feat(auth): Implement Tenant token

Make meilisearch support JWT authentication signed with meilisearch API keys
using HS256, HS384 or HS512 algorithms.

Related spec: https://github.com/meilisearch/specifications/pull/89
Fix #1991

meilisearch-auth/src/lib.rs

@@ -4,11 +4,13 @@ pub mod error;
 mod key;
 mod store;
 
+use std::collections::{HashMap, HashSet};
 use std::path::Path;
 use std::str::from_utf8;
 use std::sync::Arc;
 
 use chrono::Utc;
+use serde::{Deserialize, Serialize};
 use serde_json::Value;
 use sha2::{Digest, Sha256};
 
@@ -54,7 +56,11 @@ impl AuthController {
             .ok_or_else(|| AuthControllerError::ApiKeyNotFound(key.as_ref().to_string()))
     }
 
-    pub fn get_key_filters(&self, key: impl AsRef<str>) -> Result<AuthFilter> {
+    pub fn get_key_filters(
+        &self,
+        key: impl AsRef<str>,
+        search_rules: Option<SearchRules>,
+    ) -> Result<AuthFilter> {
         let mut filters = AuthFilter::default();
         if self
             .master_key
@@ -67,7 +73,22 @@ impl AuthController {
                 .ok_or_else(|| AuthControllerError::ApiKeyNotFound(key.as_ref().to_string()))?;
 
             if !key.indexes.iter().any(|i| i.as_str() == "*") {
-                filters.indexes = Some(key.indexes);
+                filters.search_rules = match search_rules {
+                    // Intersect search_rules with parent key authorized indexes.
+                    Some(search_rules) => SearchRules::Map(
+                        key.indexes
+                            .into_iter()
+                            .filter_map(|index| {
+                                search_rules
+                                    .get_index_search_rules(&index)
+                                    .map(|index_search_rules| (index, Some(index_search_rules)))
+                            })
+                            .collect(),
+                    ),
+                    None => SearchRules::Set(key.indexes.into_iter().collect()),
+                };
+            } else if let Some(search_rules) = search_rules {
+                filters.search_rules = search_rules;
             }
 
             filters.allow_index_creation = key
@@ -97,50 +118,149 @@ impl AuthController {
         self.master_key.as_ref()
     }
 
-    pub fn authenticate(&self, token: &[u8], action: Action, index: Option<&[u8]>) -> Result<bool> {
-        if let Some(master_key) = &self.master_key {
-            if let Some((id, exp)) = self
-                .store
-                // check if the key has access to all indexes.
-                .get_expiration_date(token, action, None)?
-                .or(match index {
-                    // else check if the key has access to the requested index.
-                    Some(index) => self.store.get_expiration_date(token, action, Some(index))?,
-                    // or to any index if no index has been requested.
-                    None => self.store.prefix_first_expiration_date(token, action)?,
-                })
-            {
-                let id = from_utf8(&id)?;
-                if exp.map_or(true, |exp| Utc::now() < exp)
-                    && generate_key(master_key.as_bytes(), id).as_bytes() == token
-                {
-                    return Ok(true);
+    /// Generate a valid key from a key id using the current master key.
+    /// Returns None if no master key has been set.
+    pub fn generate_key(&self, id: &str) -> Option<String> {
+        self.master_key
+            .as_ref()
+            .map(|master_key| generate_key(master_key.as_bytes(), id))
+    }
+
+    /// Check if the provided key is authorized to make a specific action
+    /// without checking if the key is valid.
+    pub fn is_key_authorized(
+        &self,
+        key: &[u8],
+        action: Action,
+        index: Option<&str>,
+    ) -> Result<bool> {
+        match self
+            .store
+            // check if the key has access to all indexes.
+            .get_expiration_date(key, action, None)?
+            .or(match index {
+                // else check if the key has access to the requested index.
+                Some(index) => {
+                    self.store
+                        .get_expiration_date(key, action, Some(index.as_bytes()))?
                 }
+                // or to any index if no index has been requested.
+                None => self.store.prefix_first_expiration_date(key, action)?,
+            }) {
+            // check expiration date.
+            Some(Some(exp)) => Ok(Utc::now() < exp),
+            // no expiration date.
+            Some(None) => Ok(true),
+            // action or index forbidden.
+            None => Ok(false),
+        }
+    }
+
+    /// Check if the provided key is valid
+    /// without checking if the key is authorized to make a specific action.
+    pub fn is_key_valid(&self, key: &[u8]) -> Result<bool> {
+        if let Some(id) = self.store.get_key_id(key) {
+            let id = from_utf8(&id)?;
+            if let Some(generated) = self.generate_key(id) {
+                return Ok(generated.as_bytes() == key);
             }
         }
 
         Ok(false)
     }
+
+    /// Check if the provided key is valid
+    /// and is authorized to make a specific action.
+    pub fn authenticate(&self, key: &[u8], action: Action, index: Option<&str>) -> Result<bool> {
+        if self.is_key_authorized(key, action, index)? {
+            self.is_key_valid(key)
+        } else {
+            Ok(false)
+        }
+    }
 }
 
 pub struct AuthFilter {
-    pub indexes: Option<Vec<String>>,
+    pub search_rules: SearchRules,
     pub allow_index_creation: bool,
 }
 
 impl Default for AuthFilter {
     fn default() -> Self {
         Self {
-            indexes: None,
+            search_rules: SearchRules::default(),
             allow_index_creation: true,
         }
     }
 }
 
-pub fn generate_key(master_key: &[u8], uid: &str) -> String {
-    let key = [uid.as_bytes(), master_key].concat();
+/// Transparent wrapper around a list of allowed indexes with the search rules to apply for each.
+#[derive(Debug, Serialize, Deserialize, Clone)]
+#[serde(untagged)]
+pub enum SearchRules {
+    Set(HashSet<String>),
+    Map(HashMap<String, Option<IndexSearchRules>>),
+}
+
+impl Default for SearchRules {
+    fn default() -> Self {
+        Self::Set(Some("*".to_string()).into_iter().collect())
+    }
+}
+
+impl SearchRules {
+    pub fn is_index_authorized(&self, index: &str) -> bool {
+        match self {
+            Self::Set(set) => set.contains("*") || set.contains(index),
+            Self::Map(map) => map.contains_key("*") || map.contains_key(index),
+        }
+    }
+
+    pub fn get_index_search_rules(&self, index: &str) -> Option<IndexSearchRules> {
+        match self {
+            Self::Set(set) => {
+                if set.contains("*") || set.contains(index) {
+                    Some(IndexSearchRules::default())
+                } else {
+                    None
+                }
+            }
+            Self::Map(map) => map
+                .get(index)
+                .or_else(|| map.get("*"))
+                .map(|isr| isr.clone().unwrap_or_default()),
+        }
+    }
+}
+
+impl IntoIterator for SearchRules {
+    type Item = (String, IndexSearchRules);
+    type IntoIter = Box<dyn Iterator<Item = Self::Item>>;
+
+    fn into_iter(self) -> Self::IntoIter {
+        match self {
+            Self::Set(array) => {
+                Box::new(array.into_iter().map(|i| (i, IndexSearchRules::default())))
+            }
+            Self::Map(map) => {
+                Box::new(map.into_iter().map(|(i, isr)| (i, isr.unwrap_or_default())))
+            }
+        }
+    }
+}
+
+/// Contains the rules to apply on the top of the search query for a specific index.
+///
+/// filter: search filter to apply in addition to query filters.
+#[derive(Debug, Serialize, Deserialize, Default, Clone)]
+pub struct IndexSearchRules {
+    pub filter: Option<serde_json::Value>,
+}
+
+fn generate_key(master_key: &[u8], keyid: &str) -> String {
+    let key = [keyid.as_bytes(), master_key].concat();
     let sha = Sha256::digest(&key);
-    format!("{}{:x}", uid, sha)
+    format!("{}{:x}", keyid, sha)
 }
 
 fn generate_default_keys(store: &HeedAuthStore) -> Result<()> {