Closed frasertweedale closed 8 years ago
I’m thinking about writing a PR to implement this feature, and before I start I’d like to ask you to consider a counter-proposal:
Create a monad class something like: class HasCurrentTime m where getCurrentTime :: m UTCTime
and define instances for IO
and ReaderT UTCTime
.
Then update validateJWSJWT
to have type:
validateJWSJWT :: HasCurrentTime m
=> ValidationAlgorithms
-> ValidationPolicy
-> JWK
-> JWT
-> m Bool
And provide a new function validateJWSJWTWithTime
with type (identical to your proposal for validateJWSJWT
above):
validateJWSJWTWithTime :: ValidationAlgorithms
-> ValidationPolicy
-> JWK
-> UTCTime
-> JWT
-> Bool
If you think this is a good idea, I can go ahead with it. If you have suggestions for improving it, I would love to hear them. If you think it’s a terrible idea, please let me know why. If you like the idea, but don’t want HasCurrentTime defined in this library, I can create a separate helper package for that class.
I find this library to be the best-written of the options available, and am eager to use it in production, but need this feature implemented before I can do so. Please share your thoughts.
I like the HasCurrentTime m
approach. Should see if any existing lib provides something like this, otherwise I'm happy for jose itself to provide it (and use it for this feature).
After a little more digging, I found https://hackage.haskell.org/package/monad-time. Unless you have an objection, I’ll use that.
@whittle merged the PR; thanks a bunch! I am going to try to push jose forward a bit more over the coming weeks so some types may change a bit. I will probably avoid exporting validateClaimsSet, or move it to an 'Internal' module.
I added allowed-skew already :)
Type of JWT validator is currently:
Propose implementing the "nbf" and "exp" checks required by the spec by updating
validateJWSJWT
to have type such as:And providing a new function in IO that uses the current time: