3f88f6c388
Two paths, one session. The GSI popup posts an ID token to /student/google; where a popup is refused a PKCE authorization-code flow redeems server side at /student/google/callback, keeping the client secret out of the browser. ID tokens are verified here rather than trusted from the browser: RS256 signature against Google's published JWKS (cached an hour), audience pinned to this client, issuer restricted to Google, expiry enforced, email must be verified. State is single use and expires in ten minutes. Without GOOGLE_CLIENT_ID the button is hidden and the email form is offered instead. 13 tests cover the verification rules using locally generated RSA keys, including rejection of a foreign signature, a wrong audience, a wrong issuer, an expired token and a rewritten payload. An example signs a token from an untrusted key so the rejection path can be checked without a Google account.
27 lines
937 B
TOML
27 lines
937 B
TOML
[package]
|
|
name = "zenith-pyq-clone"
|
|
version = "0.1.0"
|
|
edition = "2024"
|
|
|
|
[dependencies]
|
|
anyhow = "1.0.104"
|
|
axum = { version = "0.8.9", features = ["form", "query", "json", "http1", "http2"] }
|
|
base64 = "0.23.1"
|
|
chrono = { version = "0.4.45", features = ["serde"] }
|
|
jsonwebtoken = { version = "11.1.0", features = ["rust_crypto", "use_pem"] }
|
|
reqwest = { version = "0.13.5", features = ["form", "json"] }
|
|
serde = { version = "1.0.229", features = ["derive"] }
|
|
serde_json = "1.0.152"
|
|
sha2 = "0.11.0"
|
|
sqlx = { version = "0.9.0", features = ["sqlite", "runtime-tokio", "macros", "chrono", "uuid"] }
|
|
tokio = { version = "1.53.2", features = ["full"] }
|
|
tower-cookies = "0.11.0"
|
|
tower-http = { version = "0.7.1", features = ["fs"] }
|
|
tracing = "0.1.44"
|
|
tracing-subscriber = "0.3.23"
|
|
uuid = { version = "1.28.0", features = ["v4", "serde"] }
|
|
|
|
[dev-dependencies]
|
|
rand = "0.8"
|
|
rsa = { version = "0.9", features = ["pem"] }
|
|
serde_urlencoded = "0.7.1"
|