JWT: Enable reading a JSON Web Key Set from a file

pkg/jwt/BUILD.bazel

@@ -9,6 +9,7 @@ go_library(
         "ecdsa_sha_signature_generator.go",
         "ecdsa_sha_signature_validator.go",
         "ed25519_signature_validator.go",
+        "forwarding_signature_validator.go",
         "generate_authorization_header.go",
         "hmac_sha_signature_validator.go",
         "rsa_sha_signature_validator.go",

pkg/jwt/configuration.go

@@ -5,7 +5,10 @@ import (
 	"crypto/ed25519"
 	"crypto/rsa"
 	"encoding/json"
+	"log"
+	"os"
 	"reflect"
+	"time"
 
 	"github.com/buildbarn/bb-storage/pkg/clock"
 	"github.com/buildbarn/bb-storage/pkg/eviction"
@@ -23,19 +26,29 @@ import (
 // "Authorization" header parser based on options stored in a
 // configuration file.
 func NewAuthorizationHeaderParserFromConfiguration(config *configuration.AuthorizationHeaderParserConfiguration) (*AuthorizationHeaderParser, error) {
-	jwksJSON, err := protojson.Marshal(config.JwksInline)
-	if err != nil {
-		return nil, util.StatusWrapWithCode(err, codes.InvalidArgument, "Failed to marshal JSON Web Key Set")
-	}
-	var jwks jose.JSONWebKeySet
-	if err := json.Unmarshal(jwksJSON, &jwks); err != nil {
-		return nil, util.StatusWrapWithCode(err, codes.InvalidArgument, "Failed to unmarshal JSON Web Key Set")
-	}
-	signatureValidator, err := NewSignatureValidatorFromJSONWebKeySet(&jwks)
-	if err != nil {
-		return nil, err
+	var signatureValidator SignatureValidator
+
+	switch key := config.Jwks.(type) {
+	case *configuration.AuthorizationHeaderParserConfiguration_JwksInline:
+		jwksJSON, err := protojson.Marshal(key.JwksInline)
+		if err != nil {
+			return nil, util.StatusWrapWithCode(err, codes.InvalidArgument, "Failed to marshal JSON Web Key Set")
+		}
+		var jwks jose.JSONWebKeySet
+		if err := json.Unmarshal(jwksJSON, &jwks); err != nil {
+			return nil, util.StatusWrapWithCode(err, codes.InvalidArgument, "Failed to unmarshal JSON Web Key Set")
+		}
+		signatureValidator, err = NewSignatureValidatorFromJSONWebKeySet(&jwks)
+		if err != nil {
+			return nil, err
+		}
+	case *configuration.AuthorizationHeaderParserConfiguration_JwksFile_:
+		signatureValidator = NewSignatureValidatorFromJSONWebKeySetFile(key.JwksFile.FilePath, key.JwksFile.RefreshInterval.AsDuration())
+	default:
+		return nil, status.Error(codes.InvalidArgument, "No key type provided")
 	}
 
+
 	evictionSet, err := eviction.NewSetFromConfiguration[string](config.CacheReplacementPolicy)
 	if err != nil {
 		return nil, util.StatusWrap(err, "Failed to create eviction set")
@@ -102,3 +115,38 @@ func NewSignatureValidatorFromJSONWebKeySet(jwks *jose.JSONWebKeySet) (Signature
 
 	return NewDemultiplexingSignatureValidator(namedSignatureValidators, allSignatureValidators), nil
 }
+
+func NewSignatureValidatorFromJSONWebKeySetFile(path string, refreshInterval time.Duration) SignatureValidator {
+	// Hmm. I don't want us to first read the file once, to initialize this, and then read the file periodically to update it.
+	// However, I also don't want us to initialize this in a state that isn't ready for use.
+	validator := NewForwardingSignatureValidator(nil)
+
+	// TODO: Run this as part of the program.Group, so that it gets
+	// cleaned up upon shutdown.
+	go func() {
+		t := time.NewTicker(refreshInterval)
+		for range t.C {
+			jwksJSON, err := os.ReadFile(path)
+			if err != nil {
+				log.Printf("Failed to reload JWKS file: %v", err)
+				continue
+			}
+
+			var jwks jose.JSONWebKeySet
+			if err := json.Unmarshal(jwksJSON, &jwks); err != nil {
+				log.Printf("Failed to reload JWKS file: %v", err)
+				continue
+			}
+
+			signatureValidator, err := NewSignatureValidatorFromJSONWebKeySet(&jwks)
+			if err != nil {
+				log.Printf("Failed to create SignatureValidator for JWKS file: %v", err)
+				continue
+			}
+
+			(validator.(*forwardingSignatureValidator)).Replace(signatureValidator)
+		}
+	}()
+
+	return validator
+}

pkg/jwt/forwarding_signature_validator.go

@@ -0,0 +1,26 @@
+package jwt
+
+import (
+	"sync/atomic"
+)
+
+type forwardingSignatureValidator struct {
+	validator atomic.Pointer[SignatureValidator]
+}
+
+// NewForwardingSignatureValidator creates a SignatureValidator that simply forwards
+// requests to another SignatureValidator.
+func NewForwardingSignatureValidator(validator SignatureValidator) SignatureValidator {
+	sv := &forwardingSignatureValidator{}
+	sv.validator.Store(&validator)
+
+	return sv
+}
+
+func (sv *forwardingSignatureValidator) Replace(validator SignatureValidator) {
+	sv.validator.Store(&validator)
+}
+
+func (sv *forwardingSignatureValidator) ValidateSignature(algorithm string, keyID *string, headerAndPayload string, signature []byte) bool {
+	return (*sv.validator.Load()).ValidateSignature(algorithm, keyID, headerAndPayload, signature)
+}

pkg/proto/configuration/jwt/BUILD.bazel

@@ -8,6 +8,7 @@ proto_library(
     visibility = ["//visibility:public"],
     deps = [
         "//pkg/proto/configuration/eviction:eviction_proto",
+        "@com_google_protobuf//:duration_proto",
         "@com_google_protobuf//:struct_proto",
     ],
 )