o_sfu/config/
auth.rs

1use anyhow::{Result, anyhow, ensure};
2use o_sfu_rfc::jwt::HS256_MIN_KEY_BYTES;
3
4use super::{
5    AuthConfig, DEFAULT_MAX_PRE_AUTH_WEBSOCKET_SESSIONS,
6    DEFAULT_MAX_PRE_AUTH_WEBSOCKET_SESSIONS_PER_ORIGIN,
7    env::{Env, EnvKey, positive},
8};
9use crate::runtime::auth::decode_key;
10
11impl AuthConfig {
12    pub(super) fn from_env(env: &Env<'_>) -> Result<Self> {
13        Ok(Self {
14            key: env.var("AUTH_KEY").check(validate_auth_key).required()?,
15            authentication_timeout_ms: env.var("AUTHENTICATION_TIMEOUT_MS").default(10_000)?,
16            max_pre_auth_websocket_sessions: env
17                .var("MAX_PRE_AUTH_WEBSOCKET_SESSIONS")
18                .check(positive)
19                .default(DEFAULT_MAX_PRE_AUTH_WEBSOCKET_SESSIONS)?,
20            max_pre_auth_websocket_sessions_per_origin: env
21                .var("MAX_PRE_AUTH_WEBSOCKET_SESSIONS_PER_ORIGIN")
22                .check(positive)
23                .default(DEFAULT_MAX_PRE_AUTH_WEBSOCKET_SESSIONS_PER_ORIGIN)?,
24        })
25    }
26}
27
28fn validate_auth_key(key: EnvKey, value: String) -> Result<String> {
29    let key_len = decode_key(&value)
30        .map_err(|_error| anyhow!("{key} must be valid base64"))?
31        .len();
32    ensure!(
33        key_len >= HS256_MIN_KEY_BYTES,
34        "{key} must decode to at least {HS256_MIN_KEY_BYTES} bytes"
35    );
36    Ok(value)
37}
o_sfu/config/auth.rs

o_sfu/config/
auth.rs
