ms2k/nuthatch
SHA256
Watch
0
Code Releases Activity

Complete runtime resilience and audit controls

Browse source
This commit is contained in:
ms2k 2026-07-19 03:41:01 +09:00
commit 728abdbbf1
1 changed files with 1466 additions and 251 deletions
Download patch file Download diff file Expand all files Collapse all files

6
src/Nuthatch/Session.hs
View file

@ -45,7 +45,7 @@ import Data.Text (Text)
import qualified Data.Text as T
import qualified Data.Text.Encoding as TE
import Data.Time.Clock (addUTCTime, getCurrentTime)
import Nuthatch.Config (Config (..))
import Nuthatch.Config (Config (..), revealSecret)
import Nuthatch.Paths (encodeUserId)
import Nuthatch.Types
import System.Entropy (getEntropy)
@ -108,7 +108,7 @@ mintSession cfg issuer subject display = do
, oidcSubject = subject
, displayName = display
}
key = fromOctets (TE.encodeUtf8 (cfgJwtSecret cfg))
key = fromOctets (TE.encodeUtf8 (revealSecret (cfgJwtSecret cfg)))
header = newJWSHeaderProtected HS256
encodeCompact <$> signJWT key header claims
pure $ case result of
@ -126,7 +126,7 @@ verifySession cfg (SessionToken token) = do
defaultJWTValidationSettings (== applicationAudience)
& issuerPredicate .~ (== applicationIssuer)
& algorithms .~ singleton HS256
key = fromOctets (TE.encodeUtf8 (cfgJwtSecret cfg))
key = fromOctets (TE.encodeUtf8 (revealSecret (cfgJwtSecret cfg)))
verifyJWT settings key (jwt :: SignedJWT)
pure $ case result of
Left (_ :: JWTError) -> Left "session token validation failed"