bitwarden_core/auth/
jwt_token.rs

1use std::str::FromStr;
2
3use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine};
4use thiserror::Error;
5
6/// A Bitwarden secrets manager JWT Token.
7///
8/// References:
9/// - <https://github.com/bitwarden/server/blob/419760623a7af5f5d0cbdfeb2a7aba8c3608d880/src/Identity/IdentityServer/ClientStore.cs#L125-L126>
10/// - <https://github.com/bitwarden/server/blob/419760623a7af5f5d0cbdfeb2a7aba8c3608d880/src/Identity/IdentityServer/ClientStore.cs#L133>
11///
12/// TODO: We need to expand this to support user based JWT tokens.
13#[derive(serde::Deserialize)]
14pub struct JwtToken {
15    /// Expiration Time.
16    pub exp: u64,
17    /// Subject.
18    pub sub: String,
19    /// User's email.
20    pub email: Option<String>,
21    /// Used by Service Accounts to denote the organization.
22    pub organization: Option<String>,
23    /// The scopes the token has access to.
24    pub scope: Vec<String>,
25}
26
27/// Error when parsing JWT tokens.
28#[allow(missing_docs)]
29#[derive(Debug, Error)]
30pub enum JwtTokenParseError {
31    #[error("JWT token parse error: {0}")]
32    Parse(#[from] serde_json::Error),
33    #[error("JWT token decode error: {0}")]
34    Decode(#[from] base64::DecodeError),
35
36    #[error("JWT token has an invalid number of parts")]
37    InvalidParts,
38}
39
40impl FromStr for JwtToken {
41    type Err = JwtTokenParseError;
42
43    /// Parses a JWT token from a string.
44    ///
45    /// **Note:** This function does not validate the token signature.
46    fn from_str(s: &str) -> Result<Self, Self::Err> {
47        let split = s.split('.').collect::<Vec<_>>();
48        if split.len() != 3 {
49            return Err(Self::Err::InvalidParts);
50        }
51        let decoded = URL_SAFE_NO_PAD.decode(split[1])?;
52        Ok(serde_json::from_slice(&decoded)?)
53    }
54}
55
56#[cfg(test)]
57mod tests {
58    use crate::auth::jwt_token::JwtToken;
59
60    #[test]
61    fn can_decode_jwt() {
62        let jwt = "eyJhbGciOiJSUzI1NiIsImtpZCI6IjMwMURENkE1MEU4NEUxRDA5MUM4MUQzQjAwQkY5MDEwQz\
63        g1REJEOUFSUzI1NiIsInR5cCI6ImF0K2p3dCIsIng1dCI6Ik1CM1dwUTZFNGRDUnlCMDdBTC1RRU1oZHZabyJ9.eyJu\
64        YmYiOjE2NzUxMDM1NzcsImV4cCI6MTY3NTEwNzE3NywiaXNzIjoiaHR0cDovL2xvY2FsaG9zdCIsImNsaWVudF9pZCI\
65        6IndlYiIsInN1YiI6ImUyNWQzN2YzLWI2MDMtNDBkZS04NGJhLWFmOTYwMTJmNWE0MiIsImF1dGhfdGltZSI6MTY3NT\
66        EwMzU0OSwiaWRwIjoiYml0d2FyZGVuIiwicHJlbWl1bSI6ZmFsc2UsImVtYWlsIjoidGVzdEBiaXR3YXJkZW4uY29tI\
67        iwiZW1haWxfdmVyaWZpZWQiOnRydWUsInNzdGFtcCI6IkUzNElDWVhRUFRDS01EVldBREZDNktHNDJCQldJRDdJIiwi\
68        bmFtZSI6IlRlc3QiLCJvcmdvd25lciI6ImY0ZTQ0YTdmLTExOTAtNDMyYS05ZDRhLWFmOTYwMTMxMjdjYiIsImRldml\
69        jZSI6Ijg5Mjg5M2FiLWRkNDMtNDUwYS04NGI1LWFhOWM1YjdiYjJkOCIsImp0aSI6IkEzMkVFNjY5NDdEQzlDNUE2MT\
70        IwRURBRTIwNzc5OUJFIiwiaWF0IjoxNjc1MTAzNTc3LCJzY29wZSI6WyJhcGkiLCJvZmZsaW5lX2FjY2VzcyJdLCJhb\
71        XIiOlsiQXBwbGljYXRpb24iXX0.AyDkKvjmyaSPQViQSa2sGTKIkDGrUAtDmwpE57K4DDWT0QvwDe7FMktmwiF4LH36\
72        wx_FnpH21VI1pzwJeTHXtaz3niANJtQZjzGFsNAna_95vrsxZC2YizgGlt6mX4YIGmAw9DiYrmaN0BvQOEm_caV_u6f\
73        a30iz9Kvjxf7cpzeZvPEysxGpB3k3TRYTkFUdV43HiXdhXMBhyyOpFU6Fk6yA41y7-8bGYc5mYGknWktmPD9Yx-1xKL\
74        ftFja1SnCoLPWvDeK60lqWZQiT4tZHCYJ7m0bBNCccYHc2Kk2Bo5-UoyDxazPwsqMxeNfjlaUuj3o5N_uQ-4n_gVbeA\
75        qWV2wrel5UhYjWnczMSLBtt9p0W35kkBPt3ZAnRWMtQMPNH04p-_L6cG-Xu6lDksBTwaavcmtnCKG8V91826EiQ8MrF\
76        wGWQRZV6tPKTDAYCgSAZGBY3QDmPGT5BeFcg5Ag_nYYIIifKP-kv10v_N-TOcT3NeGBOUlAZ-9m7iT7Rk3vC--SDZdA\
77        U5turoBFiiPL2XXfAjM7P0r7J91gfXc0FaD6I2jDxOmym5h7Yn5phLsbC2NlIXkZp54dKHICenPl4ve6ndDIJacVeS5\
78        f3LEddAPV8cAFza4DjA8pZJLFrMyRvMXcL_PjKF8qPVzqVWh03lfJ4clOIxR2gOuWIc902Y5E";
79
80        let token: JwtToken = jwt.parse().unwrap();
81        assert_eq!(token.exp, 1675107177);
82        assert_eq!(token.sub, "e25d37f3-b603-40de-84ba-af96012f5a42");
83        assert_eq!(token.email.as_deref(), Some("[email protected]"));
84        assert_eq!(token.organization.as_deref(), None);
85        assert_eq!(token.scope[0], "api");
86        assert_eq!(token.scope[1], "offline_access");
87    }
88}
bitwarden_core/auth/jwt_token.rs

bitwarden_core/auth/
jwt_token.rs
