Move server-side relay auth out of shared and drop the unused validator

combined/cmd/root.go

@@ -29,13 +29,13 @@ import (
 	mgmtServer "github.com/netbirdio/netbird/management/internals/server"
 	nbconfig "github.com/netbirdio/netbird/management/internals/server/config"
 	"github.com/netbirdio/netbird/management/server/telemetry"
+	"github.com/netbirdio/netbird/relay/auth"
 	"github.com/netbirdio/netbird/relay/healthcheck"
 	relayServer "github.com/netbirdio/netbird/relay/server"
 	"github.com/netbirdio/netbird/relay/server/listener"
 	"github.com/netbirdio/netbird/relay/server/listener/ws"
 	syncgrpc "github.com/netbirdio/netbird/shared/management/grpc"
 	sharedMetrics "github.com/netbirdio/netbird/shared/metrics"
-	"github.com/netbirdio/netbird/shared/relay/auth"
 	"github.com/netbirdio/netbird/shared/signal/proto"
 	signalServer "github.com/netbirdio/netbird/signal/server"
 	"github.com/netbirdio/netbird/stun"

relay/auth/doc.go

@@ -8,7 +8,7 @@ Validator.
 
 Methods:
 
-Validate(func() hash.Hash, any): This method is defined in the Validator interface and is used to validate the authentication.
+Validate(any) error: This method is defined in the Validator interface and is used to validate the authentication.
 
 Usage:
 
@@ -18,7 +18,7 @@ To create a new AllowAllAuth validator, simply instantiate it:
 
 To validate the authentication, use the Validate method:
 
-	err := validator.Validate(sha256.New, any)
+	err := validator.Validate(credentials)
 
 This package provides a simple and effective way to manage authentication with the relay server, ensuring that the
 peers are authenticated properly.

relay/cmd/root.go

@@ -19,10 +19,10 @@ import (
 	"github.com/spf13/cobra"
 
 	"github.com/netbirdio/netbird/encryption"
+	"github.com/netbirdio/netbird/relay/auth"
 	"github.com/netbirdio/netbird/relay/healthcheck"
 	"github.com/netbirdio/netbird/relay/server"
 	"github.com/netbirdio/netbird/shared/metrics"
-	"github.com/netbirdio/netbird/shared/relay/auth"
 	"github.com/netbirdio/netbird/stun"
 	"github.com/netbirdio/netbird/trustedproxy"
 	"github.com/netbirdio/netbird/util"

relay/test/benchmark_test.go

@@ -14,8 +14,8 @@ import (
 	"github.com/pion/turn/v3"
 
 	"github.com/netbirdio/netbird/client/iface"
+	"github.com/netbirdio/netbird/relay/auth/allow"
 	"github.com/netbirdio/netbird/relay/server"
-	"github.com/netbirdio/netbird/shared/relay/auth/allow"
 	"github.com/netbirdio/netbird/shared/relay/auth/hmac"
 	"github.com/netbirdio/netbird/shared/relay/client"
 	"github.com/netbirdio/netbird/util"

shared/relay/auth/go.sum

@@ -1 +0,0 @@
-golang.org/x/crypto v0.37.0/go.mod h1:vg+k43peMZ0pUMhYmVAWysMK35e6ioLh3wB8ZCAfbVc=

shared/relay/auth/hmac/token.go

@@ -47,31 +47,6 @@ func (m *TimedHMAC) GenerateToken(algo func() hash.Hash) (*Token, error) {
 	}, nil
 }
 
-// Validate checks if the token is valid
-func (m *TimedHMAC) Validate(algo func() hash.Hash, token Token) error {
-	expectedMAC, err := m.generate(algo, token.Payload)
-	if err != nil {
-		return err
-	}
-
-	expectedSignature := base64.StdEncoding.EncodeToString(expectedMAC)
-
-	if !hmac.Equal([]byte(expectedSignature), []byte(token.Signature)) {
-		return fmt.Errorf("signature mismatch")
-	}
-
-	timeAuthInt, err := strconv.ParseInt(token.Payload, 10, 64)
-	if err != nil {
-		return fmt.Errorf("invalid payload: %w", err)
-	}
-
-	if time.Now().Unix() > timeAuthInt {
-		return fmt.Errorf("expired token")
-	}
-
-	return nil
-}
-
 func (m *TimedHMAC) generate(algo func() hash.Hash, payload string) ([]byte, error) {
 	mac := hmac.New(algo, []byte(m.secret))
 	_, err := mac.Write([]byte(payload))

shared/relay/auth/hmac/token_test.go

@@ -2,7 +2,6 @@ package hmac
 
 import (
 	"crypto/sha1"
-	"crypto/sha256"
 	"encoding/base64"
 	"strconv"
 	"testing"
@@ -33,73 +32,3 @@ func TestGenerateCredentials(t *testing.T) {
 		t.Fatalf("expected signature to be base64 encoded, got %v", err)
 	}
 }
-
-func TestValidateCredentials(t *testing.T) {
-	secret := "supersecret"
-	timeToLive := 1 * time.Hour
-	manager := NewTimedHMAC(secret, timeToLive)
-
-	// Test valid token
-	creds, err := manager.GenerateToken(sha1.New)
-	if err != nil {
-		t.Fatalf("expected no error, got %v", err)
-	}
-
-	if err := manager.Validate(sha1.New, *creds); err != nil {
-		t.Fatalf("expected valid token: %s", err)
-	}
-}
-
-func TestInvalidSignature(t *testing.T) {
-	secret := "supersecret"
-	timeToLive := 1 * time.Hour
-	manager := NewTimedHMAC(secret, timeToLive)
-
-	creds, err := manager.GenerateToken(sha256.New)
-	if err != nil {
-		t.Fatalf("expected no error, got %v", err)
-	}
-
-	invalidCreds := &Token{
-		Payload:   creds.Payload,
-		Signature: "invalidsignature",
-	}
-
-	if err = manager.Validate(sha1.New, *invalidCreds); err == nil {
-		t.Fatalf("expected invalid token due to signature mismatch")
-	}
-}
-
-func TestExpired(t *testing.T) {
-	secret := "supersecret"
-	v := NewTimedHMAC(secret, -1*time.Hour)
-	expiredCreds, err := v.GenerateToken(sha256.New)
-	if err != nil {
-		t.Fatalf("expected no error, got %v", err)
-	}
-
-	if err = v.Validate(sha1.New, *expiredCreds); err == nil {
-		t.Fatalf("expected invalid token due to expiration")
-	}
-}
-
-func TestInvalidPayload(t *testing.T) {
-	secret := "supersecret"
-	timeToLive := 1 * time.Hour
-	v := NewTimedHMAC(secret, timeToLive)
-
-	creds, err := v.GenerateToken(sha256.New)
-	if err != nil {
-		t.Fatalf("expected no error, got %v", err)
-	}
-
-	// Test invalid payload
-	invalidPayloadCreds := &Token{
-		Payload:   "invalidtimestamp",
-		Signature: creds.Signature,
-	}
-
-	if err = v.Validate(sha1.New, *invalidPayloadCreds); err == nil {
-		t.Fatalf("expected invalid token due to invalid payload")
-	}
-}

shared/relay/client/client_serverip_test.go

@@ -11,8 +11,8 @@ import (
 	"go.opentelemetry.io/otel"
 
 	"github.com/netbirdio/netbird/client/iface"
+	"github.com/netbirdio/netbird/relay/auth/allow"
 	"github.com/netbirdio/netbird/relay/server"
-	"github.com/netbirdio/netbird/shared/relay/auth/allow"
 )
 
 // TestClient_ServerIPRecoversFromUnresolvableFQDN verifies that when the

shared/relay/client/client_test.go

@@ -11,11 +11,10 @@ import (
 	"go.opentelemetry.io/otel"
 
 	"github.com/netbirdio/netbird/client/iface"
-	"github.com/netbirdio/netbird/shared/relay/auth/allow"
+	"github.com/netbirdio/netbird/relay/auth/allow"
+	"github.com/netbirdio/netbird/relay/server"
 	"github.com/netbirdio/netbird/shared/relay/auth/hmac"
 	"github.com/netbirdio/netbird/util"
-
-	"github.com/netbirdio/netbird/relay/server"
 )
 
 var (

shared/relay/client/manager_test.go

@@ -11,8 +11,8 @@ import (
 	"go.opentelemetry.io/otel"
 
 	"github.com/netbirdio/netbird/client/iface"
+	"github.com/netbirdio/netbird/relay/auth/allow"
 	"github.com/netbirdio/netbird/relay/server"
-	"github.com/netbirdio/netbird/shared/relay/auth/allow"
 )
 
 // newManagerTestServerConfig creates a new server config for manager testing with the given address