Skip to content

Commit c1fc22d

Browse files
SecondeJKSecondeJK
authored
Merge pull request #356 from opentok/feature/jwt-change
Use firebase JWT
2 parents 3f10580 + 8288d8a commit c1fc22d

File tree

3 files changed

+40
-71
lines changed

3 files changed

+40
-71
lines changed

Diff for: ‎composer.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@
3131
"php": "^7.2|^8.0",
3232
"ext-xml": "*",
3333
"johnstevenson/json-works": "~1.1",
34-
"firebase/php-jwt": "^6.0",
34+
"firebase/php-jwt": "^6.11",
3535
"guzzlehttp/guzzle": "~6.0|~7.0",
3636
"ext-json": "*",
3737
"vonage/jwt": "^0.5.1"

Diff for: ‎src/OpenTok/OpenTok.php

+19-39
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
namespace OpenTok;
44

55
use DateTimeImmutable;
6+
use Firebase\JWT\JWT;
67
use Firebase\JWT\Key;
78
use Lcobucci\JWT\Configuration;
89
use Lcobucci\JWT\Encoding\ChainedFormatter;
@@ -84,7 +85,7 @@ public function __construct($apiKey, $apiSecret, $options = array())
8485
* @param string $sessionId The session ID corresponding to the session to which the user
8586
* will connect.
8687
*
87-
* @param array $options This array defines options for the token. This array includes the
88+
* @param array $payload This array defines options for the token. This array includes the
8889
* following keys, all of which are optional:
8990
*
9091
* <ul>
@@ -114,52 +115,31 @@ public function __construct($apiKey, $apiSecret, $options = array())
114115
* </ul>
115116
*
116117
* @param bool $legacy By default, OpenTok uses SHA256 JWTs for authentication. Switching
117-
* legacy to true will create a deprecated T1 token for backwards compatibility.
118+
* legacy to true will create a T1 token for backwards compatibility.
118119
*
119120
* @return string The token string.
120121
*/
121-
public function generateToken(string $sessionId, array $options = array(), bool $legacy = false): string
122+
public function generateToken(string $sessionId, array $payload = array(), bool $legacy = false): string
122123
{
123-
// Note, JWT generation disabled due to a backend bug regarding `exp` claims being mandatory - CRT
124-
// if ($legacy) {
125-
return $this->returnLegacyToken($sessionId, $options);
126-
// }
127-
128-
// $issuedAt = new \DateTimeImmutable('@' . time());
129-
130-
// $defaults = [
131-
// 'session_id' => $sessionId,
132-
// 'role' => Role::PUBLISHER,
133-
// 'expireTime' => null,
134-
// 'initial_layout_list' => [''],
135-
// 'ist' => 'project',
136-
// 'nonce' => mt_rand(),
137-
// 'scope' => 'session.connect'
138-
// ];
139-
140-
// $options = array_merge($defaults, array_intersect_key($options, $defaults));
141-
142-
// $builder = new Builder(new JoseEncoder(), ChainedFormatter::default());
143-
// $builder = $builder->issuedBy($this->apiKey);
144-
145-
// if ($options['expireTime']) {
146-
// $expiry = new \DateTimeImmutable('@' . $options['expireTime']);
147-
// $builder = $builder->expiresAt($expiry);
148-
// }
149-
150-
// unset($options['expireTime']);
124+
if ($legacy) {
125+
return $this->returnLegacyToken($sessionId, $payload);
126+
}
151127

152-
// $builder = $builder->issuedAt($issuedAt);
153-
// $builder = $builder->canOnlyBeUsedAfter($issuedAt);
154-
// $builder = $builder->identifiedBy(bin2hex(random_bytes(16)));
128+
$issuedAt = new \DateTimeImmutable('@' . time());
155129

156-
// foreach ($options as $key => $value) {
157-
// $builder = $builder->withClaim($key, $value);
158-
// }
130+
$defaults = [
131+
'iss' => $this->apiKey,
132+
'iat' => $issuedAt->getTimestamp(),
133+
'session_id' => $sessionId,
134+
'role' => Role::PUBLISHER,
135+
'ist' => 'project',
136+
'nonce' => mt_rand(),
137+
'scope' => 'session.connect'
138+
];
159139

160-
// $token = $builder->getToken(new \Lcobucci\JWT\Signer\Hmac\Sha256(), InMemory::plainText($this->apiSecret));
140+
$payload = array_merge($defaults, array_intersect_key($payload, $defaults));
161141

162-
// return $token->toString();
142+
return JWT::encode($payload, $this->apiSecret, 'HS256');
163143
}
164144

165145
private function returnLegacyToken(string $sessionId, array $options = []): string

Diff for: ‎tests/OpenTokTest/OpenTokTest.php

+20-31
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@
22

33
namespace OpenTokTest;
44

5+
use Firebase\JWT\JWT;
6+
use Firebase\JWT\Key;
57
use Lcobucci\JWT\Configuration;
68
use Lcobucci\JWT\Token\Plain;
79
use OpenTok\Render;
@@ -753,41 +755,28 @@ public function testWillCreateLegacyT1WhenRequested(): void
753755
public function testWillCreateLegacyT1DirectlyToBypassExpBug(): void
754756
{
755757
$openTok = new OpenTok('12345678', '0123456789abcdef0123456789abcdef0123456789');
756-
$token = $openTok->generateToken('1_MX4xMjM0NTY3OH4-VGh1IEZlYiAyNyAwNDozODozMSBQU1QgMjAxNH4wLjI0NDgyMjI', []);
758+
$token = $openTok->generateToken('1_MX4xMjM0NTY3OH4-VGh1IEZlYiAyNyAwNDozODozMSBQU1QgMjAxNH4wLjI0NDgyMjI', [], true);
757759

758760
$this->assertEquals('T1', substr($token, 0, 2));
759761
}
760762

761-
/**
762-
* Makes sure that a JWT is generated for the client-side token
763-
*
764-
* Currently disabled due to the backend requiring an `exp` claim, which was
765-
* not required on T1s. Uncomment when the backend is fixed. - CRT
766-
*/
767-
// public function testWillCreateJwt(): void
768-
// {
769-
// $openTok = new OpenTok('my-api-key', 'my-super-long-and-cool-api-secret');
770-
// $token = $openTok->generateToken('some-token-value');
771-
772-
// $config = Configuration::forSymmetricSigner(
773-
// new \Lcobucci\JWT\Signer\Hmac\Sha256(),
774-
// \Lcobucci\JWT\Signer\Key\InMemory::plainText('my-super-long-and-cool-api-secret')
775-
// );
776-
777-
// $token = $config->parser()->parse($token);
778-
// $this->assertInstanceOf(Plain::class, $token);
779-
780-
// $this->assertTrue($config->validator()->validate($token, new \Lcobucci\JWT\Validation\Constraint\SignedWith(
781-
// $config->signer(),
782-
// $config->signingKey()
783-
// )));
784-
785-
// $this->assertEquals('my-api-key', $token->claims()->get('iss'));
786-
// $this->assertEquals('some-token-value', $token->claims()->get('session_id'));
787-
// $this->assertEquals('publisher', $token->claims()->get('role'));
788-
// $this->assertEquals('project', $token->claims()->get('ist'));
789-
// $this->assertEquals('session.connect', $token->claims()->get('scope'));
790-
// }
763+
public function testWillGenerateSha256Token(): void
764+
{
765+
$openTok = new OpenTok('12345678', '0123456789abcdef0123456789abcdef0123456789');
766+
$token = $openTok->generateToken('1_MX4xMjM0NTY3OH4-VGh1IEZlYiAyNyAwNDozODozMSBQU1QgMjAxNH4wLjI0NDgyMjI');
767+
768+
$this->assertNotEquals('T1', substr($token, 0, 2));
769+
770+
$decoded = JWT::decode($token, new Key('0123456789abcdef0123456789abcdef0123456789', 'HS256'));
771+
$decodedArray = (array) $decoded;
772+
773+
$this->assertEquals('12345678', $decodedArray['iss']);
774+
$this->assertEquals('1_MX4xMjM0NTY3OH4-VGh1IEZlYiAyNyAwNDozODozMSBQU1QgMjAxNH4wLjI0NDgyMjI', $decodedArray['session_id']);
775+
$this->assertEquals('project', $decodedArray['ist']);
776+
$this->assertEquals('session.connect', $decodedArray['scope']);
777+
$this->assertEquals('publisher', $decodedArray['role']);
778+
779+
}
791780

792781
public function testStartsArchive(): void
793782
{

0 commit comments

Comments
 (0)