jwt

type Issuer interface {
	// Generate creates a JWT token for the given request. The token includes
	// claims based on the identity information provided in the request.
	Generate(context.Context, *Request) (string, error)

	// JWKS returns the JSON Web Key Set (JWKS).
	JWKS() jwk.Set

	// JWTSignatureAlgorithm returns the signature algorithm used for signing JWTs.
	JWTSignatureAlgorithm() jwa.KeyAlgorithm
}

type IssuerOptions struct {
	// SignKey is the key used to sign the JWT
	SignKey jwk.Key
	// Issuer is the Issuer of the JWT (optional)
	Issuer *string
	// AllowedClockSkew is the time allowed for clock skew
	AllowedClockSkew time.Duration
	// JWKS is the JSON Web Key Set (JWKS) used to verify JWTs
	JWKS jwk.Set
}

type Request struct {
	// Trust domain is the trust domain of the JWT.
	TrustDomain spiffeid.TrustDomain

	// Audiences is the audience of the JWT.
	Audiences []string

	// Namespace is the namespace of the client.
	Namespace string

	// AppID is the app id of the client.
	AppID string

	// TTL is the time-to-live for the token in seconds
	TTL time.Duration
}