Documentation
¶
Overview ¶
Package jwt implements CEL extension functions for JSON Web Token (JWT) parsing, claims inspection, and validation.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Option ¶
type Option func(*jwtLib) *jwtLib
Option declares a functional operator for configuring JWT extension library behavior.
func ClockLeeway ¶
ClockLeeway sets the tolerance window when checking token time claims (iat, nbf, exp).
func ValidateTimes ¶
ValidateTimes enables automatic time validation (iat, nbf, exp) during token parsing with an optional clock leeway.
type Token ¶
type Token struct {
// Standard claims
Issuer string `json:"iss" cel:"issuer"`
Subject string `json:"sub" cel:"subject"`
Audience []string `json:"aud" cel:"aud"`
AuthorizedParty string `json:"azp,omitempty" cel:"azp"`
ExpiresAt time.Time `json:"exp" cel:"exp"`
NotBefore time.Time `json:"nbf" cel:"nbf"`
IssuedAt time.Time `json:"iat" cel:"iat"`
ID string `json:"jti,omitempty" cel:"id"`
// Header derived fields
Algorithm string `json:"alg" cel:"alg"`
KeyID string `json:"kid" cel:"keyId"`
// Raw JSON payload associated with the token including custom claims.
// Must be treated as read-only once initialized.
Payload map[string]any `json:"-" cel:"-"`
}
Token represents a parsed JWT token using Go native struct types. A Token instance and its associated Payload map MUST be treated as immutable once parsed or created.
func NewToken ¶
NewToken generates a `jwt.Token` instance from the JSON-decoded header and payload of a JWT.
Signature validation of the token must be performed before passing the token to CEL. It is recommended that `IsValidAt` and `PresentedBy` are checked after creation of the token to ensure the token matches core content assumptions.
func ParseToken ¶
ParseToken parses a JWT token string into a structured Token. Verification of the token must be performed before passing the token to CEL.
func (*Token) Claim ¶
Claim queries a claim value by key name using the provided types.Adapter, returning an optional dyn value.
func (*Token) IsValidAt ¶
IsValidAt checks whether the token time claims (iat, nbf, exp) are valid at the given reference time with clock leeway tolerance.
func (*Token) PresentedBy ¶
PresentedBy determines whether the token from the given issuer was presented by the expected authorized party (`azp`) or audience (`aud`). If the token contains an `azp` claim, it is checked against the `presenter`. Otherwise, the `aud` claim is checked.
Source Files