously in a separate thread
Otherwise performance was reduced unnecessarily.
2025-04-18 17:50:32 -05:00
Taimoor ZaeemandGitHub bc5ec43300 fix: invalid JWTs after jwt-secret is changed in a config reload (#4015) 2025-04-16 09:40:36 -05:00
Taimoor ZaeemandSteve Chavez 66e966d864 refactor: move jwt caching logic to Auth/JwtCache.hs 2025-02-17 14:19:40 -05:00
M. Taimoor ZaeemandSteve Chavez 3f78615dff refactor: move AuthResult to Auth/Types.hs module
The `AuthResult` type does not belong to AppState
module. This commit refactor this by moving it to
a new module `Auth/Types.hs`.
2025-02-04 11:56:42 -05:00