jwt

type Claims struct {
	Issuer    string
	Subject   string
	Audience  []string
	ExpiresAt time.Time
	NotBefore time.Time
	IssuedAt  time.Time
	ID        string
	// Extra holds the other claims (decoded JSON values).
	Extra map[string]any
}

type Guard[U auth.Authenticatable] struct {
	// contains filtered or unexported fields
}

type JWK struct {
	Kty string `json:"kty"`
	Kid string `json:"kid,omitempty"`
	Alg string `json:"alg,omitempty"`
	Use string `json:"use,omitempty"`
	N   string `json:"n,omitempty"`
	E   string `json:"e,omitempty"`
	Crv string `json:"crv,omitempty"`
	X   string `json:"x,omitempty"`
	Y   string `json:"y,omitempty"`
}

type JWKS struct {
	Keys []JWK `json:"keys"`
}

type Key struct {
	// ID is the "kid" header.
	ID string
	// Alg is the only algorithm this key accepts.
	Alg string
	// Secret is the HS256 secret (at least 32 bytes).
	Secret []byte
	// Private signs (RSA, ECDSA P-256 or Ed25519); nil for verify-only keys.
	Private crypto.Signer
	// Public verifies.
	Public crypto.PublicKey
}

type KeySet interface {
	Key(ctx context.Context, kid string) (Key, error)
}

type RefreshTokens struct {

	// TTL is the lifetime of each token (default 30 days).
	TTL time.Duration
	// Now is the clock (default time.Now).
	Now func() time.Time
	// contains filtered or unexported fields
}

type RemoteJWKS struct {
	URL string
	// Client fetches the set (default: 10s timeout).
	Client *http.Client
	// MaxAge refreshes the cache after this long (default 1h).
	MaxAge time.Duration
	// MinRefresh limits refetches for unknown key ids (default 1m), so
	// tokens with random kids cannot hammer the provider.
	MinRefresh time.Duration
	// Now is the clock (default time.Now).
	Now func() time.Time
	// contains filtered or unexported fields
}

type SharedKeySet interface {
	KeySet
	SharedKeys() bool
}

type Verifier struct {
	// contains filtered or unexported fields
}

type VerifyOptions struct {
	// Algorithms allowed (default: all supported); each key still only
	// accepts its own algorithm.
	Algorithms []string
	// Issuer, when set, must equal "iss". Required with a *RemoteJWKS.
	Issuer string
	// Audience, when set, must be in "aud". Required with a *RemoteJWKS:
	// an identity provider signs tokens for all of its clients with the
	// same keys, so without it a token issued to another app is accepted.
	Audience string
	// InsecureSkipAudience accepts any "aud" with a *RemoteJWKS.
	// Dangerous: tokens the provider issued to other apps pass.
	InsecureSkipAudience bool
	// InsecureSkipIssuer accepts any "iss" with a *RemoteJWKS.
	// Dangerous: tokens from other tenants of a multi-tenant provider pass.
	InsecureSkipIssuer bool
	// Leeway tolerates clock skew (default 30s).
	Leeway time.Duration
	// AllowMissingExpiry accepts tokens without "exp" (off by default).
	AllowMissingExpiry bool
	// Now is the clock (default time.Now).
	Now func() time.Time
}