Merge pull request #124 from nightly-labs/grafana

Grafana

.env

@@ -1,4 +1,74 @@
 ENV=DEV # PROD or DEV
 ONLY_RELAY_SERVICE=True # TRUE - This will start only nightly relay service without cloud service
 NONCE=VERY_SECRET_NONCE
-JWT_SECRET=VERY_SECRET_SECRET
+# Generated so it can work with grafana 
+# ssh-keygen -t rsa -b 4096 -m PEM -f grafana.key -N ""
+# openssl rsa -in grafana.key -pubout -outform PEM -out grafana.key.pub
+# TEST KEY DO NO USE IN PRODUCTION
+JWT_SECRET="-----BEGIN RSA PRIVATE KEY-----
+MIIJKQIBAAKCAgEAzlUYIpqSUAyLJaf8ZUef06YBh5DcmaTrwGcVwC57VtywY7bH
+XQUtGooULQjiYgnyOPxHDt2W+gQW1axiMxOQew0MF0kXYQhg0+WA1dcWOsxCDpyL
+c4z+E7EmdV7MTuvsDR2TLhZ6DFmVbN4ca64Wvftz//3Ptc/I1/VpfGsHWb0Vpmph
+kbE9vWGHzzJVp/Lvtk7ybcpfxiiNWEi7unr7/TIEsqy93lCRfpLKIvO06ITH1GZz
+7+VPL/8q8lrH5kSwxqo5szq1mEa0pNN6hTpocz00x5oBfL9K/TNLQNgdb5uOOfjQ
+9pYtZ49UDyMLs5lCsZ6ue+SIbWrJXDEPMIEgLzx9nnvytL9wbiwo5GQdIaDAZXMw
+VVdKQGyqx+UhaHmrb1u0RVRcFzO/QPWzNCWvoxJGfg9dVTxfjaa1HzQ0irPs86zC
+QUnt0OyTuq0SmUgTCNXLSQaN8MigN++zwT4cIRDB0WMgmu8sxtnmA3Zq+2GYT97j
+mbdVMB34DVbXI4UigD3UieVe4rO95cEssoUTAFG0pthv64BRKIIRNch+eiBBjkGp
+nWKRybzsmqnEqpMf9v7KQU9hmpBJDbi6KA6w3fg3KSroJZwosbAwdBuylCfQgq1j
+Z6UfR/ss9kYGhaWbCB3ARmY9XHFc+OZuFW0pohgfBfs9RDMDVkTa4tzBAGsCAwEA
+AQKCAgB/cQHCRdS/SrAbZyG28MFgObXSJQCMidfvc/x0QoF+CjuMq1WCN/M+5DBI
+DKe/RENvPSsqnGVnMWVlPt88iwX/avSf4U5maYVc+/FSo1IgqQ7X9YsQqPI5+X42
+moH48TFQfIbuvYVO4XowzxOg0ttLJufkIsHLm3aDJRqtdXIJ1IdtzWFMWrw2n+oB
+aSaM4Ll80lBczdXQEDYVZH9HVDUWk3FhZt6zVPI4yrO9WOfRgknnAAz2DJ2XmLTP
+EpFLwfuqCXQwJsAJOQrUj6aqaYQgQZq6+n2WrpTDxY3ilFnCGMOFPRDcba/HujiC
+TPQqTyxphwhgj6xQYNfUcJzgKbFVPkcp2Y72feu4dPwRn9v/9zflsezPg33mjNLD
+ls2XrA1S+UKQpiLbF5Mv6U0MxuFRoZIVhSflA/FGHgIE+IGiMDWPLQVpTBJYDjWG
+9giRRBOm4qf9CPPJVnJVEkibDbsKnRTMOPSRBgNBYvpiMO06hWsNktntJ/iqvgf0
+2L//kQEPUTx5+RdSjarQNw0tU7nQid0mf1e3rEXfitr77E6dp+T+2POXQzr2lTFA
+QzaWkIRNNJqCBI/aUhEkAnx2kVlzgLBGYVtAwlCZVF9r0VphmAIQdSeaiI/4N3zh
+jPl0jVYQCKUPe7FslC6f/hks6Y+uMJIeph9XHdYBvcDWZcZCCQKCAQEA/vhsO+vR
+vFRu4q6cvruFoEqODjZnwYUdYKnSa7O2ZTn3VkUE197pL5tSc2At9txZ6AFZ28ye
+ZDUsx+IOvt2PUfJAo7cAL6Vx9TTEMlDcSs0LFRKIrE5lI9hMHOu1evJxN9s3jivZ
+rp0PLEGrllcKIOg5+Zh/yXQue0R2b3H3/f7BdvMS4gjZq8NF0SDLe/WL2PQ0baSL
+MLC8048CDM3BVzjxx2u6ghFambJ0fJIID6DAvkdrNZ/loie71sEVJdJiY3jra/Mq
+JCOZJlRBTevVSfI0uqtybv1QYaU+Mqth8fZxWvhC14Rf30VLEWp9GV0u7Q9p0baj
+nXay/kwXE7uvJQKCAQEAzypkQ6BodHU2FRPpU4wytsowTVbcQs5DNr9ayrTyuPGa
+ydGRzJ0/qHzAv/rWjImny7r8uuvDfNXAxRI5kbAJMImrbG6zjmLHwYKCrB1GFsx1
+QRRuDiMFbblVitA1XHs/sSM0VdO18nLYPY71uIEaTKZTxd1rYuxam3SwZ7prTUGH
+zfI8S4G5vnAn2nWUHmbSNKdtBPqMf65pPGPkKmzBUd++1mvmdsVroGxi37n5vL66
+cUKlvQ5u+l1cqV/EWC6wIoJhrsgkfAO7aFSZQIXIdUeh2C57oFoVdCWULhN09quB
+XIRularP7IC/0e7dMAf5tyQ7Z90/zyMqEpMyX6XkTwKCAQEA5JbMUpyFmRcJoulx
+Vf7BOogc+9kDBJjXUcZvBGhGalKh0RJn2THcVfYm4ZGlI+FCKaKscUbt6mFSGJIv
+LidtSsap9R0oaY8mr/PywjmEhvt1qBrJtdFDE/PjqToZpnSd1LoRAMGHk+jzpXXq
+5Ap85ivNblyulGo5EgK7PActkuZHhOFAWK4emMOlYGzKggQOsR+fsX0H3UtWv0VD
+TT9ay1weR+/pcpskYw9/J/+0gm5Y3z8gex8zvUFqQosw7ovD8fKC/nEvot7Xe2mm
+crmwq28enwz+t0scOa7wKHVGhquvzSMuqhHf8kgpmR+jsI2+eIKNGJtp7M5yg1Ks
+jeCCkQKCAQAP3/G69OnMMscoKlRw4IdqVmgJJSTPwbqI0XUFn4QSBAGWgYaopUwh
+fx3OGEykjE/dXsDLGhHq2P5im5jpvxGVNJd8Qadku9EO1Q9qXPvn91bs28HrN2fN
+FqylbHsKUS96RXZXNVf18jL71J6jutDnGr/Eo8j81ZvD2ddCu5hJXUIo1+0i5Bf1
+reZ/6Q6mnb5x5nqGLSTjC9xokkcDsT3HJlwbVj1c0JgEvQl+l2O5wOvMjgzhRd/f
+M5RMLlh/YWSB4HfXyuJw1mBgCEuOFDJeOlT+meFDUmPeeJq4RSlrVY0eJ8/JjENO
+njcUwTcV3SaXkCE1PlELcGhi8ACmL7IlAoIBAQDRR/cQe7/6jIfEXbCemkWQ5Drs
+CF6jk7gUREbNiTpfWUYSa4DcsyB5phvn2MTM/rsunWtKBrRl7FwDPZcIHrNnsp1U
+w/OPG9nl9ScULy34hwksYShrFZPGeWM8dg+zB1LpwgzsirQiXqmu5FDUrzmCqLM6
+8GYuZHYXowAU0LDUtn/z8Mqv05HR/NwTZxDlxyJMIdVdoUYyWtYUAHb5p839N1Qx
+tj4b9QGK2SBDcOQwq8eCnK/DUjIBUTL+4DNSDeQCr8gc82SwkoZGBCwIWQH+ZwDz
+noL/o/3a5OnNQI0eB7/0g6ElR8BmkeZy1sZXaxZ3caatctEUuUgVFYuVkf9m
+-----END RSA PRIVATE KEY-----
+"
+JWT_PUBLIC_KEY="-----BEGIN PUBLIC KEY-----
+MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAzlUYIpqSUAyLJaf8ZUef
+06YBh5DcmaTrwGcVwC57VtywY7bHXQUtGooULQjiYgnyOPxHDt2W+gQW1axiMxOQ
+ew0MF0kXYQhg0+WA1dcWOsxCDpyLc4z+E7EmdV7MTuvsDR2TLhZ6DFmVbN4ca64W
+vftz//3Ptc/I1/VpfGsHWb0VpmphkbE9vWGHzzJVp/Lvtk7ybcpfxiiNWEi7unr7
+/TIEsqy93lCRfpLKIvO06ITH1GZz7+VPL/8q8lrH5kSwxqo5szq1mEa0pNN6hTpo
+cz00x5oBfL9K/TNLQNgdb5uOOfjQ9pYtZ49UDyMLs5lCsZ6ue+SIbWrJXDEPMIEg
+Lzx9nnvytL9wbiwo5GQdIaDAZXMwVVdKQGyqx+UhaHmrb1u0RVRcFzO/QPWzNCWv
+oxJGfg9dVTxfjaa1HzQ0irPs86zCQUnt0OyTuq0SmUgTCNXLSQaN8MigN++zwT4c
+IRDB0WMgmu8sxtnmA3Zq+2GYT97jmbdVMB34DVbXI4UigD3UieVe4rO95cEssoUT
+AFG0pthv64BRKIIRNch+eiBBjkGpnWKRybzsmqnEqpMf9v7KQU9hmpBJDbi6KA6w
+3fg3KSroJZwosbAwdBuylCfQgq1jZ6UfR/ss9kYGhaWbCB3ARmY9XHFc+OZuFW0p
+ohgfBfs9RDMDVkTa4tzBAGsCAwEAAQ==
+-----END PUBLIC KEY-----
+"

Cargo.toml

@@ -7,7 +7,7 @@ ctrlc = "3.4.2"
 serde = { version = "1.0.197", features = ["derive"] }
 tracing-subscriber = { version = "0.3.18", features = ["env-filter"] }
 once_cell = "1.19.0"
-garde = { version = "0.18.0", features = ["derive", "email", "regex"]}
+garde = { version = "0.18.0", features = ["derive", "email", "regex"] }
 anyhow = "1.0.79"
 serde_json = "1.0.113"
 strum = { version = "0.26.1", features = ["derive"] }
@@ -32,5 +32,11 @@ tokio = { version = "1.35.1", features = ["full"] }
 async-trait = "0.1.77"
 
 # If you're updating sqlx, make sure that chrono version below is the same as the one in sqlx
-sqlx = { version = "0.7.3", features = [ "runtime-tokio", "tls-rustls", "macros", "postgres", "chrono"] }
+sqlx = { version = "0.7.3", features = [
+  "runtime-tokio",
+  "tls-rustls",
+  "macros",
+  "postgres",
+  "chrono",
+] }
 chrono = { version = "0.4.22", features = ["serde"] }

grafana/.gitignore

@@ -0,0 +1 @@
+grafana-data

grafana/docker-compose.yml

@@ -0,0 +1,19 @@
+version: '3.1'
+
+services:
+  grafana:
+    image: grafana/grafana:latest
+    # container_name: grafana
+    # environment:
+    #   - GF_SECURITY_ADMIN_PASSWORD=secret # Change 'secret' to a strong password
+    #   - GF_USERS_ALLOW_SIGN_UP=false
+    volumes:
+      - ./grafana-data:/var/lib/grafana # Persists Grafana data
+      - ./grafana.ini:/etc/grafana/grafana.ini # Optional: Custom Grafana configuration
+      - ../jwt_keys/grafana.key.pub:/etc/grafana/public-key.pem # Optional: Custom Grafana configuration
+    ports:
+      - '3000:3000'
+    restart: unless-stopped
+
+volumes:
+  grafana-data:

grafana/grafana.ini

@@ -0,0 +1,8 @@
+[auth.jwt]
+enabled = true
+header_name = X-JWT-Assertion
+email_claim = sub
+username_claim = sub
+auto_sign_up = true
+key_file = /etc/grafana/public-key.pem
+url_login = true

grafana/readme.md

@@ -0,0 +1,6 @@
+// Setup
+
+1. Use openresty
+2. Use grafana without auth
+3. Generate JWT on backed
+4. Validate JWT in openresty/nginx

jwt_keys/grafana.key

@@ -0,0 +1,51 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIJKQIBAAKCAgEAzlUYIpqSUAyLJaf8ZUef06YBh5DcmaTrwGcVwC57VtywY7bH
+XQUtGooULQjiYgnyOPxHDt2W+gQW1axiMxOQew0MF0kXYQhg0+WA1dcWOsxCDpyL
+c4z+E7EmdV7MTuvsDR2TLhZ6DFmVbN4ca64Wvftz//3Ptc/I1/VpfGsHWb0Vpmph
+kbE9vWGHzzJVp/Lvtk7ybcpfxiiNWEi7unr7/TIEsqy93lCRfpLKIvO06ITH1GZz
+7+VPL/8q8lrH5kSwxqo5szq1mEa0pNN6hTpocz00x5oBfL9K/TNLQNgdb5uOOfjQ
+9pYtZ49UDyMLs5lCsZ6ue+SIbWrJXDEPMIEgLzx9nnvytL9wbiwo5GQdIaDAZXMw
+VVdKQGyqx+UhaHmrb1u0RVRcFzO/QPWzNCWvoxJGfg9dVTxfjaa1HzQ0irPs86zC
+QUnt0OyTuq0SmUgTCNXLSQaN8MigN++zwT4cIRDB0WMgmu8sxtnmA3Zq+2GYT97j
+mbdVMB34DVbXI4UigD3UieVe4rO95cEssoUTAFG0pthv64BRKIIRNch+eiBBjkGp
+nWKRybzsmqnEqpMf9v7KQU9hmpBJDbi6KA6w3fg3KSroJZwosbAwdBuylCfQgq1j
+Z6UfR/ss9kYGhaWbCB3ARmY9XHFc+OZuFW0pohgfBfs9RDMDVkTa4tzBAGsCAwEA
+AQKCAgB/cQHCRdS/SrAbZyG28MFgObXSJQCMidfvc/x0QoF+CjuMq1WCN/M+5DBI
+DKe/RENvPSsqnGVnMWVlPt88iwX/avSf4U5maYVc+/FSo1IgqQ7X9YsQqPI5+X42
+moH48TFQfIbuvYVO4XowzxOg0ttLJufkIsHLm3aDJRqtdXIJ1IdtzWFMWrw2n+oB
+aSaM4Ll80lBczdXQEDYVZH9HVDUWk3FhZt6zVPI4yrO9WOfRgknnAAz2DJ2XmLTP
+EpFLwfuqCXQwJsAJOQrUj6aqaYQgQZq6+n2WrpTDxY3ilFnCGMOFPRDcba/HujiC
+TPQqTyxphwhgj6xQYNfUcJzgKbFVPkcp2Y72feu4dPwRn9v/9zflsezPg33mjNLD
+ls2XrA1S+UKQpiLbF5Mv6U0MxuFRoZIVhSflA/FGHgIE+IGiMDWPLQVpTBJYDjWG
+9giRRBOm4qf9CPPJVnJVEkibDbsKnRTMOPSRBgNBYvpiMO06hWsNktntJ/iqvgf0
+2L//kQEPUTx5+RdSjarQNw0tU7nQid0mf1e3rEXfitr77E6dp+T+2POXQzr2lTFA
+QzaWkIRNNJqCBI/aUhEkAnx2kVlzgLBGYVtAwlCZVF9r0VphmAIQdSeaiI/4N3zh
+jPl0jVYQCKUPe7FslC6f/hks6Y+uMJIeph9XHdYBvcDWZcZCCQKCAQEA/vhsO+vR
+vFRu4q6cvruFoEqODjZnwYUdYKnSa7O2ZTn3VkUE197pL5tSc2At9txZ6AFZ28ye
+ZDUsx+IOvt2PUfJAo7cAL6Vx9TTEMlDcSs0LFRKIrE5lI9hMHOu1evJxN9s3jivZ
+rp0PLEGrllcKIOg5+Zh/yXQue0R2b3H3/f7BdvMS4gjZq8NF0SDLe/WL2PQ0baSL
+MLC8048CDM3BVzjxx2u6ghFambJ0fJIID6DAvkdrNZ/loie71sEVJdJiY3jra/Mq
+JCOZJlRBTevVSfI0uqtybv1QYaU+Mqth8fZxWvhC14Rf30VLEWp9GV0u7Q9p0baj
+nXay/kwXE7uvJQKCAQEAzypkQ6BodHU2FRPpU4wytsowTVbcQs5DNr9ayrTyuPGa
+ydGRzJ0/qHzAv/rWjImny7r8uuvDfNXAxRI5kbAJMImrbG6zjmLHwYKCrB1GFsx1
+QRRuDiMFbblVitA1XHs/sSM0VdO18nLYPY71uIEaTKZTxd1rYuxam3SwZ7prTUGH
+zfI8S4G5vnAn2nWUHmbSNKdtBPqMf65pPGPkKmzBUd++1mvmdsVroGxi37n5vL66
+cUKlvQ5u+l1cqV/EWC6wIoJhrsgkfAO7aFSZQIXIdUeh2C57oFoVdCWULhN09quB
+XIRularP7IC/0e7dMAf5tyQ7Z90/zyMqEpMyX6XkTwKCAQEA5JbMUpyFmRcJoulx
+Vf7BOogc+9kDBJjXUcZvBGhGalKh0RJn2THcVfYm4ZGlI+FCKaKscUbt6mFSGJIv
+LidtSsap9R0oaY8mr/PywjmEhvt1qBrJtdFDE/PjqToZpnSd1LoRAMGHk+jzpXXq
+5Ap85ivNblyulGo5EgK7PActkuZHhOFAWK4emMOlYGzKggQOsR+fsX0H3UtWv0VD
+TT9ay1weR+/pcpskYw9/J/+0gm5Y3z8gex8zvUFqQosw7ovD8fKC/nEvot7Xe2mm
+crmwq28enwz+t0scOa7wKHVGhquvzSMuqhHf8kgpmR+jsI2+eIKNGJtp7M5yg1Ks
+jeCCkQKCAQAP3/G69OnMMscoKlRw4IdqVmgJJSTPwbqI0XUFn4QSBAGWgYaopUwh
+fx3OGEykjE/dXsDLGhHq2P5im5jpvxGVNJd8Qadku9EO1Q9qXPvn91bs28HrN2fN
+FqylbHsKUS96RXZXNVf18jL71J6jutDnGr/Eo8j81ZvD2ddCu5hJXUIo1+0i5Bf1
+reZ/6Q6mnb5x5nqGLSTjC9xokkcDsT3HJlwbVj1c0JgEvQl+l2O5wOvMjgzhRd/f
+M5RMLlh/YWSB4HfXyuJw1mBgCEuOFDJeOlT+meFDUmPeeJq4RSlrVY0eJ8/JjENO
+njcUwTcV3SaXkCE1PlELcGhi8ACmL7IlAoIBAQDRR/cQe7/6jIfEXbCemkWQ5Drs
+CF6jk7gUREbNiTpfWUYSa4DcsyB5phvn2MTM/rsunWtKBrRl7FwDPZcIHrNnsp1U
+w/OPG9nl9ScULy34hwksYShrFZPGeWM8dg+zB1LpwgzsirQiXqmu5FDUrzmCqLM6
+8GYuZHYXowAU0LDUtn/z8Mqv05HR/NwTZxDlxyJMIdVdoUYyWtYUAHb5p839N1Qx
+tj4b9QGK2SBDcOQwq8eCnK/DUjIBUTL+4DNSDeQCr8gc82SwkoZGBCwIWQH+ZwDz
+noL/o/3a5OnNQI0eB7/0g6ElR8BmkeZy1sZXaxZ3caatctEUuUgVFYuVkf9m
+-----END RSA PRIVATE KEY-----

jwt_keys/grafana.key.pub

@@ -0,0 +1,14 @@
+-----BEGIN PUBLIC KEY-----
+MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAzlUYIpqSUAyLJaf8ZUef
+06YBh5DcmaTrwGcVwC57VtywY7bHXQUtGooULQjiYgnyOPxHDt2W+gQW1axiMxOQ
+ew0MF0kXYQhg0+WA1dcWOsxCDpyLc4z+E7EmdV7MTuvsDR2TLhZ6DFmVbN4ca64W
+vftz//3Ptc/I1/VpfGsHWb0VpmphkbE9vWGHzzJVp/Lvtk7ybcpfxiiNWEi7unr7
+/TIEsqy93lCRfpLKIvO06ITH1GZz7+VPL/8q8lrH5kSwxqo5szq1mEa0pNN6hTpo
+cz00x5oBfL9K/TNLQNgdb5uOOfjQ9pYtZ49UDyMLs5lCsZ6ue+SIbWrJXDEPMIEg
+Lzx9nnvytL9wbiwo5GQdIaDAZXMwVVdKQGyqx+UhaHmrb1u0RVRcFzO/QPWzNCWv
+oxJGfg9dVTxfjaa1HzQ0irPs86zCQUnt0OyTuq0SmUgTCNXLSQaN8MigN++zwT4c
+IRDB0WMgmu8sxtnmA3Zq+2GYT97jmbdVMB34DVbXI4UigD3UieVe4rO95cEssoUT
+AFG0pthv64BRKIIRNch+eiBBjkGpnWKRybzsmqnEqpMf9v7KQU9hmpBJDbi6KA6w
+3fg3KSroJZwosbAwdBuylCfQgq1jZ6UfR/ss9kYGhaWbCB3ARmY9XHFc+OZuFW0p
+ohgfBfs9RDMDVkTa4tzBAGsCAwEAAQ==
+-----END PUBLIC KEY-----

jwt_keys/test.py

@@ -0,0 +1,17 @@
+import jwt
+import time
+import webbrowser
+
+private_key = open('./grafana.key', 'r').read()
+
+payload = {
+    "sub": "yolo2",
+    "iat": int(time.time())
+}
+
+token = jwt.encode(payload, private_key, algorithm='RS256')
+
+base_url = 'http://localhost:3000'
+url_with_token = f'{base_url}?auth_token={token}'
+print(url_with_token)
+# webbrowser.open_new_tab(url_with_token)

server/bindings/CloudApiErrors.ts

@@ -1,3 +1,3 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 
-export type CloudApiErrors = "TeamDoesNotExist" | "UserDoesNotExist" | "CloudFeatureDisabled" | "InsufficientPermissions" | "TeamHasNoRegisteredApps" | "DatabaseError" | "MaximumUsersPerTeamReached" | "UserAlreadyBelongsToTheTeam" | "IncorrectPassword" | "AccessTokenFailure" | "RefreshTokenFailure" | "AppAlreadyExists" | "MaximumAppsPerTeamReached" | "TeamAlreadyExists" | "PersonalTeamAlreadyExists" | "EmailAlreadyExists" | "InternalServerError" | "UserDoesNotBelongsToTheTeam";
+export type CloudApiErrors = "TeamDoesNotExist" | "UserDoesNotExist" | "CloudFeatureDisabled" | "InsufficientPermissions" | "TeamHasNoRegisteredApps" | "DatabaseError" | "MaximumUsersPerTeamReached" | "UserAlreadyBelongsToTheTeam" | "IncorrectPassword" | "AccessTokenFailure" | "RefreshTokenFailure" | "AppAlreadyExists" | "MaximumAppsPerTeamReached" | "TeamAlreadyExists" | "PersonalTeamAlreadyExists" | "EmailAlreadyExists" | "InternalServerError" | "UserDoesNotBelongsToTheTeam" | "InvalidName";

server/src/auth/auth_middleware.rs

@@ -1,5 +1,5 @@
 use super::{auth_token_type::AuthTokenType, AuthToken};
-use crate::env::JWT_SECRET;
+use crate::env::JWT_PUBLIC_KEY;
 use axum::{
     extract::{ConnectInfo, Request},
     http::{HeaderMap, StatusCode},
@@ -27,7 +27,7 @@ pub async fn access_auth_middleware(
         Some(auth_header) => {
             let token = auth_header.replace("Bearer ", "");
             // Decode and validate the token
-            let decoded = match AuthToken::decode(&token, JWT_SECRET(), ip) {
+            let decoded = match AuthToken::decode(&token, JWT_PUBLIC_KEY(), ip) {
                 Ok(decoded) => decoded,
                 Err(e) => return Err((StatusCode::UNAUTHORIZED, e.to_string())),
             };