node_jwt_authenticator.go

package jwt

import (
	"context"
	"crypto/ed25519"
	"encoding/hex"
	"fmt"
	"log/slog"

	"github.com/golang-jwt/jwt/v5"

	"github.com/smartcontractkit/chainlink-common/pkg/nodeauth/types"
	"github.com/smartcontractkit/chainlink-common/pkg/nodeauth/utils"
)

// NodeJWTAuthenticator is designed to be used by the server-side service to authenticate the JWT token generated by the Node.
type NodeJWTAuthenticator struct {
	nodeAuthProvider NodeAuthProvider // Source of truth to validate public key in the JWT claim.
	parser           *jwt.Parser      // JWT parser to parse the JWT token.
	logger           *slog.Logger
}

func NewNodeJWTAuthenticator(nodeAuthProvider NodeAuthProvider, logger *slog.Logger) *NodeJWTAuthenticator {
	// Configure parser with validation options
	parser := jwt.NewParser(
		jwt.WithIssuedAt(),
		jwt.WithExpirationRequired(),
	)

	return &NodeJWTAuthenticator{
		nodeAuthProvider: nodeAuthProvider,
		parser:           parser,
		logger:           logger,
	}
}

// 1. Standard JWT Validation: validate the JWT claims and signature against public key.
// 2. Public Key Whitelist Validation: validate the node's public key is trusted.
func (v *NodeJWTAuthenticator) AuthenticateJWT(ctx context.Context, tokenString string, originalRequest any) (bool, *types.NodeJWTClaims, error) {
	// Parse JWT claims
	claims, err := v.parseJWTClaims(tokenString)
	if err != nil {
		return false, nil, fmt.Errorf("failed to parse and validate JWT claims: %w", err)
	}

	// Extract public key from JWT claim
	publicKey, err := utils.DecodePublicKey(claims.PublicKey)
	if err != nil {
		return false, claims, fmt.Errorf("invalid public key format: %w", err)
	}

	// Verify JWT signature against the public key
	if err := v.verifyJWTSignature(tokenString, publicKey); err != nil {
		return false, claims, fmt.Errorf("JWT signature verification failed: %w", err)
	}

	// Verify request digest integrity
	if err := v.verifyRequestDigest(claims, originalRequest); err != nil {
		return false, claims, fmt.Errorf("request integrity check failed: %w", err)
	}

	// Public Key Validation: Verify node's CSA pubkey against the whitelisted registry via NodeAuthProvider.
	isValid, err := v.nodeAuthProvider.IsNodePubKeyTrusted(ctx, publicKey)
	if err != nil {
		v.logger.Error("Node validation failed",
			"csaPubKey", hex.EncodeToString(publicKey),
			"error", err,
		)
		return false, claims, fmt.Errorf("node validation failed: %w", err)
	}

	if !isValid {
		v.logger.Warn("Unauthorized node attempted access",
			"csaPubKey", hex.EncodeToString(publicKey),
		)
		return false, claims, fmt.Errorf("unauthorized node: %s", hex.EncodeToString(publicKey))
	}

	v.logger.Debug("JWT validation successful",
		"csaPubKey", hex.EncodeToString(publicKey),
	)

	return true, claims, nil
}

// parseJWTClaims extracts JWT claims from the token string.
func (v *NodeJWTAuthenticator) parseJWTClaims(tokenString string) (*types.NodeJWTClaims, error) {
	token, _, err := v.parser.ParseUnverified(tokenString, &types.NodeJWTClaims{})
	if err != nil {
		return nil, fmt.Errorf("invalid JWT format: %w", err)
	}

	claims, ok := token.Claims.(*types.NodeJWTClaims)
	if !ok {
		return nil, fmt.Errorf("invalid claims type")
	}
	return claims, nil
}

// verifyJWTSignature prove the JWT signature is signed by the node's private key.
func (v *NodeJWTAuthenticator) verifyJWTSignature(tokenString string, publicKey ed25519.PublicKey) error {

	token, err := v.parser.Parse(tokenString, func(token *jwt.Token) (any, error) {
		// Ensure the signing method is jwt.SigningMethodEd25519
		if _, ok := token.Method.(*jwt.SigningMethodEd25519); !ok {
			return nil, fmt.Errorf("unexpected signing method: %v", token.Header["alg"])
		}

		return publicKey, nil
	})

	if err != nil {
		return fmt.Errorf("signature verification failed: %w", err)
	}

	if !token.Valid {
		return fmt.Errorf("token is invalid after signature verification")
	}

	return nil
}

// verifyRequestDigest ensures the request hasn't been tampered with by verifying the digest in the JWT claim.
func (v *NodeJWTAuthenticator) verifyRequestDigest(claims *types.NodeJWTClaims, originalRequest any) error {
	expectedDigest := utils.CalculateRequestDigest(originalRequest)

	if claims.Digest != expectedDigest {
		return fmt.Errorf("digest mismatch: got %s, want %s", claims.Digest, expectedDigest)
	}

	return nil
}