implement read-only auth

.github/workflows/clippy.yml

@@ -20,8 +20,3 @@ jobs:
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           args: --all-features --manifest-path=crates/Cargo.toml
-      - name: Clippy check y-sweet-worker
-        uses: actions-rs/clippy-check@v1
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          args: --all-features --manifest-path=crates/y-sweet-worker/Cargo.toml --target=wasm32-unknown-unknown

crates/y-sweet-core/src/api_types.rs

@@ -1,19 +1,14 @@
-use std::collections::HashMap;
-
 use serde::{Deserialize, Serialize};
-use serde_json::Value;
 
 #[derive(Serialize)]
 pub struct NewDocResponse {
     #[serde(rename = "docId")]
     pub doc_id: String,
 }
 
-#[derive(Serialize, Deserialize)]
+#[derive(Copy, Clone, Serialize, Deserialize)]
 pub enum Authorization {
-    #[serde(rename = "none")]
-    Nothing,
-    #[serde(rename = "readonly")]
+    #[serde(rename = "read-only")]
     ReadOnly,
     #[serde(rename = "full")]
     Full,
@@ -26,14 +21,11 @@ impl Authorization {
 }
 
 #[derive(Deserialize)]
-#[allow(unused)]
 pub struct AuthDocRequest {
     #[serde(default = "Authorization::full")]
     pub authorization: Authorization,
     #[serde(rename = "userId")]
     pub user_id: Option<String>,
-    #[serde(default)]
-    pub metadata: HashMap<String, Value>,
     #[serde(skip_serializing_if = "Option::is_none", rename = "validForSeconds")]
     pub valid_for_seconds: Option<u64>,
 }
@@ -43,7 +35,6 @@ impl Default for AuthDocRequest {
         Self {
             authorization: Authorization::Full,
             user_id: None,
-            metadata: HashMap::new(),
             valid_for_seconds: None,
         }
     }
@@ -66,6 +57,10 @@ pub struct ClientToken {
     /// An optional token that can be used to authenticate the client to the server.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub token: Option<String>,
+
+    /// The authorization level of the client.
+    #[serde(rename = "authorization")]
+    pub authorization: Authorization,
 }
 
 #[derive(Deserialize, Debug)]

crates/y-sweet-core/src/auth.rs

@@ -1,3 +1,4 @@
+use crate::api_types::Authorization;
 use bincode::Options;
 use data_encoding::Encoding;
 use rand::Rng;
@@ -90,10 +91,16 @@ pub struct Authenticator {
     key_id: Option<String>,
 }
 
+#[derive(Serialize, Deserialize)]
+pub struct DocPermission {
+    pub doc_id: String,
+    pub authorization: Authorization,
+}
+
 #[derive(Serialize, Deserialize)]
 pub enum Permission {
     Server,
-    Doc(String),
+    Doc(DocPermission),
 }
 
 #[derive(Serialize, Deserialize)]
@@ -316,10 +323,16 @@ impl Authenticator {
     pub fn gen_doc_token(
         &self,
         doc_id: &str,
+        authorization: Authorization,
         expiration_time: ExpirationTimeEpochMillis,
     ) -> String {
-        let payload =
-            Payload::new_with_expiration(Permission::Doc(doc_id.to_string()), expiration_time);
+        let payload = Payload::new_with_expiration(
+            Permission::Doc(DocPermission {
+                doc_id: doc_id.to_string(),
+                authorization,
+            }),
+            expiration_time,
+        );
         self.sign(payload)
     }
 
@@ -337,18 +350,18 @@ impl Authenticator {
         token: &str,
         doc: &str,
         current_time_epoch_millis: u64,
-    ) -> Result<(), AuthError> {
+    ) -> Result<Authorization, AuthError> {
         let payload = self.verify_token(token, current_time_epoch_millis)?;
 
         match payload {
-            Permission::Doc(doc_id) => {
-                if doc_id == doc {
-                    Ok(())
+            Permission::Doc(doc_permission) => {
+                if doc_permission.doc_id == doc {
+                    Ok(doc_permission.authorization)
                 } else {
                     Err(AuthError::InvalidResource)
                 }
             }
-            Permission::Server => Ok(()), // Server tokens can access any doc.
+            Permission::Server => Ok(Authorization::Full), // Server tokens can access any doc.
         }
     }
 
@@ -386,30 +399,68 @@ mod tests {
     #[test]
     fn test_simple_auth() {
         let authenticator = Authenticator::gen_key().unwrap();
-        let token = authenticator.gen_doc_token("doc123", ExpirationTimeEpochMillis(0));
-        assert_eq!(authenticator.verify_doc_token(&token, "doc123", 0), Ok(()));
-        assert_eq!(
+        let token = authenticator.gen_doc_token(
+            "doc123",
+            Authorization::Full,
+            ExpirationTimeEpochMillis(0),
+        );
+        assert!(matches!(
+            authenticator.verify_doc_token(&token, "doc123", 0),
+            Ok(Authorization::Full)
+        ));
+        assert!(matches!(
             authenticator.verify_doc_token(&token, "doc123", DEFAULT_EXPIRATION_SECONDS + 1),
             Err(AuthError::Expired)
-        );
-        assert_eq!(
+        ));
+        assert!(matches!(
             authenticator.verify_doc_token(&token, "doc456", 0),
             Err(AuthError::InvalidResource)
+        ));
+    }
+
+    #[test]
+    fn test_read_only_auth() {
+        let authenticator = Authenticator::gen_key().unwrap();
+        let token = authenticator.gen_doc_token(
+            "doc123",
+            Authorization::ReadOnly,
+            ExpirationTimeEpochMillis(0),
         );
+        assert!(matches!(
+            authenticator.verify_doc_token(&token, "doc123", 0),
+            Ok(Authorization::ReadOnly)
+        ));
+    }
+
+    #[test]
+    fn test_server_token_for_doc_auth() {
+        let authenticator = Authenticator::gen_key().unwrap();
+        let server_token = authenticator.server_token();
+        assert!(matches!(
+            authenticator.verify_doc_token(&server_token, "doc123", 0),
+            Ok(Authorization::Full)
+        ));
     }
 
     #[test]
     fn test_key_id() {
         let authenticator = Authenticator::gen_key()
             .unwrap()
             .with_key_id("myKeyId".try_into().unwrap());
-        let token = authenticator.gen_doc_token("doc123", ExpirationTimeEpochMillis(0));
+        let token = authenticator.gen_doc_token(
+            "doc123",
+            Authorization::Full,
+            ExpirationTimeEpochMillis(0),
+        );
         assert!(
             token.starts_with("myKeyId."),
             "Token {} does not start with myKeyId.",
             token
         );
-        assert_eq!(authenticator.verify_doc_token(&token, "doc123", 0), Ok(()));
+        assert!(matches!(
+            authenticator.verify_doc_token(&token, "doc123", 0),
+            Ok(Authorization::Full)
+        ));
 
         let token = authenticator.server_token();
         assert!(
@@ -438,65 +489,83 @@ mod tests {
         let authenticator = Authenticator::gen_key()
             .unwrap()
             .with_key_id("myKeyId".try_into().unwrap());
-        let token = authenticator.gen_doc_token("doc123", ExpirationTimeEpochMillis(0));
+        let token = authenticator.gen_doc_token(
+            "doc123",
+            Authorization::Full,
+            ExpirationTimeEpochMillis(0),
+        );
         let token = token.replace("myKeyId.", "aDifferentKeyId.");
         assert!(token.starts_with("aDifferentKeyId."));
-        assert_eq!(
+        assert!(matches!(
             authenticator.verify_doc_token(&token, "doc123", 0),
             Err(AuthError::KeyMismatch)
-        );
+        ));
     }
 
     #[test]
     fn test_missing_key_id() {
         let authenticator = Authenticator::gen_key()
             .unwrap()
             .with_key_id("myKeyId".try_into().unwrap());
-        let token = authenticator.gen_doc_token("doc123", ExpirationTimeEpochMillis(0));
+        let token = authenticator.gen_doc_token(
+            "doc123",
+            Authorization::Full,
+            ExpirationTimeEpochMillis(0),
+        );
         let token = token.replace("myKeyId.", "");
-        assert_eq!(
+        assert!(matches!(
             authenticator.verify_doc_token(&token, "doc123", 0),
             Err(AuthError::KeyMismatch)
-        );
+        ));
     }
 
     #[test]
     fn test_unexpected_key_id() {
         let authenticator = Authenticator::gen_key().unwrap();
-        let token = authenticator.gen_doc_token("doc123", ExpirationTimeEpochMillis(0));
+        let token = authenticator.gen_doc_token(
+            "doc123",
+            Authorization::Full,
+            ExpirationTimeEpochMillis(0),
+        );
         let token = format!("unexpectedKeyId.{}", token);
-        assert_eq!(
+        assert!(matches!(
             authenticator.verify_doc_token(&token, "doc123", 0),
             Err(AuthError::KeyMismatch)
-        );
+        ));
     }
 
     #[test]
     fn test_invalid_signature() {
         let authenticator = Authenticator::gen_key().unwrap();
-        let actual_payload = Payload::new(Permission::Doc("doc123".to_string()));
+        let actual_payload = Payload::new(Permission::Doc(DocPermission {
+            doc_id: "doc123".to_string(),
+            authorization: Authorization::Full,
+        }));
         let mut encoded_payload =
             bincode_encode(&actual_payload).expect("Bincode serialization should not fail.");
         encoded_payload.extend_from_slice(&authenticator.private_key);
 
         let token = hash(&encoded_payload);
 
         let auth_req = AuthenticatedRequest {
-            payload: Payload::new(Permission::Doc("abc123".to_string())),
+            payload: Payload::new(Permission::Doc(DocPermission {
+                doc_id: "abc123".to_string(),
+                authorization: Authorization::Full,
+            })),
             token,
         };
 
         let auth_enc = bincode_encode(&auth_req).expect("Bincode serialization should not fail.");
         let signed = b64_encode(&auth_enc);
 
-        assert_eq!(
+        assert!(matches!(
             authenticator.verify_doc_token(&signed, "doc123", 0),
             Err(AuthError::InvalidSignature)
-        );
-        assert_eq!(
+        ));
+        assert!(matches!(
             authenticator.verify_doc_token(&signed, "abc123", 0),
             Err(AuthError::InvalidSignature)
-        );
+        ));
     }
 
     #[test]

crates/y-sweet-core/src/doc_connection.rs

@@ -1,3 +1,4 @@
+use crate::api_types::Authorization;
 use crate::sync::{
     self, awareness::Awareness, DefaultProtocol, Message, Protocol, SyncMessage, MSG_SYNC,
     MSG_SYNC_UPDATE,
@@ -30,6 +31,7 @@ pub struct DocConnection {
     doc_subscription: Subscription,
     #[allow(unused)] // acts as RAII guard
     awareness_subscription: Subscription,
+    authorization: Authorization,
     callback: Callback,
     closed: Arc<OnceLock<()>>,
 
@@ -48,14 +50,22 @@ impl DocConnection {
     }
 
     #[cfg(feature = "sync")]
-    pub fn new<F>(awareness: Arc<RwLock<Awareness>>, callback: F) -> Self
+    pub fn new<F>(
+        awareness: Arc<RwLock<Awareness>>,
+        authorization: Authorization,
+        callback: F,
+    ) -> Self
     where
         F: Fn(&[u8]) + 'static + Send + Sync,
     {
-        Self::new_inner(awareness, Arc::new(callback))
+        Self::new_inner(awareness, authorization, Arc::new(callback))
     }
 
-    pub fn new_inner(awareness: Arc<RwLock<Awareness>>, callback: Callback) -> Self {
+    pub fn new_inner(
+        awareness: Arc<RwLock<Awareness>>,
+        authorization: Authorization,
+        callback: Callback,
+    ) -> Self {
         let closed = Arc::new(OnceLock::new());
 
         let (doc_subscription, awareness_subscription) = {
@@ -127,6 +137,7 @@ impl DocConnection {
             awareness,
             doc_subscription,
             awareness_subscription,
+            authorization,
             callback,
             client_id: OnceLock::new(),
             closed,
@@ -152,6 +163,7 @@ impl DocConnection {
         protocol: &P,
         msg: Message,
     ) -> Result<Option<Message>, sync::Error> {
+        let can_write = matches!(self.authorization, Authorization::Full);
         let a = &self.awareness;
         match msg {
             Message::Sync(msg) => match msg {
@@ -160,12 +172,24 @@ impl DocConnection {
                     protocol.handle_sync_step1(&awareness, sv)
                 }
                 SyncMessage::SyncStep2(update) => {
-                    let mut awareness = a.write().unwrap();
-                    protocol.handle_sync_step2(&mut awareness, Update::decode_v1(&update)?)
+                    if can_write {
+                        let mut awareness = a.write().unwrap();
+                        protocol.handle_sync_step2(&mut awareness, Update::decode_v1(&update)?)
+                    } else {
+                        Err(sync::Error::PermissionDenied {
+                            reason: "Token does not have write access".to_string(),
+                        })
+                    }
                 }
                 SyncMessage::Update(update) => {
-                    let mut awareness = a.write().unwrap();
-                    protocol.handle_update(&mut awareness, Update::decode_v1(&update)?)
+                    if can_write {
+                        let mut awareness = a.write().unwrap();
+                        protocol.handle_update(&mut awareness, Update::decode_v1(&update)?)
+                    } else {
+                        Err(sync::Error::PermissionDenied {
+                            reason: "Token does not have write access".to_string(),
+                        })
+                    }
                 }
             },
             Message::Auth(reason) => {