merge #2108

src/ESP32React/ArduinoJsonJWT.cpp

@@ -0,0 +1,137 @@
+#include "ArduinoJsonJWT.h"
+
+#include <array>
+
+ArduinoJsonJWT::ArduinoJsonJWT(String secret)
+    : _secret(std::move(secret)) {
+}
+
+void ArduinoJsonJWT::setSecret(String secret) {
+    _secret = std::move(secret);
+}
+
+String ArduinoJsonJWT::getSecret() {
+    return _secret;
+}
+
+String ArduinoJsonJWT::buildJWT(JsonObject payload) {
+    // serialize, then encode payload
+    String jwt;
+    serializeJson(payload, jwt);
+    jwt = encode(jwt.c_str(), static_cast<int>(jwt.length()));
+
+    // add the header to payload
+    jwt = getJWTHeader() + '.' + jwt;
+
+    // add signature
+    jwt += '.' + sign(jwt);
+
+    return jwt;
+}
+
+void ArduinoJsonJWT::parseJWT(String jwt, JsonDocument & jsonDocument) {
+    // clear json document before we begin, jsonDocument wil be null on failure
+    jsonDocument.clear();
+
+    const String &     jwt_header      = getJWTHeader();
+    const unsigned int jwt_header_size = jwt_header.length();
+
+    // must have the correct header and delimiter
+    if (!jwt.startsWith(jwt_header) || jwt.indexOf('.') != static_cast<int>(jwt_header_size)) {
+        return;
+    }
+
+    // check there is a signature delimieter
+    const int signatureDelimiterIndex = jwt.lastIndexOf('.');
+    if (signatureDelimiterIndex == static_cast<int>(jwt_header_size)) {
+        return;
+    }
+
+    // check the signature is valid
+    const String signature = jwt.substring(static_cast<unsigned int>(signatureDelimiterIndex) + 1);
+    jwt                    = jwt.substring(0, static_cast<unsigned int>(signatureDelimiterIndex));
+    if (sign(jwt) != signature) {
+        return;
+    }
+
+    // decode payload
+    jwt = jwt.substring(jwt_header_size + 1);
+    jwt = decode(jwt);
+
+    // parse payload, clearing json document after failure
+    const DeserializationError error = deserializeJson(jsonDocument, jwt);
+    if (error != DeserializationError::Ok || !jsonDocument.is<JsonObject>()) {
+        jsonDocument.clear();
+    }
+}
+
+/*
+ * ESP32 uses mbedtls, with decent HMAC implementations supporting sha256, as well as others.
+ * No need to pull in additional crypto libraries - lets use what we already have.
+ */
+String ArduinoJsonJWT::sign(String & payload) {
+    std::array<unsigned char, 32> hmacResult{};
+    {
+        mbedtls_md_context_t ctx;
+        mbedtls_md_type_t    md_type = MBEDTLS_MD_SHA256;
+        mbedtls_md_init(&ctx);
+        mbedtls_md_setup(&ctx, mbedtls_md_info_from_type(md_type), 1);
+        mbedtls_md_hmac_starts(&ctx, reinterpret_cast<const unsigned char *>(_secret.c_str()), _secret.length());
+        mbedtls_md_hmac_update(&ctx, reinterpret_cast<const unsigned char *>(payload.c_str()), payload.length());
+        mbedtls_md_hmac_finish(&ctx, hmacResult.data());
+        mbedtls_md_free(&ctx);
+    }
+    return encode(reinterpret_cast<const char *>(hmacResult.data()), hmacResult.size());
+}
+
+String ArduinoJsonJWT::encode(const char * cstr, int inputLen) {
+    // prepare encoder
+    base64_encodestate _state;
+    base64_init_encodestate(&_state);
+
+    // prepare buffer of correct length
+    const auto bufferLength = static_cast<std::size_t>(base64_encode_expected_len(inputLen)) + 1;
+    auto *     buffer       = new char[bufferLength];
+
+    // encode to buffer
+    int len = base64_encode_block(cstr, inputLen, &buffer[0], &_state);
+    len += base64_encode_blockend(&buffer[len], &_state);
+    buffer[len] = '\0';
+
+    // convert to arduino string, freeing buffer
+    auto result = String(buffer);
+    delete[] buffer;
+    buffer = nullptr;
+
+    // remove padding and convert to URL safe form
+    while (result.length() > 0 && result.charAt(result.length() - 1) == '=') {
+        result.remove(result.length() - 1);
+    }
+    result.replace('+', '-');
+    result.replace('/', '_');
+
+    // return as string
+    return result;
+}
+
+String ArduinoJsonJWT::decode(String value) {
+    // convert to standard base64
+    value.replace('-', '+');
+    value.replace('_', '/');
+
+    // prepare buffer of correct length
+    const auto bufferLength = static_cast<std::size_t>(base64_decode_expected_len(value.length()) + 1);
+    auto *     buffer       = new char[bufferLength];
+
+    // decode
+    const int len = base64_decode_chars(value.c_str(), static_cast<int>(value.length()), &buffer[0]);
+    buffer[len]   = '\0';
+
+    // convert to arduino string, freeing buffer
+    auto result = String(buffer);
+    delete[] buffer;
+    buffer = nullptr;
+
+    // return as string
+    return result;
+}