Where communities thrive


  • Join over 1.5M+ people
  • Join over 100K+ communities
  • Free without limits
  • Create your own community
People
Activity
    Gabriel Volpe
    @gvolpe
    @andreamarcolin I'll make a new release later this afternoon including your PR :tada:
    Andrea Marcolin
    @andreamarcolin
    Hello @gvolpe! I'm happy my PR looked great and got merged :) Thanks for the support, it was so quick!! Also, I was just thinking about the release, but it seems you are always a step ahead me ;) Thanks again!
    Gabriel Volpe
    @gvolpe
    No worries, thanks for contributing :) I'd make a release now but I'm just going out so I'll do it when I get back
    Andrea Marcolin
    @andreamarcolin
    No problems :) not urgent at all ;)
    On its way to Maven Central :)
    Andrea Marcolin
    @andreamarcolin
    🚀🚀🚀
    IvanFinochenko
    @IvanFinochenko
    Hello @gvolpe.
    You use a variable of type JwtPublicKey in the signature of the jwtEncode method by JwtAsymmetricAlgorithm. Why not a private key?
    Gabriel Volpe
    @gvolpe
    Hi @IvanFinochenko , that's the only one I needed but we can add support for a Private Key, if interested. PRs welcome :)
    Ryan Zeigler
    @rzeigler
    I'm intruiged. Going to poke around and see if I can use this to replace my own rolled version
    Gabriel Volpe
    @gvolpe
    Go for it @rzeigler 😉
    IvanFinochenko
    @IvanFinochenko
    @gvolpe , Hi, I created pull request profunktor/http4s-jwt-auth#49. Can you see, please?
    Gabriel Volpe
    @gvolpe
    Thanks @IvanFinochenko , I'll have a look whenever I find some time, already assigned myself to review it :)
    Gabriel Volpe
    @gvolpe
    Here's an overdue release, sorry for the delay: https://github.com/profunktor/http4s-jwt-auth/releases/tag/0.0.4
    /cc @IvanFinochenko
    IvanFinochenko
    @IvanFinochenko
    @gvolpe , thank you
    Gabriel Volpe
    @gvolpe
    :+1:
    Raphael Parree
    @rparree
    If i want to access custom fields, is the only way possible to take the claim's content (String) and use a Json parser (i'm using circe)?
    Gabriel Volpe
    @gvolpe
    That's correct @rparree

    Happy to add a function

     def jwtDecodeAs[F[_]: ApplicativeError[*[_], Throwable], A: Decoder](
          jwtToken: JwtToken,
          jwtAuth: JwtAuth
      ): F[A] = ???

    If that's helpful. Contributions welcome :)

    Raphael Parree
    @rparree
    let me have a look this week, might add something like that. I guess you want to stay independent of the json parser, or is a dependency with circe fine?
    Gabriel Volpe
    @gvolpe
    yeah that's a good point, probably not worth it because it must be another module
    kyri-petrou
    @kyri-petrou:matrix.org
    [m]

    Hey there 👋 I've been trying to implement the JWT middleware (after learning about it in the PFPv2 book gvolpe 🙌) for a Firebase-based app which uses an asymmetric JWT.

    I don't seem to be able to figure out an elegant solution on how to make the middleware obtain a new public key when the current one expires (the caching is not the issue).

    If it's not possible through some clever wrapping of the middleware or similar, could another constructor that passes JwtAuth by-name work here?

    gvolpe
    @gvolpe:matrix.org
    [m]
    I would probably create my own middleware in that case. Are you saying the JwtAuth instance needs to be a different one every time you get a new public key? If so, you need to keep track of the state. Using a Ref this is quite easy but I would suggest hiding the implementation details behind an interface. E.g.
    trait AuthKeyHandler[F[_]]: 
      def get: F[JwtAuth]
      def refresh: F[JwtAuth] // or F[Unit] depending on your use case
    
    object AuthKeyHandler:
      def make[F[_]: Monad: Ref.Make](
          initial: JwtAuth
      ): F[AuthKeyHandler[F]] =
        Ref.of[F, JwtAuth](initial).map { ref => new:
          def get: F[JwtAuth] = ref.get
          def refresh: F[JwtAuth] = getPublicKey >>= ref.set
        }
    kyri-petrou
    @kyri-petrou:matrix.org
    [m]

    Awesome, thanks! I ended up doing something very similar at the end (I was paying attention while reading your book afterall!).

    That “AuthKeyHandler” in my case had to hide quite a lot having to also deal with Google’s insanity that they return a map of certificates that need to be converted into public keys which also expire every 6 hours 🥲

    And you need to take the kid from the token and take the correct certificate for it from the map they return
    gvolpe
    @gvolpe:matrix.org
    [m]
    Definitely a good call to hide all that behind an interface :)
    kyri-petrou
    @kyri-petrou:matrix.org
    [m]
    Yeah at the end it was just an F[JwtAuth] returned from the interface which I thought was quite elegant but happy to see that your suggestion led to the same!
    Thanks a bunch again, and by the way if you need any extra hands with any other library just give me a ping, happy to help
    gvolpe
    @gvolpe:matrix.org
    [m]
    Thanks appreciate it :)