snapshot of https://github.com/centrifugal/centrifugo.git (master, 2026-09-16; blobs > 131072B omitted)

internal/cli/gentoken.go

@@ -0,0 +1,106 @@
+package cli
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os"
+	"time"
+
+	"github.com/centrifugal/centrifugo/v6/internal/config"
+	"github.com/centrifugal/centrifugo/v6/internal/confighelpers"
+	"github.com/centrifugal/centrifugo/v6/internal/jwtverify"
+
+	"github.com/cristalhq/jwt/v5"
+	"github.com/spf13/cobra"
+	"github.com/tidwall/sjson"
+)
+
+func GenToken() *cobra.Command {
+	var genTokenConfigFile string
+	var genTokenUser string
+	var genTokenTTL int64
+	var genTokenQuiet bool
+	var genTokenCmd = &cobra.Command{
+		Use:   "gentoken",
+		Short: "Generate sample connection JWT for user",
+		Long:  `Generate sample connection JWT for user`,
+		Run: func(cmd *cobra.Command, args []string) {
+			genToken(cmd, genTokenConfigFile, genTokenUser, genTokenTTL, genTokenQuiet)
+		},
+	}
+	genTokenCmd.Flags().StringVarP(&genTokenConfigFile, "config", "c", "config.json", "path to config file")
+	genTokenCmd.Flags().StringVarP(&genTokenUser, "user", "u", "", "user ID, by default anonymous")
+	genTokenCmd.Flags().Int64VarP(&genTokenTTL, "ttl", "t", 3600*24*7, "token TTL in seconds, use -1 for token without expiration")
+	genTokenCmd.Flags().BoolVarP(&genTokenQuiet, "quiet", "q", false, "only output the token without anything else")
+	return genTokenCmd
+}
+
+func genToken(cmd *cobra.Command, genTokenConfigFile string, genTokenUser string, genTokenTTL int64, genTokenQuiet bool) {
+	cfg, _, err := config.GetConfig(cmd, genTokenConfigFile)
+	if err != nil {
+		fmt.Printf("error getting config: %v\n", err)
+		os.Exit(1)
+	}
+	verifierConfig, err := confighelpers.MakeVerifierConfig(cfg.Client.Token)
+	if err != nil {
+		fmt.Printf("error: %v\n", err)
+		os.Exit(1)
+	}
+	token, err := generateToken(verifierConfig, genTokenUser, genTokenTTL)
+	if err != nil {
+		fmt.Printf("error: %v\n", err)
+		os.Exit(1)
+	}
+	var user = fmt.Sprintf("user \"%s\"", genTokenUser)
+	if genTokenUser == "" {
+		user = "anonymous user"
+	}
+	exp := "without expiration"
+	if genTokenTTL >= 0 {
+		exp = fmt.Sprintf("with expiration TTL %s", time.Duration(genTokenTTL)*time.Second)
+	}
+	if genTokenQuiet {
+		fmt.Print(token)
+		return
+	}
+	fmt.Printf("HMAC SHA-256 JWT for %s %s:\n%s\n", user, exp, token)
+}
+
+// generateToken generates sample JWT for user.
+func generateToken(config jwtverify.VerifierConfig, user string, ttlSeconds int64) (string, error) {
+	if config.HMACSecretKey == "" {
+		return "", errors.New("gentoken only supports generating HMAC-signed tokens, but no HMAC secret key is set in the configuration (client.token.hmac_secret_key) – if you use RSA/ECDSA/JWKS token verification you need to generate the JWT with your own tooling")
+	}
+	signer, err := jwt.NewSignerHS(jwt.HS256, []byte(config.HMACSecretKey))
+	if err != nil {
+		return "", fmt.Errorf("error creating HMAC signer: %w", err)
+	}
+	builder := jwt.NewBuilder(signer)
+	claims := jwtverify.ConnectTokenClaims{
+		RegisteredClaims: jwt.RegisteredClaims{
+			IssuedAt: jwt.NewNumericDate(time.Now()),
+			Subject:  user,
+		},
+	}
+	if ttlSeconds > 0 {
+		claims.ExpiresAt = jwt.NewNumericDate(time.Now().Add(time.Duration(ttlSeconds) * time.Second))
+	}
+
+	encodedClaims, err := json.Marshal(claims)
+	if err != nil {
+		return "", err
+	}
+	if config.UserIDClaim != "" {
+		encodedClaims, err = sjson.SetBytes(encodedClaims, config.UserIDClaim, user)
+		if err != nil {
+			return "", err
+		}
+	}
+
+	token, err := builder.Build(encodedClaims)
+	if err != nil {
+		return "", err
+	}
+	return token.String(), nil
+}