Auto-commit

Author: milos85vasic

auth-service/src/auth_service.go

@@ -186,6 +186,20 @@ func (s *AuthServiceServer) ValidateToken(ctx context.Context, req *auth.Validat
 	}
 
 	if claims, ok := token.Claims.(jwt.MapClaims); ok && token.Valid {
+		// Validate JTI is UUID v4
+		if jti, exists := claims["jti"].(string); exists {
+			parsedUUID, err := uuid.Parse(jti)
+			if err != nil || uuid.Version(parsedUUID) != 4 {
+				return nil, errors.New("invalid JTI format")
+			}
+		}
+		// Validate JTI is UUID v4
+		if jti, exists := claims["jti"].(string); exists {
+			parsedUUID, err := uuid.Parse(jti)
+			if err != nil || uuid.Version(parsedUUID) != 4 {
+				return nil, errors.New("invalid JTI format")
+			}
+		}
 		userID := claims["sub"].(string)
 		username := claims["username"].(string)
 		expiresAt := int64(claims["exp"].(float64))
@@ -234,7 +248,13 @@ func (s *AuthServiceServer) RefreshToken(ctx context.Context, req *auth.RefreshT
 	if !ok {
 		return nil, status.Error(codes.Unauthenticated, "invalid token claims")
 	}
-
+	// Validate JTI is UUID v4
+	if jti, exists := claims["jti"].(string); exists {
+		parsedUUID, err := uuid.Parse(jti)
+		if err != nil || uuid.Version(parsedUUID) != 4 {
+			return nil, status.Error(codes.Unauthenticated, "invalid JTI format")
+		}
+	}
 	userID := claims["sub"].(string)
 
 	// Get user by ID to retrieve username

auth-service/src/uuid_validation_test.go

@@ -0,0 +1,108 @@
+package main
+
+import (
+	"testing"
+	"github.com/golang-jwt/jwt/v5"
+	"github.com/google/uuid"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+var testKey = []byte("test-secret")
+
+func generateTestToken(claims jwt.MapClaims) (string, error) {
+	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
+	return token.SignedString(testKey)
+}
+
+func TestValidateTokenWithValidUUIDv4(t *testing.T) {
+	validUUID := uuid.New().String()
+	claims := jwt.MapClaims{"jti": validUUID, "sub": "user123"}
+	tokenString, _ := generateTestToken(claims)
+
+	_, err := ValidateToken(tokenString)
+	if err != nil {
+		t.Fatalf("Expected no error, got %v", err)
+	}
+}
+
+func TestValidateTokenWithInvalidUUIDFormat(t *testing.T) {
+	invalidUUID := "not-a-uuid"
+	claims := jwt.MapClaims{"jti": invalidUUID, "sub": "user123"}
+	tokenString, _ := generateTestToken(claims)
+
+	_, err := ValidateToken(tokenString)
+	if err == nil {
+		t.Fatal("Expected error, got none")
+	}
+	expectedErr := status.Error(codes.Unauthenticated, "invalid JTI format")
+	if err.Error() != expectedErr.Error() {
+		t.Fatalf("Expected error %v, got %v", expectedErr, err)
+	}
+}
+
+func TestValidateTokenWithMissingJTI(t *testing.T) {
+	claims := jwt.MapClaims{"sub": "user123"}
+	tokenString, _ := generateTestToken(claims)
+
+	_, err := ValidateToken(tokenString)
+	if err != nil {
+		t.Fatalf("Expected no error, got %v", err)
+	}
+}
+
+func TestValidateTokenWithNonV4UUID(t *testing.T) {
+	nonV4UUID := "123e4567-e89b-11d3-a75a-426614174000" // UUID v1
+	claims := jwt.MapClaims{"jti": nonV4UUID, "sub": "user123"}
+	tokenString, _ := generateTestToken(claims)
+
+	_, err := ValidateToken(tokenString)
+	if err == nil {
+		t.Fatal("Expected error, got none")
+	}
+	expectedErr := status.Error(codes.Unauthenticated, "invalid JTI format")
+	if err.Error() != expectedErr.Error() {
+		t.Fatalf("Expected error %v, got %v", expectedErr, err)
+	}
+}
+
+func TestRefreshTokenWithValidUUIDv4(t *testing.T) {
+	validUUID := uuid.New().String()
+	claims := jwt.MapClaims{"jti": validUUID, "sub": "user123"}
+	tokenString, _ := generateTestToken(claims)
+
+	_, err := RefreshToken(tokenString)
+	if err != nil {
+		t.Fatalf("Expected no error, got %v", err)
+	}
+}
+
+func TestRefreshTokenWithInvalidUUIDFormat(t *testing.T) {
+	invalidUUID := "not-a-uuid"
+	claims := jwt.MapClaims{"jti": invalidUUID, "sub": "user123"}
+	tokenString, _ := generateTestToken(claims)
+
+	_, err := RefreshToken(tokenString)
+	if err == nil {
+		t.Fatal("Expected error, got none")
+	}
+	expectedErr := status.Error(codes.Unauthenticated, "invalid JTI format")
+	if err.Error() != expectedErr.Error() {
+		t.Fatalf("Expected error %v, got %v", expectedErr, err)
+	}
+}
+
+func TestRefreshTokenWithNonV4UUID(t *testing.T) {
+	nonV4UUID := "123e4567-e89b-11d3-a75a-426614174000" // UUID v1
+	claims := jwt.MapClaims{"jti": nonV4UUID, "sub": "user123"}
+	tokenString, _ := generateTestToken(claims)
+
+	_, err := RefreshToken(tokenString)
+	if err == nil {
+		t.Fatal("Expected error, got none")
+	}
+	expectedErr := status.Error(codes.Unauthenticated, "invalid JTI format")
+	if err.Error() != expectedErr.Error() {
+		t.Fatalf("Expected error %v, got %v", expectedErr, err)
+	}
+}