Move server-side relay auth out of shared and drop the unused validator

shared/relay/auth/allow/allow_all.go

@@ -1,10 +0,0 @@
-package allow
-
-// Auth is a Validator that allows all connections.
-// Used this for testing purposes only.
-type Auth struct {
-}
-
-func (a *Auth) Validate(any) error {
-	return nil
-}

shared/relay/auth/doc.go

@@ -1,26 +0,0 @@
-/*
-Package auth manages the authentication process with the relay server.
-
-Key Components:
-
-Validator: The Validator interface defines the Validate method. Any type that provides this method can be used as a
-Validator.
-
-Methods:
-
-Validate(func() hash.Hash, any): This method is defined in the Validator interface and is used to validate the authentication.
-
-Usage:
-
-To create a new AllowAllAuth validator, simply instantiate it:
-
-	validator := &allow.Auth{}
-
-To validate the authentication, use the Validate method:
-
-	err := validator.Validate(sha256.New, any)
-
-This package provides a simple and effective way to manage authentication with the relay server, ensuring that the
-peers are authenticated properly.
-*/
-package auth

shared/relay/auth/go.sum

@@ -1 +0,0 @@
-golang.org/x/crypto v0.37.0/go.mod h1:vg+k43peMZ0pUMhYmVAWysMK35e6ioLh3wB8ZCAfbVc=

shared/relay/auth/hmac/token.go

@@ -47,31 +47,6 @@ func (m *TimedHMAC) GenerateToken(algo func() hash.Hash) (*Token, error) {
 	}, nil
 }
 
-// Validate checks if the token is valid
-func (m *TimedHMAC) Validate(algo func() hash.Hash, token Token) error {
-	expectedMAC, err := m.generate(algo, token.Payload)
-	if err != nil {
-		return err
-	}
-
-	expectedSignature := base64.StdEncoding.EncodeToString(expectedMAC)
-
-	if !hmac.Equal([]byte(expectedSignature), []byte(token.Signature)) {
-		return fmt.Errorf("signature mismatch")
-	}
-
-	timeAuthInt, err := strconv.ParseInt(token.Payload, 10, 64)
-	if err != nil {
-		return fmt.Errorf("invalid payload: %w", err)
-	}
-
-	if time.Now().Unix() > timeAuthInt {
-		return fmt.Errorf("expired token")
-	}
-
-	return nil
-}
-
 func (m *TimedHMAC) generate(algo func() hash.Hash, payload string) ([]byte, error) {
 	mac := hmac.New(algo, []byte(m.secret))
 	_, err := mac.Write([]byte(payload))

shared/relay/auth/hmac/token_test.go

@@ -2,7 +2,6 @@ package hmac
 
 import (
 	"crypto/sha1"
-	"crypto/sha256"
 	"encoding/base64"
 	"strconv"
 	"testing"
@@ -33,73 +32,3 @@ func TestGenerateCredentials(t *testing.T) {
 		t.Fatalf("expected signature to be base64 encoded, got %v", err)
 	}
 }
-
-func TestValidateCredentials(t *testing.T) {
-	secret := "supersecret"
-	timeToLive := 1 * time.Hour
-	manager := NewTimedHMAC(secret, timeToLive)
-
-	// Test valid token
-	creds, err := manager.GenerateToken(sha1.New)
-	if err != nil {
-		t.Fatalf("expected no error, got %v", err)
-	}
-
-	if err := manager.Validate(sha1.New, *creds); err != nil {
-		t.Fatalf("expected valid token: %s", err)
-	}
-}
-
-func TestInvalidSignature(t *testing.T) {
-	secret := "supersecret"
-	timeToLive := 1 * time.Hour
-	manager := NewTimedHMAC(secret, timeToLive)
-
-	creds, err := manager.GenerateToken(sha256.New)
-	if err != nil {
-		t.Fatalf("expected no error, got %v", err)
-	}
-
-	invalidCreds := &Token{
-		Payload:   creds.Payload,
-		Signature: "invalidsignature",
-	}
-
-	if err = manager.Validate(sha1.New, *invalidCreds); err == nil {
-		t.Fatalf("expected invalid token due to signature mismatch")
-	}
-}
-
-func TestExpired(t *testing.T) {
-	secret := "supersecret"
-	v := NewTimedHMAC(secret, -1*time.Hour)
-	expiredCreds, err := v.GenerateToken(sha256.New)
-	if err != nil {
-		t.Fatalf("expected no error, got %v", err)
-	}
-
-	if err = v.Validate(sha1.New, *expiredCreds); err == nil {
-		t.Fatalf("expected invalid token due to expiration")
-	}
-}
-
-func TestInvalidPayload(t *testing.T) {
-	secret := "supersecret"
-	timeToLive := 1 * time.Hour
-	v := NewTimedHMAC(secret, timeToLive)
-
-	creds, err := v.GenerateToken(sha256.New)
-	if err != nil {
-		t.Fatalf("expected no error, got %v", err)
-	}
-
-	// Test invalid payload
-	invalidPayloadCreds := &Token{
-		Payload:   "invalidtimestamp",
-		Signature: creds.Signature,
-	}
-
-	if err = v.Validate(sha1.New, *invalidPayloadCreds); err == nil {
-		t.Fatalf("expected invalid token due to invalid payload")
-	}
-}

shared/relay/auth/validator.go

@@ -1,19 +0,0 @@
-package auth
-
-import (
-	authv2 "github.com/netbirdio/netbird/shared/relay/auth/hmac/v2"
-)
-
-type TimedHMACValidator struct {
-	authenticatorV2 *authv2.Validator
-}
-
-func NewTimedHMACValidator(secret []byte) *TimedHMACValidator {
-	return &TimedHMACValidator{
-		authenticatorV2: authv2.NewValidator(secret),
-	}
-}
-
-func (a *TimedHMACValidator) Validate(credentials any) error {
-	return a.authenticatorV2.Validate(credentials)
-}

shared/relay/client/client_serverip_test.go

@@ -11,8 +11,8 @@ import (
 	"go.opentelemetry.io/otel"
 
 	"github.com/netbirdio/netbird/client/iface"
+	"github.com/netbirdio/netbird/relay/auth/allow"
 	"github.com/netbirdio/netbird/relay/server"
-	"github.com/netbirdio/netbird/shared/relay/auth/allow"
 )
 
 // TestClient_ServerIPRecoversFromUnresolvableFQDN verifies that when the

shared/relay/client/client_test.go

@@ -11,11 +11,10 @@ import (
 	"go.opentelemetry.io/otel"
 
 	"github.com/netbirdio/netbird/client/iface"
-	"github.com/netbirdio/netbird/shared/relay/auth/allow"
+	"github.com/netbirdio/netbird/relay/auth/allow"
+	"github.com/netbirdio/netbird/relay/server"
 	"github.com/netbirdio/netbird/shared/relay/auth/hmac"
 	"github.com/netbirdio/netbird/util"
-
-	"github.com/netbirdio/netbird/relay/server"
 )
 
 var (

shared/relay/client/manager_test.go

@@ -11,8 +11,8 @@ import (
 	"go.opentelemetry.io/otel"
 
 	"github.com/netbirdio/netbird/client/iface"
+	"github.com/netbirdio/netbird/relay/auth/allow"
 	"github.com/netbirdio/netbird/relay/server"
-	"github.com/netbirdio/netbird/shared/relay/auth/allow"
 )
 
 // newManagerTestServerConfig creates a new server config for manager testing with the given address