mooncred

moon add moonbitstack/mooncred

// The key is whatever signs. Here, HMAC over SHA-256.
let key = @jwt.mac(fn() {
  @hmac.Hmac::new(secret[:], fn() { @sha2.Hasher::new() })
})

let token = @jwt.sign(claims, HS256, key)

// The algorithm is the caller's, not the token's.
let got = @jwt.verify(token[:], HS256, key, now=At(seconds),
                      issuer="moonbitstack", audience=["moonapi"])

#Packages

#The algorithm is not the token's to choose

• alg: none. A token with an empty signature that a verifier accepts because the token said not to check. There is no none in the Alg type, so there is nothing to accept.
• Algorithm confusion. A token signed with HMAC, keyed on the RSA public key that everybody has, offered to a verifier that reads alg from the header and obliges. Here the caller has already decided; the header must agree with it.

#Configuration precedence

@jwt.policy        <        the policy you pass        <        the arguments you pass

• wins turns the last two layers around. Base makes the policy authoritative and the arguments advisory.
• clash decides what happens when a setting is given twice: Ignore merges quietly, Panic refuses, and Handle(f) gives your function the base and the merged result and takes whichever it returns.

// A policy for the deployment, assembled once.
let ours = @jwt.Policy::new(issuer="moonbitstack", audience=["moonapi"])
// The same thing written as a record update.
let same : @jwt.Policy = { ..@jwt.policy, issuer: Some("moonbitstack"), audience: ["moonapi"] }

// Used as it is, and used with one thing changed for this call.
let a = @jwt.verify(token[:], HS256, key, now=At(seconds), policy=ours)
let b = @jwt.verify(token[:], HS256, key, now=At(seconds), policy=ours, leeway=60)

// Reading a token without asking whether it has expired.
let c = @jwt.verify(token[:], HS256, key, now=Ignored)

#Keys are contracts, not implementations

let verifier = match key.material() {
  Okp(x~, ..) => @ed25519.PublicKey::new(x[:])
  _ => abort("not an Ed25519 key")
}

#When a setting takes a bare value and when it takes Some

let policy = @jwt.Policy::new(issuer="https://issuer.example", leeway=30)
let got = @jwt.verify(token[:], HS256, key, now=At(seconds), issuer="https://issuer.example")

let plain = @jwt.sign(claims, HS256, key)                      // typ: "JWT"
let access = @jwt.sign(claims, HS256, key, typ=Some("at+jwt"))  // typ: "at+jwt"
let bare = @jwt.sign(claims, HS256, key, typ=None)              // no typ header

#Certificates

// Validate what a server sent, against the Mozilla roots.
let roots = @roots.mozilla()                     // build once, keep
let path = @x509.verify(chain[:], roots, now~, host="example.com")
// path: the leaf, the intermediates it runs through, the anchor

// Or one certificate on its own.
let cert = @x509.parse(der[:])
let serves = cert.matches("a.example.com")    // subjectAltName names and addresses
let signed = cert.signed_by(issuer.spki)      // raises for an algorithm it does not check

let key = @x509.PrivateKey::pem(text)     // PRIVATE KEY, EC PRIVATE KEY, RSA PRIVATE KEY
let pairs = cert.spki.holds(key.public()) // whether the two belong together

let seed = b"\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f"
let key : @x509.PrivateKey = MlDsa(@mldsa.PrivateKey::from_seed(kind=D65, seed))
let der = @x509.self_signed(
  key~,
  cn="pqc.example",
  serial=b"\x01",
  not_before=1793232000L,                  // seconds since the Unix epoch
  not_after=1824768000L,
  exts={ ..@x509.Exts::empty(), san: [Dns("pqc.example")] },
)

#Requests, containers and revocation

// A request to be signed, and the same request read back.
let pem = @csr.self_signed_pem(key, subject=@x509.common_name("csr.example.com"))
let request = @csr.Request::pem(pem)
let sound = request.verified()              // the signature, over the octets that arrived
let mine = request.asks_for(key.public())   // whether it asks for this key

// A key at rest, and the container that holds it.
let locked = key.encrypt(passphrase~, salt~, iv~, scheme=Aes256Cbc)
let back = @x509.PrivateKey::read_encrypted(locked[:], passphrase~)
let pfx = @pkcs12.build(certs~, key=Some(key.pkcs8()), passphrase~, salt~, iv~, mac_salt~)
let inside = @pkcs12.parse(pfx[:]).contents(passphrase~)

// Revocation, without a network in the library.
let list = @revoke.Crl::pem(text)
let fresh = list.fresh(now)                 // thisUpdate and nextUpdate, against the caller's clock
let status = list.status(cert)              // Good, Revoked(entry), or Unknown

#Signed strings, JWE and COSE

let text = @token.sign(payload, keys~, salt="session", at=now)
let value = @token.verify(text[:], keys~, salt="session", max_age=86400L, now~)

let message = @cose.sign1(payload, alg=ES256, signer, kid=kid)
let opened = @cose.verify1(message[:], alg=ES256, verifier)

let claims = @cose.Claims::new(iss="moonbitstack", exp=4102444800L)
let cwt = @cose.signed(claims, alg=HS256, signer)
let checked = @cose.verified(cwt[:], alg=HS256, verifier, now=At(seconds))

#Policy, when a chain has to be valid for a purpose

let path = @x509.verify(chain[:], roots, now~)
let certs = []
for cert in path {
  certs.push(@policy.read(cert.raw))
}
let held = @policy.policies(certs, initial=["2.23.140.1.2.1"])   // empty: not valid for it

#What is checked

#Conformance

#What is not here yet

#Licence