feat: JWT verification builtins (#94)

Cargo.toml

@@ -47,6 +47,7 @@ time = ["dep:chrono", "dep:chrono-tz"]
 uuid = ["dep:uuid"]
 urlquery = ["dep:url"]
 yaml = ["serde_yaml"]
+jwt-openssl = ["openssl"]
 full-opa = [
     "base64",
     "base64url",
@@ -66,8 +67,7 @@ full-opa = [
     "time",
     "uuid",
     "urlquery",
-    "yaml",
-
+    "yaml"
     #"rego-extensions"
 ]
 
@@ -95,6 +95,9 @@ rego-extensions = []
 opa-testutil = []
 rand = ["dep:rand"]
 
+# Enable this feature to omit some restrictions in opa test environment
+weak-safety = []
+
 [dependencies]
 anyhow = { version = "1.0.45", default-features = false }
 serde = {version = "1.0.150", default-features = false, features = ["derive", "rc", "alloc"] }
@@ -130,6 +133,8 @@ mimalloc = { package = "regorus-mimalloc", path = "mimalloc", version = "2.2.6",
 indexmap = { version = "2.12.1", default-features = false, features = ["serde"], optional = true }
 bincode = { version = "2.0.1", default-features = false, features = ["alloc", "serde"], optional = true }
 
+openssl = { version = "0.10.73", optional = true}
+
 [dev-dependencies]
 anyhow = "1.0.45"
 cfg-if = "1.0.0"
@@ -144,6 +149,7 @@ num_cpus = "1.16"
 
 [build-dependencies]
 anyhow = "1.0"
+openssl = { version = "0.10.73", optional = true}
 
 [profile.release]
 debug = true

bindings/ffi/Cargo.toml

@@ -12,7 +12,7 @@ crate-type = ["cdylib", "staticlib"]
 [dependencies]
 anyhow = "1.0"
 regorus = { path  = "../..", default-features = false }
-serde_json = "1.0.140"
+serde_json = "1.0.149"
 parking_lot = { version = "0.12", optional = true }
 
 [profile.release]

build.rs

@@ -26,6 +26,22 @@ fn main() -> Result<()> {
         println!("cargo:rustc-env=GIT_HASH={git_hash}");
     }
 
+    // Verify OpenSSL version
+    #[cfg(feature = "jwt-openssl")]
+    {
+        use openssl::version;
+        // Minimal OpenSSL version that meets FIPS certification
+        let min_ver_num = 0x30000000i64;
+        let ver = version::version();
+        let ver_num = version::number();
+        if !ver.starts_with("OpenSSL") || ver_num < min_ver_num {
+            panic!(
+                "FATAL: OpenSSL version must be 3.0.0 or higher, found version: {}",
+                ver
+            );
+        }
+    }
+
     // Rerun only if build.rs changes.
     println!("cargo:rerun-if-changed=build.rs");
     Ok(())

src/builtins/jwt/backend.rs

@@ -0,0 +1,26 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+use crate::*;
+use anyhow::Result;
+
+pub trait Backend {
+    fn encode_base64url(src: &[u8]) -> String;
+    fn decode_base64url(src: &str) -> Result<Vec<u8>>;
+
+    fn verify_hs256(token: &str, secret: &str) -> Result<bool>;
+    fn verify_hs384(token: &str, secret: &str) -> Result<bool>;
+    fn verify_hs512(token: &str, secret: &str) -> Result<bool>;
+
+    fn verify_rs256(token: &str, certificate: &str) -> Result<bool>;
+    fn verify_rs384(token: &str, certificate: &str) -> Result<bool>;
+    fn verify_rs512(token: &str, certificate: &str) -> Result<bool>;
+
+    fn verify_ps256(token: &str, certificate: &str) -> Result<bool>;
+    fn verify_ps384(token: &str, certificate: &str) -> Result<bool>;
+    fn verify_ps512(token: &str, certificate: &str) -> Result<bool>;
+
+    fn verify_es256(token: &str, certificate: &str) -> Result<bool>;
+    fn verify_es384(token: &str, certificate: &str) -> Result<bool>;
+    fn verify_es512(token: &str, certificate: &str) -> Result<bool>;
+}

src/builtins/jwt/backends/mod.rs

@@ -0,0 +1,5 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+#[cfg(feature = "jwt-openssl")]
+pub mod openssl;