fix!: Remove ring dependency (#380)

Remove dependency on jsonwebtoken which brings in the ring crate.
Ring crate triggers governance violations.

Support for JWT will be implemented in future using a more governance
compliant crate.

BREAKING CHANGE

Prior to this PR, support for jwt builtins was minimially implemented.
Only io.jwt.decode and io.jwt.decode_verify was implemented.
With this PR, those builtins will no longer be available. They are
planned to be implemented in the future. In the meantime, they can be
brought back in via Engine::add_extension.

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>

src/builtins/jwt.rs

@@ -1,73 +0,0 @@
-// Copyright (c) Microsoft Corporation.
-// Licensed under the MIT License.
-
-use crate::ast::{Expr, Ref};
-use crate::builtins;
-use crate::builtins::utils::{ensure_args_count, ensure_string};
-use crate::*;
-
-use crate::lexer::Span;
-use crate::value::Value;
-
-use itertools::Itertools;
-
-use anyhow::{bail, Result};
-
-pub fn register(m: &mut builtins::BuiltinsMap<&'static str, builtins::BuiltinFcn>) {
-    m.insert("io.jwt.decode", (jwt_decode, 1));
-    m.insert("io.jwt.decode_verify", (jwt_decode_verify, 2));
-}
-
-fn decode(span: &Span, jwt: String, strict: bool) -> Result<Value> {
-    let Some((Ok(header), Ok(payload), Ok(signature))) = jwt
-        .split('.')
-        .map(|p| data_encoding::BASE64URL_NOPAD.decode(p.as_bytes()))
-        .collect_tuple()
-    else {
-        if strict {
-            bail!(span.error("invalid jwt token"));
-        }
-        return Ok(Value::Undefined);
-    };
-
-    let header = String::from_utf8_lossy(&header).to_string();
-    let payload = String::from_utf8_lossy(&payload).to_string();
-    let signature = data_encoding::HEXLOWER_PERMISSIVE.encode(&signature);
-
-    let signature = Value::String(signature.into());
-    let header = Value::from_json_str(&header)?;
-
-    if header["enc"] != Value::Undefined {
-        bail!(span.error("JWT is a JWE object, which is not supported"));
-    }
-
-    if header["cty"] == "JWT".into() {
-        if payload.len() <= 2 || !payload.starts_with('"') || !payload.ends_with('"') {
-            bail!(span.error("invalid nested JWT"));
-        }
-        // Ignore ""
-        decode(span, payload[1..payload.len() - 1].to_string(), strict)
-    } else {
-        let payload = Value::from_json_str(&payload)?;
-        Ok(Value::from_array([header, payload, signature].into()))
-    }
-}
-
-fn jwt_decode(span: &Span, params: &[Ref<Expr>], args: &[Value], strict: bool) -> Result<Value> {
-    let name = "io.jwt.decode";
-    ensure_args_count(span, name, params, args, 1)?;
-    let jwt = ensure_string(name, &params[0], &args[0])?;
-
-    decode(span, jwt.to_string(), strict) //header, payload, signature, strict)
-}
-
-fn jwt_decode_verify(
-    span: &Span,
-    params: &[Ref<Expr>],
-    args: &[Value],
-    _strict: bool,
-) -> Result<Value> {
-    let name = "io.jwt.decode_verify";
-    ensure_args_count(span, name, params, args, 2)?;
-    Ok(Value::Undefined)
-}

src/builtins/mod.rs

@@ -18,8 +18,6 @@ mod glob;
 mod graph;
 #[cfg(feature = "http")]
 mod http;
-#[cfg(feature = "jwt")]
-mod jwt;
 pub mod numbers;
 mod objects;
 #[cfg(feature = "opa-runtime")]
@@ -83,8 +81,6 @@ lazy_static! {
 	//units::register(&mut m);
 	types::register(&mut m);
 	encoding::register(&mut m);
-	#[cfg(feature = "jwt")]
-	jwt::register(&mut m);
 	#[cfg(feature = "time")]
 	time::register(&mut m);
 

src/builtins/opa.rs

@@ -67,8 +67,6 @@ fn opa_runtime(span: &Span, params: &[Ref<Expr>], args: &[Value], _strict: bool)
         "hex",
         #[cfg(feature = "http")]
         "http",
-        #[cfg(feature = "jwt")]
-        "jwt",
         #[cfg(feature = "jsonschema")]
         "jsonschema",
         #[cfg(feature = "opa-runtime")]