graphql-engine/server/src-lib/Hasura/Server/Auth/JWT/Logging.hs
Anon Ray 75090d51b9 jwt config now takes a jwk url (close #465) (#527)
JWT config now takes an optional jwk_url parameter (which points to published JWK Set). This is useful for providers who rotate their JWK Set.

Optional jwk_url parameter is taken. The published JWK set under that URL should be in standard JWK format (tools.ietf.org/html/rfc7517#section-4.8).

If the response contains an Expires header, the JWK set is automatically refreshed.
2018-09-27 16:52:49 +05:30

56 lines
1.6 KiB
Haskell

{-# LANGUAGE OverloadedStrings #-}
module Hasura.Server.Auth.JWT.Logging
( JwkRefreshLog (..)
, JwkRefreshHttpError (..)
, mkJwkRefreshLog
)
where
import Data.Aeson
import Hasura.Logging (LogLevel (..), ToEngineLog (..))
import Hasura.Prelude
import Hasura.Server.Logging ()
import qualified Data.Text as T
import qualified Network.HTTP.Client as HTTP
import qualified Network.HTTP.Types as HTTP
data JwkRefreshLog
= JwkRefreshLog
{ jrlLogLevel :: !LogLevel
, jrlError :: !T.Text
, jrlHttpError :: !(Maybe JwkRefreshHttpError)
} deriving (Show)
data JwkRefreshHttpError
= JwkRefreshHttpError
{ jrheStatus :: !(Maybe HTTP.Status)
, jrheUrl :: !T.Text
, jrheHttpException :: !(Maybe HTTP.HttpException)
, jrheResponse :: !(Maybe T.Text)
} deriving (Show)
instance ToJSON JwkRefreshHttpError where
toJSON jhe =
object [ "status_code" .= (HTTP.statusCode <$> jrheStatus jhe)
, "url" .= jrheUrl jhe
, "response" .= jrheResponse jhe
, "http_exception" .= (toJSON <$> jrheHttpException jhe)
]
instance ToJSON JwkRefreshLog where
toJSON jrl =
object [ "error" .= jrlError jrl
, "http_error" .= (toJSON <$> jrlHttpError jrl)
]
instance ToEngineLog JwkRefreshLog where
toEngineLog jwkRefreshLog =
(jrlLogLevel jwkRefreshLog, "jwk-refresh-log", toJSON jwkRefreshLog)
mkJwkRefreshLog :: T.Text -> Maybe JwkRefreshHttpError -> JwkRefreshLog
mkJwkRefreshLog = JwkRefreshLog (LevelOther "critical")