16366cf9f2
https://github.com/zed-industries/zed/issues/30972 brought up another case where our context is not enough to track the actual source of the issue: we get a general top-level error without inner error. The reason for this was `.ok_or_else(|| anyhow!("failed to read HEAD SHA"))?; ` on the top level. The PR finally reworks the way we use anyhow to reduce such issues (or at least make it simpler to bubble them up later in a fix). On top of that, uses a few more anyhow methods for better readability. * `.ok_or_else(|| anyhow!("..."))`, `map_err` and other similar error conversion/option reporting cases are replaced with `context` and `with_context` calls * in addition to that, various `anyhow!("failed to do ...")` are stripped with `.context("Doing ...")` messages instead to remove the parasitic `failed to` text * `anyhow::ensure!` is used instead of `if ... { return Err(...); }` calls * `anyhow::bail!` is used instead of `return Err(anyhow!(...));` Release Notes: - N/A
110 lines
2.9 KiB
Rust
110 lines
2.9 KiB
Rust
use anyhow::Result;
|
|
use jsonwebtoken::{DecodingKey, EncodingKey, Header, Validation};
|
|
use serde::{Deserialize, Serialize};
|
|
use std::{
|
|
borrow::Cow,
|
|
ops::Add,
|
|
time::{Duration, SystemTime, UNIX_EPOCH},
|
|
};
|
|
|
|
const DEFAULT_TTL: Duration = Duration::from_secs(6 * 60 * 60); // 6 hours
|
|
|
|
#[derive(Default, Serialize, Deserialize)]
|
|
#[serde(rename_all = "camelCase")]
|
|
pub struct ClaimGrants<'a> {
|
|
pub iss: Cow<'a, str>,
|
|
pub sub: Option<Cow<'a, str>>,
|
|
pub iat: u64,
|
|
pub exp: u64,
|
|
pub nbf: u64,
|
|
pub jwtid: Option<Cow<'a, str>>,
|
|
pub video: VideoGrant<'a>,
|
|
}
|
|
|
|
#[derive(Default, Serialize, Deserialize)]
|
|
#[serde(rename_all = "camelCase")]
|
|
pub struct VideoGrant<'a> {
|
|
pub room_create: Option<bool>,
|
|
pub room_join: Option<bool>,
|
|
pub room_list: Option<bool>,
|
|
pub room_record: Option<bool>,
|
|
pub room_admin: Option<bool>,
|
|
pub room: Option<Cow<'a, str>>,
|
|
pub can_publish: Option<bool>,
|
|
pub can_subscribe: Option<bool>,
|
|
pub can_publish_data: Option<bool>,
|
|
pub hidden: Option<bool>,
|
|
pub recorder: Option<bool>,
|
|
}
|
|
|
|
impl<'a> VideoGrant<'a> {
|
|
pub fn to_admin(room: &'a str) -> Self {
|
|
Self {
|
|
room_admin: Some(true),
|
|
room: Some(Cow::Borrowed(room)),
|
|
..Default::default()
|
|
}
|
|
}
|
|
|
|
pub fn to_join(room: &'a str) -> Self {
|
|
Self {
|
|
room: Some(Cow::Borrowed(room)),
|
|
room_join: Some(true),
|
|
can_publish: Some(true),
|
|
can_subscribe: Some(true),
|
|
..Default::default()
|
|
}
|
|
}
|
|
|
|
pub fn for_guest(room: &'a str) -> Self {
|
|
Self {
|
|
room: Some(Cow::Borrowed(room)),
|
|
room_join: Some(true),
|
|
can_publish: Some(false),
|
|
can_subscribe: Some(true),
|
|
..Default::default()
|
|
}
|
|
}
|
|
}
|
|
|
|
pub fn create(
|
|
api_key: &str,
|
|
secret_key: &str,
|
|
identity: Option<&str>,
|
|
video_grant: VideoGrant,
|
|
) -> Result<String> {
|
|
if video_grant.room_join.is_some() && identity.is_none() {
|
|
anyhow::bail!("identity is required for room_join grant, but it is none");
|
|
}
|
|
|
|
let now = SystemTime::now();
|
|
|
|
let claims = ClaimGrants {
|
|
iss: Cow::Borrowed(api_key),
|
|
sub: identity.map(Cow::Borrowed),
|
|
iat: now.duration_since(UNIX_EPOCH).unwrap().as_secs(),
|
|
exp: now
|
|
.add(DEFAULT_TTL)
|
|
.duration_since(UNIX_EPOCH)
|
|
.unwrap()
|
|
.as_secs(),
|
|
nbf: 0,
|
|
jwtid: identity.map(Cow::Borrowed),
|
|
video: video_grant,
|
|
};
|
|
Ok(jsonwebtoken::encode(
|
|
&Header::default(),
|
|
&claims,
|
|
&EncodingKey::from_secret(secret_key.as_ref()),
|
|
)?)
|
|
}
|
|
|
|
pub fn validate<'a>(token: &'a str, secret_key: &str) -> Result<ClaimGrants<'a>> {
|
|
let token = jsonwebtoken::decode(
|
|
token,
|
|
&DecodingKey::from_secret(secret_key.as_ref()),
|
|
&Validation::default(),
|
|
)?;
|
|
|
|
Ok(token.claims)
|
|
}
|