auth

var (
	ErrMissingJWKS    = errors.New("Failed to find matching key for token")
	ErrRequestGrant   = errors.New("Request does not match grant")
	ErrUserIdDataType = errors.New("User ID claim is not a string")
	ErrUserForbidden  = errors.New("Not authorized to perform this action")
)

var ErrFunc = func() middleware.ErrFunc {
	return func(w http.ResponseWriter, err error) {
		server.JsonResponse(w, models.NewFailure(
			models.ErrUnauthorizedCode,
			err.Error(),
		), http.StatusUnauthorized)
	}
}

var KeyFunc = func(authAddr string) middleware.KeyFunc {
	return func(token *middleware.Token) ([]byte, error) {
		cert, err := getJwksCert(authAddr, token)
		if err != nil {
			return nil, err
		}
		if cert == "" {
			return nil, ErrMissingJWKS
		}
		key, err := certPemToRsaPublicKey([]byte(cert))
		if err != nil {
			return nil, err
		}
		return pem.EncodeToMemory(
			&pem.Block{
				Type:  "RSA PUBLIC KEY",
				Bytes: x509.MarshalPKCS1PublicKey(key),
			},
		), nil
	}
}

var SetAuthGrants = func(grantStrs []string) error {
	err := grants.SetCustomGrants(grantStrs)
	if err != nil {
		return err
	}
	s := strings.Join(grantStrs, grants.GrantDelimiter)
	authGrants, err = grants.ToGrant(s)
	authGrants = authGrants.Clean()
	return err
}