update added to config.json jwt_secret

config.json

@@ -7,5 +7,6 @@
   "web": "./web",
   "tls_enabled": true,
   "tls_cert": "/home/tola/certs/localhost/localhost.crt",
-  "tls_key": "/home/tola/certs/localhost/localhost.key"
+  "tls_key": "/home/tola/certs/localhost/localhost.key",
+  "jwt_secret": "super_secret"
 }

src/api/add_user.c

@@ -1,10 +1,18 @@
 #include "security/jwt.h"
 #include "user.h"
 #include "utils/utils.h"
+#include "config/config.h"
 
 void add_user(struct mg_connection *c, struct mg_http_message *hm) {
   request_with_token *requestdata = check_body(hm);
-  const bool valid = jwt_verifyJWT(requestdata->token, JWT_DEFAULT_SECRET);
+  char *jwt_secret = cm_get_parameter_as_string(config, "jwt_secret");
+  bool valid = false;
+  if (jwt_secret) {
+    printf("jwt_secret is not null %s\n", jwt_secret);
+    valid = jwt_verifyJWT(requestdata->token, jwt_secret);
+  } else {
+    valid = jwt_verifyJWT(requestdata->token, JWT_DEFAULT_SECRET);
+  }
   if (!valid) {
     mg_http_reply(c, 403, HTTP_HEADERS, "{%m:%m}", MG_ESC("error"),
                   MG_ESC("invalid token"));

src/api/change_password.c

@@ -2,6 +2,7 @@
 #include "security/jwt.h"
 #include "user.h"
 #include "utils/utils.h"
+#include "config/config.h"
 
 void change_password(struct mg_connection *c, struct mg_http_message *hm) {
   if (hm->body.len == 0) {
@@ -15,7 +16,14 @@ void change_password(struct mg_connection *c, struct mg_http_message *hm) {
                   MG_ESC(requestdata->error));
     return;
   }
-  const bool valid = jwt_verifyJWT(requestdata->token, JWT_DEFAULT_SECRET);
+  char *jwt_secret = cm_get_parameter_as_string(config, "jwt_secret");
+  bool valid = false;
+  if (jwt_secret) {
+    printf("jwt_secret is not null %s\n", jwt_secret);
+    valid = jwt_verifyJWT(requestdata->token, jwt_secret);
+  } else {
+    valid = jwt_verifyJWT(requestdata->token, JWT_DEFAULT_SECRET);
+  }
   if (!valid) {
     mg_http_reply(c, 403, HTTP_HEADERS, "{%m:%m}", MG_ESC("error"),
                   MG_ESC("invalid token"));

src/api/change_user.c

@@ -1,6 +1,7 @@
 #include "security/jwt.h"
 #include "user.h"
 #include "utils/utils.h"
+#include "config/config.h"
 
 void change_user(struct mg_connection *c, struct mg_http_message *hm) {
   if (hm->body.len == 0) {
@@ -14,7 +15,14 @@ void change_user(struct mg_connection *c, struct mg_http_message *hm) {
                   MG_ESC(requestdata->error));
     return;
   }
-  const bool valid = jwt_verifyJWT(requestdata->token, JWT_DEFAULT_SECRET);
+  char *jwt_secret = cm_get_parameter_as_string(config, "jwt_secret");
+  bool valid = false;
+  if (jwt_secret) {
+    printf("jwt_secret is not null %s\n", jwt_secret);
+    valid = jwt_verifyJWT(requestdata->token, jwt_secret);
+  } else {
+    valid = jwt_verifyJWT(requestdata->token, JWT_DEFAULT_SECRET);
+  }
   if (!valid) {
     mg_http_reply(c, 403, HTTP_HEADERS, "{%m:%m}", MG_ESC("error"),
                   MG_ESC("invalid token"));

src/api/delete_user.c

@@ -1,6 +1,7 @@
 #include "security/jwt.h"
 #include "user.h"
 #include "utils/utils.h"
+#include "config/config.h"
 
 void delete_user(struct mg_connection *c, struct mg_http_message *hm) {
   if (hm->body.len == 0) {
@@ -14,7 +15,14 @@ void delete_user(struct mg_connection *c, struct mg_http_message *hm) {
                   MG_ESC(requestdata->error));
     return;
   }
-  const bool valid = jwt_verifyJWT(requestdata->token, JWT_DEFAULT_SECRET);
+  char *jwt_secret = cm_get_parameter_as_string(config, "jwt_secret");
+  bool valid = false;
+  if (jwt_secret) {
+    printf("jwt_secret is not null %s\n", jwt_secret);
+    valid = jwt_verifyJWT(requestdata->token, jwt_secret);
+  } else {
+    valid = jwt_verifyJWT(requestdata->token, JWT_DEFAULT_SECRET);
+  }
   if (!valid) {
     mg_http_reply(c, 403, HTTP_HEADERS, "{%m:%m}", MG_ESC("error"),
                   MG_ESC("invalid token"));

src/api/get_all_users.c

@@ -1,6 +1,7 @@
 #include "security/jwt.h"
 #include "user.h"
 #include "utils/utils.h"
+#include "config/config.h"
 
 void get_all_users(struct mg_connection *c, struct mg_http_message *hm) {
   request_with_token *data = check_body(hm);
@@ -9,7 +10,15 @@ void get_all_users(struct mg_connection *c, struct mg_http_message *hm) {
                   MG_ESC(data->error));
     return;
   }
-  if (!jwt_verifyJWT(data->token, JWT_DEFAULT_SECRET)) {
+  char *jwt_secret = cm_get_parameter_as_string(config, "jwt_secret");
+  bool valid = false;
+  if (jwt_secret) {
+    printf("jwt_secret is not null %s\n", jwt_secret);
+    valid = jwt_verifyJWT(data->token, jwt_secret);
+  } else {
+    valid = jwt_verifyJWT(data->token, JWT_DEFAULT_SECRET);
+  }
+  if (!valid) {
     mg_http_reply(c, 403, HTTP_HEADERS, "{%m:%m}", MG_ESC("error"),
                   MG_ESC("invalid token"));
     return;

src/api/get_token.c

@@ -1,5 +1,7 @@
+#include "config/ConfigManager.h"
 #include "security/jwt.h"
 #include "user.h"
+#include "config/config.h"
 
 void get_token(struct mg_connection *c, struct mg_http_message *hm) {
   if (hm->body.len == 0) {
@@ -41,9 +43,17 @@ void get_token(struct mg_connection *c, struct mg_http_message *hm) {
            "\"%s\",\"is_superuser\": %s}",
            db_user->id, db_user->username, db_user->email, db_user->group,
            db_user->is_superuser ? "true" : "false");
-  char *token = jwt_createJWT(header, payload, JWT_DEFAULT_SECRET);
+  char *jwt_secret = cm_get_parameter_as_string(config, "jwt_secret");
+  char *token = nullptr;
+  if (jwt_secret) {
+      printf("jwt_secret is not null %s\n", jwt_secret);
+      token = jwt_createJWT(header, payload, jwt_secret);
+  } else {
+      token = jwt_createJWT(header, payload, JWT_DEFAULT_SECRET);
+  }
   mg_http_reply(c, 200, HTTP_HEADERS, "{%m:%m}", MG_ESC("token"),
                 MG_ESC(token));
   free_user(db_user);
   free(token);
+  free(jwt_secret);
 }

src/api/get_user.c

@@ -1,6 +1,7 @@
 #include "security/jwt.h"
 #include "user.h"
 #include "utils/utils.h"
+#include "config/config.h"
 
 void get_user(struct mg_connection *c, struct mg_http_message *hm) {
   if (hm->body.len == 0) {
@@ -14,7 +15,15 @@ void get_user(struct mg_connection *c, struct mg_http_message *hm) {
                   MG_ESC(requestdata->error));
     return;
   }
-  if (!jwt_verifyJWT(requestdata->token, JWT_DEFAULT_SECRET)) {
+  char *jwt_secret = cm_get_parameter_as_string(config, "jwt_secret");
+    bool valid = false;
+    if (jwt_secret) {
+      printf("jwt_secret is not null %s\n", jwt_secret);
+      valid = jwt_verifyJWT(requestdata->token, jwt_secret);
+    } else {
+      valid = jwt_verifyJWT(requestdata->token, JWT_DEFAULT_SECRET);
+    }
+  if (!valid) {
     free_request_with_token(requestdata);
     mg_http_reply(c, 403, HTTP_HEADERS, "{%m:%m}", MG_ESC("error"),
                   MG_ESC("invalid token"));

src/api/verify_token.c

@@ -1,3 +1,5 @@
+#include "config/ConfigManager.h"
+#include "config/config.h"
 #include "security/jwt.h"
 #include "user.h"
 #include "utils/utils.h"
@@ -8,7 +10,14 @@ void verify_token(struct mg_connection *c, struct mg_http_message *hm) {
     mg_http_reply(c, 403, HTTP_HEADERS, "{%m:false}", MG_ESC("valid"));
     return;
   }
-  const bool valid = jwt_verifyJWT(data->token, JWT_DEFAULT_SECRET);
+  char *jwt_secret = cm_get_parameter_as_string(config, "jwt_secret");
+  bool valid = false;
+  if (jwt_secret) {
+    printf("jwt_secret is not null %s\n", jwt_secret);
+    valid = jwt_verifyJWT(data->token, jwt_secret);
+  } else {
+    valid = jwt_verifyJWT(data->token, JWT_DEFAULT_SECRET);
+  }
   if (!valid) {
     mg_http_reply(c, 403, HTTP_HEADERS, "{%m:false}", MG_ESC("valid"));
     free_request_with_token(data);
@@ -35,4 +44,5 @@ void verify_token(struct mg_connection *c, struct mg_http_message *hm) {
   free_request_with_token(data);
   free(username);
   free_user(user);
+  free(jwt_secret);
 }