jwt

type Algorithm string

type Claims struct {
	Issuer         string             `mapstructure:"iss,omitempty" json:"iss,omitempty"` // Required
	Subject        string             `mapstructure:"sub,omitempty" json:"sub,omitempty"` // Required
	Audience       string             `mapstructure:"aud,omitempty" json:"aud,omitempty"` // Required
	ExpirationTime int64              `mapstructure:"exp,omitempty" json:"exp,omitempty"` // Required for non-DPoP tokens
	NotBefore      int64              `mapstructure:"nbf,omitempty" json:"nbf,omitempty"`
	IssuedAt       int64              `mapstructure:"iat,omitempty" json:"iat,omitempty"` // Required
	JwtID          string             `mapstructure:"jti,omitempty" json:"jti,omitempty"` // Required for DPoP tokens
	Nonce          string             `mapstructure:"nonce,omitempty" json:"nonce,omitempty"`
	Confirmation   *ConfirmationClaim `mapstructure:"cnf,omitempty" json:"cnf,omitempty"`
	Scope          string             `mapstructure:"scope,omitempty" json:"scope,omitempty"` // Required for non-DPoP tokens

	// DPoP claims
	HTTPMethod string `mapstructure:"htm,omitempty" json:"htm,omitempty"` // The HTTP method for the request to which the JWT is attached
	HTTPURI    string `mapstructure:"htu,omitempty" json:"htu,omitempty"` // The HTTP URI used for the request, without query and fragment parts

	CustomClaims CustomClaims `mapstructure:",remain" json:"-"`
}

type ConfirmationClaim struct {
	JWK              *Key   `mapstructure:"jwk,omitempty" json:"jwk,omitempty"`
	SHA256Thumbprint string `mapstructure:"jkt,omitempty" json:"jkt,omitempty"`
}

type CustomClaims map[string]interface{}

type EllipticCurve string

type Header struct {
	Type        Type   `json:"typ,omitempty"` // JWT or dpop+jwt
	ContentType string `json:"cty,omitempty"`

	// JWS Headers (will be different for JWE)
	Algorithm                      Algorithm `json:"alg,omitempty"` // Required
	JWKSetURL                      string    `json:"jwu,omitempty"`
	JWK                            *Key      `json:"jwk,omitempty"` // Required for DPoP tokens
	KeyID                          string    `json:"kid,omitempty"`
	X509URL                        string    `json:"x5u,omitempty"`
	X509CertificateChain           []string  `json:"x5c,omitempty"`
	X509CertificateSHA1Thumbprint  string    `json:"x5t,omitempty"`
	X509CertificateSHA256Thumprint string    `json:"x5t#S256,omitempty"`
}

type Key struct {
	SymmetricKey []byte            `json:"-"` // required for HMAC, the symmetric key bytes
	PublicKey    crypto.PublicKey  `json:"-"` // required for RSA/EC, the public key
	PrivateKey   crypto.PrivateKey `json:"-"` // optional for RSA/EC, the private key

	KeyType               KeyType        `json:"kty,omitempty"`      // required, the cryptographic algorithm family used with the key
	PublicKeyUse          PublicKeyUse   `json:"use,omitempty"`      // optional, the intended use of the public key
	KeyOperations         []KeyOperation `json:"key_ops,omitempty"`  // optional, list of operations this key is intended to perform
	Algorithm             Algorithm      `json:"alg,omitempty"`      // optional, algorithm intended for use with this key
	KeyID                 string         `json:"kid,omitempty"`      // optional, used to match "kid" value in JWT header
	X509Url               string         `json:"x5u,omitempty"`      // optional, URL of X.509 certificate
	X509CertificateChain  []string       `json:"x5c,omitempty"`      // optional, base64-encoded PKIX certificates (1+)
	X509CertificateSHA1   string         `json:"x5t,omitempty"`      // optional, base64url-encoded SHA-1 fingerprint of X.509
	X509CertificateSHA256 string         `json:"x5t#S256,omitempty"` // optional, base64url-encoded SHA-256 fingerprint of X.509

	Curve EllipticCurve `json:"crv,omitempty"` // required, the elliptic curve for the public key
	X     *bigInt       `json:"x,omitempty"`   // required, the base64url-encoded x-coordinate
	Y     *bigInt       `json:"y,omitempty"`   // required, the base64url-encoded y-coordinate

	N *bigInt `json:"n,omitempty"` // required, the base64urlUint-encoded modulus
	E *bigInt `json:"e,omitempty"` // required, the base64urlUint-encoded exponent

	K string `json:"k,omitempty"` // required, the base64url-encoded key value

	D           *bigInt      `json:"d,omitempty"`   // required for EC/RSA, the base64url-encoded ECC private key or base64urlUint private exponent for RSA
	P           *bigInt      `json:"p,omitempty"`   // required for RSA, the base64urlUint-encoded first prime factor
	Q           *bigInt      `json:"q,omitempty"`   // required for RSA, the base64urlUint-encoded second prime factor
	DP          *bigInt      `json:"dp,omitempty"`  // required for RSA, the base64urlUint-encoded first factor CRT exponent
	DQ          *bigInt      `json:"dq,omitempty"`  // required for RSA, the base64urlUint-encoded second factor CRT exponent
	QI          *bigInt      `json:"qi,omitempty"`  // required for RSA, the base64urlUint-encoded first CRT certificate
	OtherPrimes []OtherPrime `json:"oth,omitempty"` // optional for RSA, the base64urlUint-encoded other primes info
}

type KeyOperation string

type KeySet struct {
	Keys []*Key `json:"keys"`
}

type KeyType string

type OtherPrime struct {
	R *bigInt `json:"r"` // required, the base64urlUint-encoded prime factor
	D *bigInt `json:"d"` // required, the base64urlUint-encoded factor CRT exponent
	T *bigInt `json:"t"` // required, the base64urlUint-encoded factor CRT coefficient
}

type PublicKeyUse string

type Signer func(b []byte) ([]byte, error)

type Token struct {
	Header    *Header // The header values
	Claims    *Claims // The claims (registered and custom)
	Signature []byte  // The signature of the token
	// contains filtered or unexported fields
}

type Type string

type Verifier func(msg, sig []byte) error