jimmy/postgrest
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
3,967 Commits 9 Branches 102 Tags
ad66ae4e740bc291d06fec0a56189b8a89e73180
Commit Graph
80 Commits
Author SHA1 Message Date
Laurence Isla e0c5b3a314 correct: handle array values in JWT aud claim correctly 2025-05-07 21:54:32 +00:00
Laurence Isla b3bff90d68 correct: fail on invalid types of registered JWT claims (exp, nbf, iat, aud) 2025-05-07 21:54:32 +00:00
Taimoor ZaeemandSteve Chavez 36b6a2c86b fix: improve jwt errors 2025-03-13 00:20:54 +01:00
Taimoor ZaeemandSteve Chavez 4ddf33df76 refactor: group jwt errors 2025-03-04 16:54:42 -05:00
Taimoor ZaeemandSteve Chavez 66e966d864 refactor: move jwt caching logic to Auth/JwtCache.hs 2025-02-17 14:19:40 -05:00
M. Taimoor ZaeemandSteve Chavez 3f78615dff refactor: move AuthResult to Auth/Types.hs module 
The `AuthResult` type does not belong to AppState
module. This commit refactor this by moving it to
a new module `Auth/Types.hs`.
 2025-02-04 11:56:42 -05:00
Taimoor ZaeemandGitHub 71a147392a fix: jwt cache is not purged (#3801) 2025-01-29 14:53:10 -05:00
M. Taimoor ZaeemandSteve Chavez af6b79d4d7 feat: support string comparison for jwt-role-claim-key 2024-12-12 08:47:06 -05:00
Wolfgang WaltherandWolfgang Walther 465170c7d6 refactor: Use jose-jwt instead of hs-jose 
This removes one more dependency on Template Haskell.
 2024-06-17 08:55:32 +02:00
steve-chavez 47e9a2d134 refactor: Listener to own module 2024-05-23 19:34:42 -05:00
Andrei DziahelandGitHub c3301a1653 feat: implement server-timing-enabled config parameter (#3064) 2023-11-22 17:57:50 -05:00
Taimoor ZaeemandGitHub a6e3eda5b2 feat: implement JWT caching (#2928) 2023-09-25 14:46:55 -03:00
Taimoor ZaeemandSteve Chavez c195eece65 feat: add Server-Timing header with JWT duration 2023-09-15 14:39:12 -03:00
steve-chavez c10ba8e214 fix: skew of 30 seconds for JWT validation 2023-04-27 21:06:06 -05:00
steve-chavez 4c555cbd5d refactor: authRole to ByteString 2023-04-15 18:05:04 -05:00
Robert Vollmert 2b8ffc8e61 src: update for changed map type in aeson-2 
This means that we're now using Data.Map.Strict instead of
Data.HashMap.Strict for JSON objects in general, and specifically
for claims maps and CSV rows.

This addresses certain hash flooding vulnerabilities, but may
have performance downsides.

Compare e.g. https://frasertweedale.github.io/blog-fp/posts/2021-10-12-aeson-hash-flooding-protection.html
 2022-06-13 13:25:54 +02:00
Robert Vollmert 5e6987b1d8 src: consistently import HashMap as HM, Map as M 
With both HashMap and Map imported as M in different modules,
linter rules prevented ever importing both modules in one place.
 2022-06-13 13:16:50 +02:00
Wolfgang Walther c3ade07ad6 feat: Make db-anon-role optional 
Without db-anon-role, PostgREST will block any anonymous access without hitting the database.

Resolves #1689, Ref #1823
 2022-01-22 15:59:26 +01:00
David LindbomWolfgang WaltherWolfgang Walther
 		3c17f97c87 refactor: Make JWT authorization a middleware 
This follows the style of wai-middleware-auth package and
makes the JWT parsing a middleware.

Co-authored-by: Wolfgang Walther <walther@technowledgy.de>
 2022-01-07 20:26:33 +01:00
Remo RechkemmerandGitHub f99fd6cbad refactor: Split up Types.hs and logically organize modules (#1793) 2021-04-11 18:28:01 +02:00
Remo RechkemmerandGitHub e6973f966b refactor: App.hs and related changes (#1725) 
* Use ExceptT to avoid 'staircasing' case analysis in App.hs
* Split large function in App.hs into individual handler functions
* Adapt API of Auth.hs, OpenApi.hs etc. to simplify the use of those modules in App.hs
* Split optional rollback functionality into Middleware
* Unify SimpleError and ApiRequestError into one Error type, so it can be used across modules
 2021-02-23 22:41:48 +01:00
steve-chavez 17af56adb1 refactor: config validation inside readAppConfig 
Remove Either from configJwtRoleClaimKey/configServerUnixSocketMode
and remove whenLefts.
 2021-01-22 15:56:08 -05:00
Wolfgang WaltherandWolfgang Walther 6dd126461e cov: Remove unused code 2021-01-14 16:40:29 +01:00
steve-chavez 0ff05edd16 refactor: move parseSecret out of App.postgrest 
parseSecret only needs to be computed once, after the config is read.
 2020-07-13 11:30:16 -05:00
steve-chavez 55b4f4fbe7 Fix expired JWTs starting an empty transaction 
Fixes https://github.com/PostgREST/postgrest/issues/1094.

Expired JWTs were doing an empty BEGIN/COMMIT in the db.
 2020-07-03 17:23:10 -05:00
Robert VollmertandSteve Chavez 3da5a2875e Update to protolude 0.3.0 
The good part is that protolude 0.3.0 builds with GHC 8.10.

The bad part is that this change is a bit painful:
- the default `toS` has changed to no longer convert to and from ByteString
- similarly, `show` no longer outputs ByteString

The changes here are pretty much minimal to keep things compiling; I didn't
see a nice way to work with the new ConvertText class, even though `toUtf8`
seems like it might help if used besides `toS` at just the right spots.
 2020-04-23 14:14:21 -05:00
Xavier FranciscoandSteve Chávez 28b3d6cafd Update stylish haskell config; apply all; add CI config (#1299) 
* Update config default; Copy non-defaults

* Update .stylish-haskell config version to match pgrst

* Apply stylish haskell to all files

* CircleCI config

* Remove redundant import.

What is used from Network.HTTP.Types.Headers is also exported by Network.HTTP.Types.

* Grouped imports

* Show un-styled files on CircleCI failure

* Fix styling imports

* Apply adhoc standard correctly
 2019-05-23 10:44:34 -05:00
Russell DaviesandSteve Chávez 473ac70789 Add support for parsing JSON Web Key Sets 2018-11-13 13:58:17 -05:00
steve-chavez dadfe965b9 Do hlint 2.1 hints 2018-11-06 11:54:10 -05:00
Steve ChávezandGitHub 0a1d83ce8f Fix JWTIssuedAtFuture for valid iat claim (#1166) 
* Add test for ensuring "iat" works with time cache
 2018-08-16 12:29:32 -05:00
steve-chavez f033c2c4b5 Add role-claim-key config value 2018-04-30 11:31:06 -05:00
steve-chavez 5c87fe2704 Add getCurrentTime cache for jwt validation 2018-04-30 11:31:06 -05:00
Ruslan TalpaandGitHub e4183780a9 Fix #1016 2017-12-12 15:31:39 +02:00
Pi3randJoe Nelson 2b5ae34c5a Update jose to 0.6 (#997) 2017-10-15 10:49:25 -04:00
Elliot MurphyandJoe Nelson 3ccae4bb8b Allow configurable audience claim (#975) 2017-09-26 07:29:20 -07:00
Joe NelsonandGitHub 0ed4215a0d Support asymmetric JWK (#919) 2017-08-09 08:42:00 -05:00
Ruslan TalpaandJoe Nelson 5fffbbe381 Make HTTP headers available as GUCs #800 (#849) 2017-04-10 19:23:48 -05:00
Joe Nelson c6cd8145eb Set request.jwt.claim.* 2016-10-17 22:32:36 -07:00
Joe Nelson 62ed9e2c4d Do not require jwt secret, but die on auth without it 2016-09-24 21:28:08 -07:00
Joe Nelson fb5fce026d Issue http 401 for expired jwt 
Fixes #512
 2016-09-24 21:28:08 -07:00
Diogo BiazusandJoe Nelson 6f737056a2 Protolude completion in library and executable (#697) 2016-08-21 15:10:19 -07:00
Diogo Biazus 0e172b8030 Port Auth to prolude 2016-06-29 09:25:57 -04:00
Jacky Hu cf4e157de7 Provide a swagger2 spec for the dynamic API 
Related issue: #144
 2016-06-18 10:18:43 +08:00
Joe Nelson c7d863c998 Merge pull request #605 from diogob/microlens 
Replace lens dependency for microlens
 2016-05-21 11:48:07 -07:00
Diogo Biazus b68fcd2522 Replace lens dependency for microlens 2016-05-21 13:31:39 -04:00
Diogo Biazus abd81c998b jwtClaims should always return Left for invalid JWT 2016-05-21 13:18:45 -04:00
Joe Nelson 18e3c30ad8 Return proper 401/403 when access denied 
Fixes #584
 2016-05-15 00:56:47 -07:00
Joe Nelson eae5857d0e Set role only once, and set it before other GUC vars (#560) 
* Set role only once, and set it before other GUC vars

Fixes #559

* Unify role/claim logic in claimsToSQL

Suggested by @diogob
 2016-04-15 07:30:36 -07:00
Joe Nelson 358254639a Merge @ruslantalpa's fk improved detection 2016-03-12 12:42:57 -08:00
Joe Nelson f67e195f76 Expose all claims via sql postgrest.claims 2016-03-11 20:51:22 -08:00