Allow base64 encoded bytes as argument to --secret

Cargo.toml

@@ -21,3 +21,4 @@ serde_json = "1"
 chrono = "0.4"
 parse_duration = "2.1.1"
 atty = "0.2"
+base64 = "0.13.0"

src/main.rs

@@ -1,4 +1,5 @@
 use atty::Stream;
+use base64::decode as base64_decode;
 use chrono::{TimeZone, Utc};
 use clap::{arg_enum, crate_authors, crate_version, App, Arg, ArgMatches, SubCommand};
 use jsonwebtoken::errors::{ErrorKind, Result as JWTResult};
@@ -237,7 +238,7 @@ fn config_options<'a, 'b>() -> App<'a, 'b> {
                         .long("no-iat")
                 ).arg(
                     Arg::with_name("secret")
-                        .help("the secret to sign the JWT with. Can be prefixed with @ to read from a binary file")
+                        .help("the secret to sign the JWT with. Prefix with @ to read from a file or b64: to use base-64 encoded bytes")
                         .takes_value(true)
                         .long("secret")
                         .short("S")
@@ -266,7 +267,7 @@ fn config_options<'a, 'b>() -> App<'a, 'b> {
                         .long("iso8601")
                 ).arg(
                     Arg::with_name("secret")
-                        .help("the secret to validate the JWT with. Can be prefixed with @ to read from a binary file")
+                        .help("the secret to validate the JWT with. Prefix with @ to read from a file or b64: to use base-64 encoded bytes")
                         .takes_value(true)
                         .long("secret")
                         .short("S")
@@ -345,6 +346,10 @@ fn encoding_key_from_secret(alg: &Algorithm, secret_string: &str) -> JWTResult<E
             if secret_string.starts_with('@') {
                 let secret = slurp_file(&secret_string.chars().skip(1).collect::<String>());
                 Ok(EncodingKey::from_secret(&secret))
+            } else if secret_string.starts_with("b64:") {
+                Ok(EncodingKey::from_secret(
+                    &base64_decode(&secret_string.chars().skip(4).collect::<String>()).unwrap(),
+                ))
             } else {
                 Ok(EncodingKey::from_secret(secret_string.as_bytes()))
             }
@@ -382,6 +387,11 @@ fn decoding_key_from_secret(
             if secret_string.starts_with('@') {
                 let secret = slurp_file(&secret_string.chars().skip(1).collect::<String>());
                 Ok(DecodingKey::from_secret(&secret).into_static())
+            } else if secret_string.starts_with("b64:") {
+                Ok(DecodingKey::from_secret(
+                    &base64_decode(&secret_string.chars().skip(4).collect::<String>()).unwrap(),
+                )
+                .into_static())
             } else {
                 Ok(DecodingKey::from_secret(secret_string.as_bytes()).into_static())
             }

tests/jwt-cli.rs

@@ -7,6 +7,7 @@ mod tests {
         encoding_key_from_secret, is_payload_item, is_timestamp_or_duration, translate_algorithm,
         OutputFormat, Payload, PayloadItem, SupportedAlgorithms,
     };
+    use base64::decode as base64_decode;
     use chrono::{Duration, TimeZone, Utc};
     use jsonwebtoken::{Algorithm, DecodingKey, EncodingKey, Header, TokenData};
     use serde_json::{from_value, json};
@@ -662,13 +663,33 @@ mod tests {
         assert_eq!(expected, key);
     }
 
+    #[test]
+    fn encoding_key_from_secret_handles_base64() {
+        let b64 = "+t0vs/PPB0dvyYKIk1DYvz5WyCUds5DLy07ycOK5oHA=";
+        let mut arg: String = "b64:".to_owned();
+        arg.push_str(b64);
+        let expected = EncodingKey::from_secret(&base64_decode(b64).unwrap());
+        let key = encoding_key_from_secret(&Algorithm::HS256, &arg).unwrap();
+        assert_eq!(expected, key);
+    }
+
     #[test]
     fn decoding_key_from_secret_handles_at() {
         let expected = DecodingKey::from_secret(include_bytes!("hmac-key.bin"));
         let key = decoding_key_from_secret(&Algorithm::HS256, "@./tests/hmac-key.bin").unwrap();
         assert_eq!(expected, key);
     }
 
+    #[test]
+    fn decoding_key_from_secret_handles_base64() {
+        let b64 = "+t0vs/PPB0dvyYKIk1DYvz5WyCUds5DLy07ycOK5oHA=";
+        let mut arg: String = "b64:".to_owned();
+        arg.push_str(b64);
+        let expected = DecodingKey::from_secret(&base64_decode(b64).unwrap()).into_static();
+        let key = decoding_key_from_secret(&Algorithm::HS256, &arg).unwrap();
+        assert_eq!(expected, key);
+    }
+
     #[test]
     fn encodes_and_decodes_an_rsa_ssa_pss_token_using_key_from_file() {
         let body: String = "{\"field\":\"value\"}".to_string();