Documentation
¶
Overview ¶
Package jwt signs and verifies moth access tokens: compact JWS with ES256, a kid header, and the fixed claim set moth mints. It is deliberately not a general JOSE library — third-party libraries verify these tokens against the project JWKS; this package only has to produce and check moth's own.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ( ErrMalformed = errors.New("malformed token") ErrInvalidSignature = errors.New("invalid signature") ErrExpired = errors.New("token expired") )
Verification errors.
Functions ¶
Types ¶
type Claims ¶
type Claims struct {
Issuer string `json:"iss,omitempty"`
Subject string `json:"sub,omitempty"`
Audience string `json:"aud,omitempty"`
IssuedAt int64 `json:"iat,omitempty"`
ExpiresAt int64 `json:"exp,omitempty"`
Email string `json:"email,omitempty"`
EmailVerified bool `json:"email_verified"`
// Custom is the user's custom_claims object (roles, permissions, ...),
// embedded verbatim under the "claims" claim.
Custom map[string]any `json:"claims,omitempty"`
}
Claims is the moth access-token claim set.
func ParseUnverified ¶
ParseUnverified decodes the claims WITHOUT checking the signature or expiry. Introspection uses it to identify which project a token claims to belong to before verification; never trust its output for authentication.
func Verify ¶
func Verify(token string, lookup func(kid string) (*ecdsa.PublicKey, error), now time.Time) (Claims, error)
Verify checks the signature and expiry of a compact ES256 JWS and returns its claims. lookup resolves the header kid to a public key; issuer/audience checks are the caller's job.
Source Files