jwt

type AlgorithmKeySet interface {
	KeySet
	// GetKeyForAlgorithm returns the only key eligible to verify a token with
	// the given kid and alg headers. An empty keyID matches every key.
	GetKeyForAlgorithm(ctx context.Context, keyID, alg string) (any, error)
}

type Audience []string

type Claims struct {
	Issuer    string       `json:"iss,omitempty"`
	Subject   string       `json:"sub,omitempty"`
	Audience  Audience     `json:"aud,omitempty"`
	Expiry    *NumericDate `json:"exp,omitempty"`
	NotBefore *NumericDate `json:"nbf,omitempty"`
	IssuedAt  *NumericDate `json:"iat,omitempty"`
	ID        string       `json:"jti,omitempty"`

	// DPoP specific claims
	Cnf        *Cnf   `json:"cnf,omitempty"`
	Nonce      string `json:"nonce,omitempty"`
	HTTPMethod string `json:"htm,omitempty"`
	HTTPUri    string `json:"htu,omitempty"`

	// Custom most common claims
	Name          string `json:"name,omitempty"`
	Profile       string `json:"profile,omitempty"`
	Email         string `json:"email,omitempty"`
	EmailVerified bool   `json:"email_verified,omitempty"`
	Phone         string `json:"phone_number,omitempty"`
	PhoneVerified bool   `json:"phone_number_verified,omitempty"`
	// Role in the service
	Role   string `json:"role,omitempty"`
	Tenant string `json:"tenant,omitempty"`
	Org    string `json:"org,omitempty"`
	// map of Org:Role
	Orgs    map[string]string `json:"orgs,omitempty"`
	OrgRole string            `json:"org_role,omitempty"`
	Scope   Audience          `json:"scope,omitempty"`
}

type Cnf struct {
	Jkt string `json:"jkt,omitempty"`
}

type Key struct {
	// ID of the key
	ID   string `json:"id" yaml:"id"`
	Seed string `json:"seed" yaml:"seed"`
}

type KeySet interface {
	// GetKey returns the key to verify a token with the given kid header.
	// An empty keyID selects the only signing-eligible key, if there is
	// exactly one.
	GetKey(ctx context.Context, keyID string) (any, error)
}

type Keyfunc func(*Token) (any, error)

type MapClaims map[string]any

type NumericDate int64

type Option interface {
	// contains filtered or unexported methods
}

type Parser interface {
	// ParseToken verifies the token signature and standard claims and returns MapClaims
	ParseToken(ctx context.Context, token string, cfg *VerifyConfig) (MapClaims, error)

	// GetRevocation returns the revocation checker, or nil if none is set
	GetRevocation() Revocation
	// SetRevocation installs a revocation checker consulted by ParseToken
	SetRevocation(Revocation)
}

type ParserConfig struct {
	// Issuer specifies issuer claim
	Issuer   string              `json:"issuer" yaml:"issuer"`
	JWKSURI  string              `json:"jwks_uri" yaml:"jwks_uri"`
	JWKeySet *jose.JSONWebKeySet `json:"jwks" yaml:"jwks"`
}

type Provider interface {
	Signer
	Parser
}

type ProviderConfig struct {
	// Issuer specifies issuer claim
	Issuer string `json:"issuer" yaml:"issuer"`
	// KeyID specifies ID of the current key
	KeyID string `json:"kid" yaml:"kid"`
	// Keys specifies list of issuer's keys
	Keys []*Key `json:"keys" yaml:"keys"`

	// PrivateKey is a PEM-encoded key or a pkcs11: URI resolved through cryptoprov;
	// when set, the provider signs with RS*/ES* instead of HS256 keys
	PrivateKey string `json:"private_key" yaml:"private_key"`

	// TokenExpiry specifies token expiration period
	TokenExpiry csr.Duration `json:"token_expiry" yaml:"token_expiry"`
}

type RemoteKeySet struct {
	// contains filtered or unexported fields
}

type RemoteKeySetOption func(*RemoteKeySet)

type Revocation interface {
	// Validate validates token claims,
	// it can be used to validate token revocation, etc.
	Validate(ctx context.Context, token string, claims MapClaims) error
	// Revoke revokes token
	Revoke(ctx context.Context, token string, claims MapClaims) error
}

type Signer interface {
	// Sign returns a signed, compact-serialized JWT for the claims. The exp,
	// iat and nbf claims are written as NumericDate whatever their Go type,
	// time.Time included, see MapClaims.NormalizeTimeClaims; one that
	// MapClaims.Time cannot parse is an error. The claims map is not
	// modified.
	Sign(ctx context.Context, claims MapClaims) (string, error)
	// PublicKey is returned for asymmetric signer
	PublicKey() crypto.PublicKey
	// Issuer returns name of the issuer
	Issuer() string
	// TokenExpiry specifies token expiration period
	TokenExpiry() time.Duration
}

type SignerInfo struct {
	// contains filtered or unexported fields
}

type StaticKeySet struct {
	// PublicKeys used to verify the JWT. They have no kid, see StaticKeySet.
	// Supported types are *rsa.PublicKey and *ecdsa.PublicKey; any other
	// entry makes GetKey fail.
	PublicKeys []crypto.PublicKey
	KeySet     []jose.JSONWebKey
}

type Token struct {
	Raw           string         // The raw token.  Populated when you Parse a token
	SigningMethod string         // The signing method used or to be used
	Header        map[string]any // The first segment of the token
	Claims        ValidClaims    // The second segment of the token
	Signature     string         // The third segment of the token.  Populated when you Parse a token
	Valid         bool           // Is the token valid?  Populated when you Parse/Verify a token
}

type TokenParser struct {
	ValidMethods         []string // If populated, only these methods will be considered valid
	UseJSONNumber        bool     // Use JSON Number format in JSON decoder
	SkipClaimsValidation bool     // Skip claims validation during token parsing
}

type ValidClaims interface {
	Valid(cfg *VerifyConfig) error
}

type VerifyConfig struct {
	// ExpectedIssuer validates the iss claim of a JWT matches this value
	ExpectedIssuer string
	// ExpectedSubject validates the sub claim of a JWT matches this value
	ExpectedSubject string
	// ExpectedAudience validates that the aud claim of a JWT contains this value
	ExpectedAudience []string
}