dpop

type MemoryReplayCache struct {
	// contains filtered or unexported fields
}

type ReplayCache interface {
	// Add atomically records key through expiresAt (inclusive: the verifier
	// still accepts a proof at that instant). It returns an error
	// wrapping ErrReplay when key is already recorded and not expired, and
	// any other error when the key cannot be recorded; VerifyClaims rejects
	// the proof in both cases. Of concurrent Add calls for the same key,
	// exactly one may succeed.
	Add(ctx context.Context, key string, expiresAt time.Time) error
}

type Result struct {
	Claims *jwtgo.Claims
	Key    *jose.JSONWebKey
	// Thumbprint is the RFC 7638 SHA-256 thumbprint of Key, to compare
	// with the access token cnf.jkt claim
	Thumbprint string
	// AccessTokenHash is the proof ath claim, if present
	AccessTokenHash string
}

type Signer interface {
	// Sign returns DPoP token
	Sign(ctx context.Context, method string, u *url.URL, extraClaims any) (string, error)
	// JWKThumbprint returns base64 hash of the key
	JWKThumbprint() string
}

type TokenInfo struct {
	Token       *jwt.JSONWebToken
	Claims      jwtgo.Claims
	Key         *jose.JSONWebKey
	Thumbprint  string
	CnfJkt      string
	IsPublicKey bool
	IsFresh     bool
}

type VerifyConfig struct {
	// ExpectedIssuer validates the iss claim of a JWT matches this value
	ExpectedIssuer string
	// ExpectedSubject validates the sub claim of a JWT matches this value
	ExpectedSubject string
	// ExpectedAudience validates that the aud claim of a JWT contains this value
	ExpectedAudience string
	// ExpectedNonce validates that the nonce claim of a JWT contains this value
	ExpectedNonce string
	// EnableQuery specifies to get `dpop` header from the QueryString
	EnableQuery bool

	// ExternalURL is the trusted external origin of this server, as
	// scheme://host[:port]. When set, VerifyRequestClaims takes the htu
	// scheme and host from it instead of the request URL and Host header,
	// which are client-controlled. Set it for plain-HTTP servers and for
	// servers reached under a different name than the Host they receive.
	ExternalURL string
	// ReplayCache, when set, records each accepted proof and rejects a
	// second use of the same jti with the same key (ErrReplay) until the
	// proof leaves its acceptance window. When nil, VerifyClaims does not
	// detect replayed proofs.
	ReplayCache ReplayCache
	// AccessToken, when set, is the access token presented with the proof
	// to a protected resource. The proof must then carry an ath claim equal
	// to AccessTokenHash(AccessToken), and ExpectedThumbprint must be set
	// too: ath alone does not bind the proof key to the token. Leave it
	// empty at the token endpoint. Set it per request, on a copy of a shared
	// VerifyConfig.
	AccessToken string
	// ExpectedThumbprint, when set, is the cnf.jkt value of the access token
	// presented with the proof; the proof key thumbprint must equal it. Set
	// it per request, with AccessToken.
	ExpectedThumbprint string
}