joseUtils

type AudienceSingle string

type AudienceSlice []string

type DataJWT struct {
	Header    Headers                // The protected Header claims
	Payload   map[string]interface{} // JSON Payload claims
	Signature *[]byte                // Signature if already signed
}

type DecryptedOpenidJWE struct {
	ProtectedHeaders   map[string]interface{}
	UnprotectedHeaders map[string]interface{}
	Recipients         []*RecipientJWE
	NestedJWT          DataJWT
}

type HeaderRequestJWE struct {
	// Algorithm ("alg", required) is the cryptographic algorithm used to encrypt (encapsulate) the value of the CEK (Crystals-Kyber).
	Algorithm string `json:"alg,omitempty" bson:"alg,omitempty"`

	// ContentType ("cty", required in UHC) is used to declare the media type of secured content (the "plaintext" encrypted data).
	ContentType string `json:"cty,omitempty" bson:"cty,omitempty"`

	// Encryption ("enc", required) identifies the cryptographic algorithm used to encrypt the data using the CEK (e.g.: *"A256GCM"* for AES data encryption).
	Encryption string `json:"enc,omitempty" bson:"enc,omitempty"` // string

	// JSONWebKey ("jwk", conditional) is the public key to which the JWE was encrypted.
	JSONWebKey *jwkUtils.JWK `json:"jwk,omitempty" bson:"jwk,omitempty"` // JSON

	// JWKSetURL ("jku", conditional) is a URI that refers to a resource for a set of JSON-encoded public keys or the recipient, one of which
	// corresponds to the  public key to which the JWE was encrypted (determined by the recipient's encryption KeyID).
	JWKSetURL *string `json:"jku,omitempty" bson:"jku,omitempty"` // string

	// KeyID ("kid", conditional) indicates the recipient's public key to which the JWE was encrypted.
	KeyID *string `json:"kid,omitempty" bson:"kid,omitempty"`

	// SenderKeyID ("skid", required in UHC) is a hint which references the sender's public encryption key for authenticated encryption.
	SenderKeyID string `json:"skid,omitempty" bson:"skid,omitempty"` // string

	// Type ("typ", required) is used to declare the media type of the complete JWS. It is "jwt" as per the OpenID specification.
	Type string `json:"typ,omitempty" bson:"typ,omitempty"`
}

type HeaderRequestJWS struct {
	// Algorithm ("alg") is the cryptographic algorithm used to secure the JWS. MUST NOT be "none".
	Algorithm string `json:"alg,omitempty" bson:"alg,omitempty"`

	// ContentType ("cty") is used to declare the media type of secured content (the payload). It is set to
	ContentType string `json:"cty,omitempty" bson:"cty,omitempty"`

	// JSONWebKeySet ("jwks", optional) contains an array of public keys that corresponds in UHC to the sender's public signature JWK (first) and public encryption JWK (second, it can be already in the JWE "jwk" header).
	JSONWebKeySet *jwkUtils.JWKeySet `json:"jwks,omitempty" bson:"jwks,omitempty"` // JSON

	// KeyID ("kid") indicates which key was used to secure the JWS. It can be already defined in the payload's "client_id" (DID#KID URI).
	KeyID string `json:"kid,omitempty" bson:"kid,omitempty"`

	// To ("to") is the DID Service Endpoint.
	// It should be the same as the payload's "aud" field in case of the Authorization flow
	// or the "htu" field when using a DPoP token bound to an access token.
	To string `json:"to,omitempty" bson:"to,omitempty"`

	// Type ("typ") is used to declare the media type of the complete JWS. It is "jwt" as per the OpenID specification.
	Type string `json:"typ,omitempty" bson:"typ,omitempty"`

	// specifies if the payload bytes are compressed or not
	ZipCompression *string `json:"zip,omitempty" bson:"zip,omitempty"` // CompressionAlgorithm
}

type Headers map[string]interface{}

type JWEncryptionGo struct {
	ProtectedHeaders   map[string]interface{}
	OrigProtectedHders string                 `json:"protected,omitempty"` // the original protected headers Base64Url encoded
	UnprotectedHeaders map[string]interface{} `json:"unprotected,omitempty"`
	Recipients         []*RecipientJWE        `json:"recipients,omitempty"`
	AAD                string                 `json:"aad,omitempty"`
	IV                 string                 `json:"iv,omitempty"`
	Ciphertext         string                 `json:"ciphertext,omitempty"`
	Tag                string                 `json:"tag,omitempty"`
}

type JWEncryptionRawJSON struct {
	B64ProtectedHeaders      string          `json:"protected,omitempty"`
	UnprotectedHeaders       json.RawMessage `json:"unprotected,omitempty"`
	Recipients               json.RawMessage `json:"recipients,omitempty"`
	B64SingleRecipientEncKey string          `json:"encrypted_key,omitempty"`
	SingleRecipientHeader    json.RawMessage `json:"header,omitempty"`
	B64AAD                   string          `json:"aad,omitempty"`
	B64IV                    string          `json:"iv,omitempty"`
	B64Ciphertext            string          `json:"ciphertext,omitempty"`
	B64Tag                   string          `json:"tag,omitempty"`
}

type JsonMarshalFunc func(interface{}) ([]byte, error)

type NumericDate int64

type PartsJWT struct {
	Header    string  // Is the protected header (because signed claims)
	Payload   string  // payload claims to be signed also
	Signature *string // it does not exist when preparing the data for signature
}

type PayloadClaims struct {
	Issuer    string        `json:"iss,omitempty"`
	Subject   string        `json:"sub,omitempty"`
	Audience  AudienceSlice `json:"aud,omitempty"`
	Expiry    *NumericDate  `json:"exp,omitempty"`
	NotBefore *NumericDate  `json:"nbf,omitempty"`
	IssuedAt  *NumericDate  `json:"iat,omitempty"`
	ID        string        `json:"jti,omitempty"`
}

type RecipientHeaders struct {
	Alg string          `json:"alg,omitempty"`
	APU string          `json:"apu,omitempty"`
	APV string          `json:"apv,omitempty"`
	IV  string          `json:"iv,omitempty"`
	Tag string          `json:"tag,omitempty"`
	KID string          `json:"kid,omitempty"`
	EPK json.RawMessage `json:"epk,omitempty"`
}

type RecipientJWE struct {
	Header       *RecipientHeaders `json:"header,omitempty"`
	EncryptedKey string            `json:"encrypted_key,omitempty"`
}