File Coverage

blib/lib/Plack/Middleware/Auth/JWT.pm

Criterion	Covered	Total	%
statement	75	77	97.4
branch	41	46	89.1
condition	9	11	81.8
subroutine	12	12	100.0
pod	2	3	66.6
total	139	149	93.2

package Plack::Middleware::Auth::JWT;

# ABSTRACT: Token-based Auth (aka Bearer Token) using JSON Web Tokens (JWT)
our $VERSION = '0.907'; # VERSION

use 5.010;
use strict;
use warnings;
use parent qw(Plack::Middleware);
use Plack::Util;
use Plack::Util::Accessor
    qw(decode_args decode_callback psgix_claims psgix_token token_required ignore_invalid_token token_header_name token_query_name _env);
use Plack::Request;
use Crypt::JWT 0.020 qw(decode_jwt);
use JSON qw(encode_json);

sub prepare_app {
    my $self = shift;

    # some defaults
    $self->psgix_claims('claims') unless $self->psgix_claims;
    $self->psgix_token('token')   unless $self->psgix_token;

    $self->token_header_name('bearer')
        unless defined $self->token_header_name;
    $self->token_header_name(undef)  unless $self->token_header_name;
    $self->token_query_name('token') unless defined $self->token_query_name;
    $self->token_query_name(undef)   unless $self->token_query_name;
    $self->token_required(0)         unless defined $self->token_required;
    $self->ignore_invalid_token(0)   unless defined $self->ignore_invalid_token;

    # either decode_args or decode_callback is required
    if ( my $cb = $self->decode_callback ) {
        die "decode_callback must be a code reference"
            unless ref($cb) eq 'CODE';
    }
    elsif ( my $args = $self->decode_args ) {
        $args->{decode_payload} = 1;
        $args->{decode_header}  = 0;
        $args->{verify_exp}     = 1 unless exists $args->{verify_exp};
        $args->{leeway}         = 5 unless exists $args->{leeway};
    }
    else {
        die
            "Either decode_callback or decode_args has to be defined when loading this Middleware";
    }
}

sub call {
    my ( $self, $env ) = @_;
    $self->_env($env);

    my $token;

    if ( $self->token_header_name && $env->{HTTP_AUTHORIZATION} ) {
        my $name = $self->token_header_name;
        my $auth = $env->{HTTP_AUTHORIZATION};
        $token = $1 if $auth =~ /^\s*$name\s+(.+)/i;
    }
    elsif ( my $name = $self->token_query_name ) {
        my $req = Plack::Request->new($env);
        $token = $req->query_parameters->get($name);
    }

    unless ($token) {
        return $self->unauthorized if $self->token_required;

        # no token found, but non required, so just call the app
        return $self->app->($env);
    }

    my $claims = eval {
        if ( my $cb = $self->decode_callback ) {
            return $cb->( $token, $env );
        }
        else {
            return decode_jwt( token => $token, %{ $self->decode_args } );
        }
    };
    if ($@ || !$claims) {
        my $e = $@;
        if ($self->ignore_invalid_token) {
            return $self->app->($env);
        }
        else {
            $e =~ s/ at .*$//; # don't leak implementation detail on error!
            return $self->unauthorized( 'Invalid token: ' . $e );
        }
    }
    else {
        $env->{ 'psgix.' . $self->psgix_token }  = $token;
        $env->{ 'psgix.' . $self->psgix_claims } = $claims;
        return $self->app->($env);
    }

    # should never be reached, but just to make sure...
    return $self->unauthorized;
}

sub unauthorized {
    my $self = shift;
    my $body = shift || 'Authorization required';

    my $env = $self->_env;
    if ($env->{HTTP_ACCEPT} && $env->{HTTP_ACCEPT} =~ m{application/json}i ) {
        my $ident = $body =~/exp claim check failed/ ? 'token_expired' : 'token_invalid';
        my $data = encode_json({
            ident=>$ident,
            message=>$body,
        });
        return [
            401,
            [   'Content-Type'   => 'application/json',
                'Content-Length' => length $data
            ],
            [$data]
        ];
    }
    else {
        return [
            401,
            [   'Content-Type'   => 'text/plain',
                'Content-Length' => length $body
            ],
            [$body]
        ];
    }
}

1;

__END__