jwt

type Audience []string

type Claims struct {
	Issuer    string       `json:"iss,omitempty"`
	Subject   string       `json:"sub,omitempty"`
	Audience  Audience     `json:"aud,omitempty"`
	Expiry    *NumericDate `json:"exp,omitempty"`
	NotBefore *NumericDate `json:"nbf,omitempty"`
	IssuedAt  *NumericDate `json:"iat,omitempty"`
	ID        string       `json:"jti,omitempty"`

	// DPoP specific claims
	Cnf        *Cnf   `json:"cnf,omitempty"`
	Nonce      string `json:"nonce,omitempty"`
	HTTPMethod string `json:"htm,omitempty"`
	HTTPUri    string `json:"htu,omitempty"`

	// Custom most common claims
	Name          string `json:"name,omitempty"`
	Profile       string `json:"profile ,omitempty"`
	Email         string `json:"email,omitempty"`
	EmailVerified bool   `json:"email_verified ,omitempty"`
	Phone         string `json:"phone_number,omitempty"`
	PhoneVerified bool   `json:"phone_number_verified ,omitempty"`
	// Role in the service
	Role   string `json:"role,omitempty"`
	Tenant string `json:"tenant,omitempty"`
	Org    string `json:"org,omitempty"`
	// map of Org:Role
	Orgs    map[string]string `json:"orgs,omitempty"`
	OrgRole string            `json:"org_role,omitempty"`
}

type Cnf struct {
	Jkt string `json:"jkt,omitempty"`
}

type Key struct {
	// ID of the key
	ID   string `json:"id" yaml:"id"`
	Seed string `json:"seed" yaml:"seed"`
}

type KeySet interface {
	GetKey(ctx context.Context, kid string) (any, error)
}

type Keyfunc func(*Token) (any, error)

type MapClaims map[string]any

type NumericDate int64

type Option interface {
	// contains filtered or unexported methods
}

type Parser interface {
	// ParseToken returns jwt.StandardClaims
	ParseToken(ctx context.Context, authorization string, cfg *VerifyConfig) (MapClaims, error)
}

type ParserConfig struct {
	// Issuer specifies issuer claim
	Issuer   string              `json:"issuer" yaml:"issuer"`
	JWKSURI  string              `json:"jwks_uri" yaml:"jwks_uri"`
	JWKeySet *jose.JSONWebKeySet `json:"jwks" yaml:"jwks"`
}

type Provider interface {
	Signer
	Parser
}

type ProviderConfig struct {
	// Issuer specifies issuer claim
	Issuer string `json:"issuer" yaml:"issuer"`
	// KeyID specifies ID of the current key
	KeyID string `json:"kid" yaml:"kid"`
	// Keys specifies list of issuer's keys
	Keys []*Key `json:"keys" yaml:"keys"`

	PrivateKey string `json:"private_key" yaml:"private_key"`

	// TokenExpiry specifies token expiration period
	TokenExpiry csr.Duration `json:"token_expiry" yaml:"token_expiry"`
}

type RemoteKeySet struct {
	// contains filtered or unexported fields
}

type Signer interface {
	// SignClaims returns signed JWT token
	Sign(ctx context.Context, claims MapClaims) (string, error)
	// PublicKey is returned for assymetric signer
	PublicKey() crypto.PublicKey
	// Issuer returns name of the issuer
	Issuer() string
	// TokenExpiry specifies token expiration period
	TokenExpiry() time.Duration
}

type SignerInfo struct {
	// contains filtered or unexported fields
}

type StaticKeySet struct {
	// PublicKeys used to verify the JWT. Supported types are *rsa.PublicKey and
	// *ecdsa.PublicKey.
	PublicKeys []crypto.PublicKey
	KeySet     []jose.JSONWebKey
}

type Token struct {
	Raw           string         // The raw token.  Populated when you Parse a token
	SigningMethod string         // The signing method used or to be used
	Header        map[string]any // The first segment of the token
	Claims        ValidClaims    // The second segment of the token
	Signature     string         // The third segment of the token.  Populated when you Parse a token
	Valid         bool           // Is the token valid?  Populated when you Parse/Verify a token
}

type TokenParser struct {
	ValidMethods         []string // If populated, only these methods will be considered valid
	UseJSONNumber        bool     // Use JSON Number format in JSON decoder
	SkipClaimsValidation bool     // Skip claims validation during token parsing
}

type ValidClaims interface {
	Valid(cfg *VerifyConfig) error
}

type VerifyConfig struct {
	// ExpectedIssuer validates the iss claim of a JWT matches this value
	ExpectedIssuer string
	// ExpectedSubject validates the sub claim of a JWT matches this value
	ExpectedSubject string
	// ExpectedAudience validates that the aud claim of a JWT contains this value
	ExpectedAudience []string
}