Skip to content

Commit 3347bb7

Browse files
peter-evanspeter-evans
committed
Revised claim rules format
1 parent b22e4ec commit 3347bb7

2 files changed

Lines changed: 100 additions & 54 deletions

File tree

‎paseto/v2.lua‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -149,14 +149,14 @@ local function validate_claims(payload_claims, claim_rules)
149149
if type(claim_rules) ~= "table" then
150150
return false, "Invalid claim rules format"
151151
end
152-
for key, value in pairs(claim_rules) do
153-
if registered_claims[key] ~= nil then
154-
local valid, err = registered_claims[key](payload_claims, value)
152+
for _, rule in pairs(claim_rules) do
153+
if registered_claims[rule.claim] ~= nil then
154+
local valid, err = registered_claims[rule.claim](payload_claims, rule.value)
155155
if valid == false then
156156
return false, err
157157
end
158158
else
159-
local matches, err = claim_matches_expected_value(payload_claims, key, value)
159+
local matches, err = claim_matches_expected_value(payload_claims, rule.claim, rule.value)
160160
if matches == false then
161161
return false, err
162162
end

‎spec/paseto.v2_spec.lua‎

Lines changed: 96 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -156,7 +156,10 @@ describe("v2 protocol standard API", function()
156156

157157
it("should encrypt and decrypt payload claims successfully with claims validation", function()
158158
local token = paseto.encrypt(key, payload_claims)
159-
local claim_rules = { data = "this is a secret message", myclaim = "validate this" }
159+
local claim_rules = {
160+
claim_1 = { claim = "data", value = "this is a secret message" },
161+
claim_2 = { claim = "myclaim", value = "validate this" }
162+
}
160163
local decrypted_claims = paseto.decrypt(key, token, claim_rules)
161164
assert.equal("table", type(decrypted_claims))
162165
assert.equal(#payload_claims, #decrypted_claims)
@@ -167,13 +170,13 @@ describe("v2 protocol standard API", function()
167170
payload_claims["exp"] = date(os.time()):addminutes(10):fmt("${iso}%z")
168171
local token = paseto.encrypt(key, payload_claims)
169172
local claim_rules = {
170-
ForAudience = "some-audience.com",
171-
IdentifiedBy = "87IFSGFgPNtQNNuw0AtuLttP",
172-
IssuedBy = "paragonie.com",
173-
Subject = "test",
174-
NotExpired = true,
175-
ValidAt = true,
176-
ContainsClaim = "data"
173+
claim_1 = { claim = "IssuedBy", value = "paragonie.com" },
174+
claim_2 = { claim = "IdentifiedBy", value = "87IFSGFgPNtQNNuw0AtuLttP" },
175+
claim_3 = { claim = "ForAudience", value = "some-audience.com" },
176+
claim_4 = { claim = "Subject", value = "test" },
177+
claim_5 = { claim = "NotExpired", value = "" },
178+
claim_6 = { claim = "ValidAt", value = "" },
179+
claim_7 = { claim = "ContainsClaim", value = "data" }
177180
}
178181
local decrypted_claims = paseto.decrypt(key, token, claim_rules)
179182
assert.equal("table", type(decrypted_claims))
@@ -191,31 +194,41 @@ describe("v2 protocol standard API", function()
191194

192195
it("should raise error 'Missing required claim 'required_claim''", function()
193196
local token = paseto.encrypt(key, payload_claims)
194-
local claim_rules = { required_claim = "this is a secret message", myclaim = "validate this" }
197+
local claim_rules = {
198+
claim_1 = { claim = "required_claim", value = "this is a secret message" },
199+
claim_2 = { claim = "myclaim", value = "validate this" }
200+
}
195201
local decrypted_claims, err = paseto.decrypt(key, token, claim_rules)
196202
assert.equal(nil, decrypted_claims)
197203
assert.equal("Missing required claim 'required_claim'", err)
198204
end)
199205

200206
it("should raise error 'Claim 'myclaim' does not match the expected value'", function()
201207
local token = paseto.encrypt(key, payload_claims)
202-
local claim_rules = { data = "this is a secret message", myclaim = "invalid" }
208+
local claim_rules = {
209+
claim_1 = { claim = "data", value = "this is a secret message" },
210+
claim_2 = { claim = "myclaim", value = "invalid" }
211+
}
203212
local decrypted_claims, err = paseto.decrypt(key, token, claim_rules)
204213
assert.equal(nil, decrypted_claims)
205214
assert.equal("Claim 'myclaim' does not match the expected value", err)
206215
end)
207216

208217
it("should raise error 'Claim 'aud' does not match the expected value' when validating rule 'ForAudience'", function()
209218
local token = paseto.encrypt(key, payload_claims)
210-
local claim_rules = { ForAudience = "some-other-audience.com" }
219+
local claim_rules = {
220+
claim_1 = { claim = "ForAudience", value = "some-other-audience.com" }
221+
}
211222
local decrypted_claims, err = paseto.decrypt(key, token, claim_rules)
212223
assert.equal(nil, decrypted_claims)
213224
assert.equal("Claim 'aud' does not match the expected value", err)
214225
end)
215226

216227
it("should raise error 'Missing required claim 'exp''", function()
217228
local token = paseto.encrypt(key, {})
218-
local claim_rules = { NotExpired = true }
229+
local claim_rules = {
230+
claim_1 = { claim = "NotExpired", value = "" }
231+
}
219232
local decrypted_claims, err = paseto.decrypt(key, token, claim_rules)
220233
assert.equal(nil, decrypted_claims)
221234
assert.equal("Missing required claim 'exp'", err)
@@ -224,7 +237,9 @@ describe("v2 protocol standard API", function()
224237
it("should raise error 'Token has expired'", function()
225238
payload_claims["exp"] = date(os.time()):addseconds(-1):fmt("${iso}%z")
226239
local token = paseto.encrypt(key, payload_claims)
227-
local claim_rules = { NotExpired = true }
240+
local claim_rules = {
241+
claim_1 = { claim = "NotExpired", value = "" }
242+
}
228243
local decrypted_claims, err = paseto.decrypt(key, token, claim_rules)
229244
assert.equal(nil, decrypted_claims)
230245
assert.equal("Token has expired", err)
@@ -236,7 +251,9 @@ describe("v2 protocol standard API", function()
236251
payload_claims["nbf"] = future:fmt("${iso}%z")
237252
payload_claims["exp"] = future:fmt("${iso}%z")
238253
local token = paseto.encrypt(key, payload_claims)
239-
local claim_rules = { ValidAt = true }
254+
local claim_rules = {
255+
claim_1 = { claim = "ValidAt", value = "" }
256+
}
240257
local decrypted_claims, err = paseto.decrypt(key, token, claim_rules)
241258
assert.equal(nil, decrypted_claims)
242259
assert.equal("Token was issued in the future", err)
@@ -249,7 +266,9 @@ describe("v2 protocol standard API", function()
249266
payload_claims["nbf"] = future:fmt("${iso}%z")
250267
payload_claims["exp"] = future:fmt("${iso}%z")
251268
local token = paseto.encrypt(key, payload_claims)
252-
local claim_rules = { ValidAt = true }
269+
local claim_rules = {
270+
claim_1 = { claim = "ValidAt", value = "" }
271+
}
253272
local decrypted_claims, err = paseto.decrypt(key, token, claim_rules)
254273
assert.equal(nil, decrypted_claims)
255274
assert.equal("Token cannot be used yet", err)
@@ -262,15 +281,19 @@ describe("v2 protocol standard API", function()
262281
payload_claims["nbf"] = now:fmt("${iso}%z")
263282
payload_claims["exp"] = past:fmt("${iso}%z")
264283
local token = paseto.encrypt(key, payload_claims)
265-
local claim_rules = { ValidAt = true }
284+
local claim_rules = {
285+
claim_1 = { claim = "ValidAt", value = "" }
286+
}
266287
local decrypted_claims, err = paseto.decrypt(key, token, claim_rules)
267288
assert.equal(nil, decrypted_claims)
268289
assert.equal("Token has expired", err)
269290
end)
270291

271292
it("should raise error 'Missing required claim 'important_claim'", function()
272293
local token = paseto.encrypt(key, payload_claims)
273-
local claim_rules = { ContainsClaim = "important_claim" }
294+
local claim_rules = {
295+
claim_1 = { claim = "ContainsClaim", value = "important_claim" }
296+
}
274297
local decrypted_claims, err = paseto.decrypt(key, token, claim_rules)
275298
assert.equal(nil, decrypted_claims)
276299
assert.equal("Missing required claim 'important_claim'", err)
@@ -366,7 +389,10 @@ describe("v2 protocol standard API", function()
366389

367390
it("should sign and verify payload claims successfully with claims validation", function()
368391
local token = paseto.sign(secret_key, payload_claims)
369-
local claim_rules = { data = "this is a signed message", myclaim = "validate this" }
392+
local claim_rules = {
393+
claim_1 = { claim = "data", value = "this is a signed message" },
394+
claim_2 = { claim = "myclaim", value = "validate this" }
395+
}
370396
local verified_claims = paseto.verify(public_key, token, claim_rules)
371397
assert.equal("table", type(verified_claims))
372398
assert.equal(#payload_claims, #verified_claims)
@@ -377,13 +403,13 @@ describe("v2 protocol standard API", function()
377403
payload_claims["exp"] = date(os.time()):addminutes(10):fmt("${iso}%z")
378404
local token = paseto.sign(secret_key, payload_claims)
379405
local claim_rules = {
380-
ForAudience = "some-audience.com",
381-
IdentifiedBy = "87IFSGFgPNtQNNuw0AtuLttP",
382-
IssuedBy = "paragonie.com",
383-
Subject = "test",
384-
NotExpired = true,
385-
ValidAt = true,
386-
ContainsClaim = "data"
406+
claim_1 = { claim = "IssuedBy", value = "paragonie.com" },
407+
claim_2 = { claim = "IdentifiedBy", value = "87IFSGFgPNtQNNuw0AtuLttP" },
408+
claim_3 = { claim = "ForAudience", value = "some-audience.com" },
409+
claim_4 = { claim = "Subject", value = "test" },
410+
claim_5 = { claim = "NotExpired", value = "" },
411+
claim_6 = { claim = "ValidAt", value = "" },
412+
claim_7 = { claim = "ContainsClaim", value = "data" }
387413
}
388414
local verified_claims = paseto.verify(public_key, token, claim_rules)
389415
assert.equal("table", type(verified_claims))
@@ -401,31 +427,41 @@ describe("v2 protocol standard API", function()
401427

402428
it("should raise error 'Missing required claim 'required_claim''", function()
403429
local token = paseto.sign(secret_key, payload_claims)
404-
local claim_rules = { required_claim = "this is a signed message", myclaim = "validate this" }
430+
local claim_rules = {
431+
claim_1 = { claim = "required_claim", value = "this is a signed message" },
432+
claim_2 = { claim = "myclaim", value = "validate this" }
433+
}
405434
local verified_claims, err = paseto.verify(public_key, token, claim_rules)
406435
assert.equal(nil, verified_claims)
407436
assert.equal("Missing required claim 'required_claim'", err)
408437
end)
409438

410439
it("should raise error 'Claim 'myclaim' does not match the expected value'", function()
411440
local token = paseto.sign(secret_key, payload_claims)
412-
local claim_rules = { data = "this is a signed message", myclaim = "invalid" }
441+
local claim_rules = {
442+
claim_1 = { claim = "data", value = "this is a signed message" },
443+
claim_2 = { claim = "myclaim", value = "invalid" }
444+
}
413445
local verified_claims, err = paseto.verify(public_key, token, claim_rules)
414446
assert.equal(nil, verified_claims)
415447
assert.equal("Claim 'myclaim' does not match the expected value", err)
416448
end)
417449

418450
it("should raise error 'Claim 'aud' does not match the expected value' when validating rule 'ForAudience'", function()
419451
local token = paseto.sign(secret_key, payload_claims)
420-
local claim_rules = { ForAudience = "some-other-audience.com" }
452+
local claim_rules = {
453+
claim_1 = { claim = "ForAudience", value = "some-other-audience.com" }
454+
}
421455
local verified_claims, err = paseto.verify(public_key, token, claim_rules)
422456
assert.equal(nil, verified_claims)
423457
assert.equal("Claim 'aud' does not match the expected value", err)
424458
end)
425459

426460
it("should raise error 'Missing required claim 'exp''", function()
427461
local token = paseto.sign(secret_key, {})
428-
local claim_rules = { NotExpired = true }
462+
local claim_rules = {
463+
claim_1 = { claim = "NotExpired", value = "" }
464+
}
429465
local verified_claims, err = paseto.verify(public_key, token, claim_rules)
430466
assert.equal(nil, verified_claims)
431467
assert.equal("Missing required claim 'exp'", err)
@@ -434,7 +470,9 @@ describe("v2 protocol standard API", function()
434470
it("should raise error 'Token has expired'", function()
435471
payload_claims["exp"] = date(os.time()):addseconds(-1):fmt("${iso}%z")
436472
local token = paseto.sign(secret_key, payload_claims)
437-
local claim_rules = { NotExpired = true }
473+
local claim_rules = {
474+
claim_1 = { claim = "NotExpired", value = "" }
475+
}
438476
local verified_claims, err = paseto.verify(public_key, token, claim_rules)
439477
assert.equal(nil, verified_claims)
440478
assert.equal("Token has expired", err)
@@ -446,7 +484,9 @@ describe("v2 protocol standard API", function()
446484
payload_claims["nbf"] = future:fmt("${iso}%z")
447485
payload_claims["exp"] = future:fmt("${iso}%z")
448486
local token = paseto.sign(secret_key, payload_claims)
449-
local claim_rules = { ValidAt = true }
487+
local claim_rules = {
488+
claim_1 = { claim = "ValidAt", value = "" }
489+
}
450490
local verified_claims, err = paseto.verify(public_key, token, claim_rules)
451491
assert.equal(nil, verified_claims)
452492
assert.equal("Token was issued in the future", err)
@@ -459,7 +499,9 @@ describe("v2 protocol standard API", function()
459499
payload_claims["nbf"] = future:fmt("${iso}%z")
460500
payload_claims["exp"] = future:fmt("${iso}%z")
461501
local token = paseto.sign(secret_key, payload_claims)
462-
local claim_rules = { ValidAt = true }
502+
local claim_rules = {
503+
claim_1 = { claim = "ValidAt", value = "" }
504+
}
463505
local verified_claims, err = paseto.verify(public_key, token, claim_rules)
464506
assert.equal(nil, verified_claims)
465507
assert.equal("Token cannot be used yet", err)
@@ -472,15 +514,19 @@ describe("v2 protocol standard API", function()
472514
payload_claims["nbf"] = now:fmt("${iso}%z")
473515
payload_claims["exp"] = past:fmt("${iso}%z")
474516
local token = paseto.sign(secret_key, payload_claims)
475-
local claim_rules = { ValidAt = true }
517+
local claim_rules = {
518+
claim_1 = { claim = "ValidAt", value = "" }
519+
}
476520
local verified_claims, err = paseto.verify(public_key, token, claim_rules)
477521
assert.equal(nil, verified_claims)
478522
assert.equal("Token has expired", err)
479523
end)
480524

481525
it("should raise error 'Missing required claim 'important_claim'", function()
482526
local token = paseto.sign(secret_key, payload_claims)
483-
local claim_rules = { ContainsClaim = "important_claim" }
527+
local claim_rules = {
528+
claim_1 = { claim = "ContainsClaim", value = "important_claim" }
529+
}
484530
local verified_claims, err = paseto.verify(public_key, token, claim_rules)
485531
assert.equal(nil, verified_claims)
486532
assert.equal("Missing required claim 'important_claim'", err)
@@ -510,14 +556,14 @@ describe("v2 protocol standard API", function()
510556
}
511557
footer_claims = { kid = "MDlCMUIwNzU4RTA2QzZFMDQ4" }
512558
claim_rules = {
513-
IssuedBy = "paragonie.com",
514-
IdentifiedBy = "87IFSGFgPNtQNNuw0AtuLttP",
515-
ForAudience = "some-audience.com",
516-
Subject = "test",
517-
NotExpired = true,
518-
ValidAt = true,
519-
ContainsClaim = "data",
520-
myclaim = "required value"
559+
claim_1 = { claim = "IssuedBy", value = "paragonie.com" },
560+
claim_2 = { claim = "IdentifiedBy", value = "87IFSGFgPNtQNNuw0AtuLttP" },
561+
claim_3 = { claim = "ForAudience", value = "some-audience.com" },
562+
claim_4 = { claim = "Subject", value = "test" },
563+
claim_5 = { claim = "NotExpired", value = "" },
564+
claim_6 = { claim = "ValidAt", value = "" },
565+
claim_7 = { claim = "ContainsClaim", value = "data" },
566+
claim_8 = { claim = "myclaim", value = "required value" }
521567
}
522568

523569
-- generate symmetric key
@@ -566,14 +612,14 @@ describe("v2 protocol standard API", function()
566612
}
567613
footer_claims = { kid = "MDlCMUIwNzU4RTA2QzZFMDQ4" }
568614
claim_rules = {
569-
IssuedBy = "paragonie.com",
570-
IdentifiedBy = "87IFSGFgPNtQNNuw0AtuLttP",
571-
ForAudience = "some-audience.com",
572-
Subject = "test",
573-
NotExpired = true,
574-
ValidAt = true,
575-
ContainsClaim = "data",
576-
myclaim = "required value"
615+
claim_1 = { claim = "IssuedBy", value = "paragonie.com" },
616+
claim_2 = { claim = "IdentifiedBy", value = "87IFSGFgPNtQNNuw0AtuLttP" },
617+
claim_3 = { claim = "ForAudience", value = "some-audience.com" },
618+
claim_4 = { claim = "Subject", value = "test" },
619+
claim_5 = { claim = "NotExpired", value = "" },
620+
claim_6 = { claim = "ValidAt", value = "" },
621+
claim_7 = { claim = "ContainsClaim", value = "data" },
622+
claim_8 = { claim = "myclaim", value = "required value" }
577623
}
578624

579625
-- generate key pair

0 commit comments

Comments
 (0)