move JWT/Bcrypt inside zm_crypt

src/zm_crypt.cpp

@@ -1,25 +1,59 @@
 #include "zm.h"
 # include "zm_crypt.h"
+#include "BCrypt.hpp"
+#include "jwt.h"
 #include <algorithm>
 
 
+// returns username if valid, "" if not
+std::string verifyToken(std::string jwt_token_str, std::string key) {
+  std::string username = "";
+  try {
+    // is it decodable?
+    auto decoded = jwt::decode(jwt_token_str);
+    auto verifier = jwt::verify()
+                        .allow_algorithm(jwt::algorithm::hs256{ key })
+                        .with_issuer("ZoneMinder");
   
+    // signature verified?
+    verifier.verify(decoded);
 
+    // make sure it has fields we need
+    if (decoded.has_payload_claim("type")) {
+      std::string type = decoded.get_payload_claim("type").as_string();
+      if (type != "access") {
+        Error ("Only access tokens are allowed. Please do not use refresh tokens");
+        return "";
+      }
+    }
+    else {
+      // something is wrong. All ZM tokens have type
+      Error ("Missing token type. This should not happen");
+      return "";
+    }
+    if (decoded.has_payload_claim("user")) {
+      username  = decoded.get_payload_claim("user").as_string();
+      Info ("Got %s as user claim from token", username.c_str());
+    } 
+    else {
+      Error ("User not found in claim");
+      return "";
+    }
+  } // try
+  catch (const std::exception &e) {
+      Error("Unable to verify token: %s", e.what());
+      return "";
+  }
+  catch (...) {
+     Error ("unknown exception");
+     return "";
 
-std::string createToken() {
-  std::string token = jwt::create()
-                        .set_issuer("auth0")
-                        //.set_expires_at(jwt::date(expiresAt))
-                        //.set_issued_at(jwt::date(tp))
-                        //.set_issued_at(jwt::date(std::chrono::system_clock::now()))
-                        //.set_expires_at(jwt::date(std::chrono::system_clock::now()+std::chrono::seconds{EXPIRY}))
-                        .sign(jwt::algorithm::hs256{"secret"});
-  return token;
+  }
+  return username;
 }
 
 bool verifyPassword(const char *username, const char *input_password, const char *db_password_hash) {
   bool password_correct = false;
-  Info ("JWT created as %s",createToken().c_str());
   if (strlen(db_password_hash ) < 4) {
     // actually, shoud be more, but this is min. for next code
     Error ("DB Password is too short or invalid to check");

src/zm_crypt.h

@@ -23,10 +23,9 @@
 
 #include <string.h>
 #include <openssl/sha.h>
-#include "BCrypt.hpp"
-#include "jwt.h"
+
 
 bool verifyPassword( const char *username, const char *input_password, const char *db_password_hash);
-std::string createToken();
 
+std::string verifyToken(std::string token, std::string key);
 #endif // ZM_CRYPT_H

src/zm_user.cpp

@@ -142,6 +142,7 @@ User *zmLoadUser( const char *username, const char *password ) {
 User *zmLoadTokenUser (std::string jwt_token_str, bool use_remote_addr ) {
   std::string key = config.auth_hash_secret;
   std::string remote_addr = "";
+  
   if (use_remote_addr) {
     remote_addr = std::string(getenv( "REMOTE_ADDR" ));
     if ( remote_addr == "" ) {
@@ -153,35 +154,8 @@ User *zmLoadTokenUser (std::string jwt_token_str, bool use_remote_addr ) {
 
   Info ("Inside zmLoadTokenUser, formed key=%s", key.c_str());
 
-  try {
-
-    auto decoded = jwt::decode(jwt_token_str);
-    auto verifier = jwt::verify()
-                        .allow_algorithm(jwt::algorithm::hs256{ key })
-                        .with_issuer("ZoneMinder");
-  
-    verifier.verify(decoded);
-    
-    // token is valid and not expired
-
-    if (decoded.has_payload_claim("type")) {
-       std::string type = decoded.get_payload_claim("type").as_string();
-       if (type != "access") {
-         Error ("Only access tokens are allowed. Please do not use refresh tokens");
-         return 0;
-       }
-    }
-    else {
-      // something is wrong. All ZM tokens have type
-      Error ("Missing token type. This should not happen");
-      return 0;
-    }
-    if (decoded.has_payload_claim("user")) {
-
-      // We only need to check if user is enabled in DB and pass on
-      // correct access permissions
-      std::string username = decoded.get_payload_claim("user").as_string();
-      Info ("Got %s as user claim from token", username.c_str());
+  std::string username = verifyToken(jwt_token_str, key);
+  if (username != "") {
     char sql[ZM_SQL_MED_BUFSIZ] = "";
     snprintf(sql, sizeof(sql),
       "SELECT Id, Username, Enabled, Stream+0, Events+0, Control+0, Monitors+0, System+0, MonitorIds"
@@ -213,20 +187,9 @@ User *zmLoadTokenUser (std::string jwt_token_str, bool use_remote_addr ) {
 
   }
   else {
-      Error ("User not found in claim");
-      return 0;
+    return NULL;
   }
 
-  }
-  catch (const std::exception &e) {
-      Error("Unable to verify token: %s", e.what());
-      return 0;
-  }
-  catch (...) {
-     Error ("unknown exception");
-
-  }
-  return 0;
 }
  
 // Function to validate an authentication string