search

clockworklabs / SpacetimeDB

Multiplayer at the speed of light
https://spacetimedb.com
Other
4.41k stars 110 forks source link

Clean up auth related code with traits, and reuse existing key generation code. #1988

Closed jsdt closed 1 week ago

jsdt commented 1 week ago

Description of Changes

This is an attempt to clean up auth-related code. To summarize the main changes:

  1. We don't use a global OIDC key cache any more.
  2. The 4 JWT related functions in the NodeDelegate trait were removed, and the functionality was put in the JwtAuthProvider trait. NodeDelegate now just has one function to return an auth provider. This should make it easier to change this in the future. The new trait also exposes functions for signing and verifying keys, rather than giving the concrete keys.
  3. SpacetimeIdentityClaims2 is now the only SpacetimeIdentityClaims.
  4. Instead of using jsonwebkey in the token validation tests, we use the same key generate code that is used for standalone key generation. There were some small changes to the key generate code to make it easier to reuse.

There is a corresponding private PR.

API and ABI breaking changes

None.

Expected complexity level and risk

  1. This is close to functionally equivalent, and should make future auth changes less complex.

Testing

Most of the unit tests for this code are in token_validation.rs.