jose_jwks_provider.h

#ifndef SOURCEMETA_CORE_JOSE_JWKS_PROVIDER_H_
#define SOURCEMETA_CORE_JOSE_JWKS_PROVIDER_H_
 
#ifndef SOURCEMETA_CORE_JOSE_EXPORT
#include <sourcemeta/core/jose_export.h>
#endif
 
#include <sourcemeta/core/jose_algorithm.h>
#include <sourcemeta/core/jose_jwks.h>
#include <sourcemeta/core/jose_jwt.h>
#include <sourcemeta/core/jose_verify.h>
 
#include <chrono>      // std::chrono
#include <functional>  // std::function
#include <memory>      // std::shared_ptr
#include <mutex>       // std::mutex
#include <optional>    // std::optional, std::nullopt
#include <span>        // std::span
#include <string>      // std::string
#include <string_view> // std::string_view
 
namespace sourcemeta::core {

class SOURCEMETA_CORE_JOSE_EXPORT JWKSProvider {
public:
  struct FetchResult {
    std::string body;
    std::optional<std::chrono::seconds> max_age;
  };

  using Fetcher =
      std::function<std::optional<FetchResult>(std::string_view url)>;

  using Clock = std::function<std::chrono::system_clock::time_point()>;

  struct Options {
    std::chrono::seconds fallback_ttl{std::chrono::hours{1}};
    std::chrono::seconds minimum_ttl{std::chrono::minutes{5}};
    std::chrono::seconds maximum_ttl{std::chrono::hours{24}};
    std::chrono::seconds unknown_kid_cooldown{std::chrono::minutes{5}};
    JWTClockSkew clock_skew{};
  };

  JWKSProvider(std::string jwks_uri, Fetcher fetcher);
  JWKSProvider(std::string jwks_uri, Fetcher fetcher, Options options);
  JWKSProvider(std::string jwks_uri, Fetcher fetcher, Options options,
               Clock clock);

  JWKSProvider(const JWKSProvider &) = delete;
  auto operator=(const JWKSProvider &) -> JWKSProvider & = delete;
  JWKSProvider(JWKSProvider &&) = delete;
  auto operator=(JWKSProvider &&) -> JWKSProvider & = delete;

  [[nodiscard]] auto
  verify(const JWT &token,
         const std::span<const JWSAlgorithm> allowed_algorithms,
         const std::string_view expected_issuer,
         const std::string_view expected_audience,
         const std::optional<std::string_view> expected_subject,
         const std::optional<std::string_view> expected_type)
      -> std::optional<JWTVerificationError>;

  [[nodiscard]] auto verify_access_token(
      const JWT &token, const std::span<const JWSAlgorithm> allowed_algorithms,
      const std::string_view expected_issuer,
      const std::string_view expected_audience,
      const std::optional<std::string_view> expected_subject = std::nullopt)
      -> std::optional<JWTVerificationError>;

  [[nodiscard]] auto
  verify(const JWT &token,
         const std::span<const JWSAlgorithm> allowed_algorithms,
         const std::string_view expected_issuer,
         const std::string_view expected_audience,
         const std::optional<std::string_view> expected_subject,
         const std::optional<std::string_view> expected_type,
         std::chrono::system_clock::time_point &resolved_now)
      -> std::optional<JWTVerificationError>;
 
private:
  auto verify_at(const JWT &token,
                 const std::span<const JWSAlgorithm> allowed_algorithms,
                 const std::string_view expected_issuer,
                 const std::string_view expected_audience,
                 const std::optional<std::string_view> expected_subject,
                 const std::optional<std::string_view> expected_type,
                 const std::chrono::system_clock::time_point now)
      -> std::optional<JWTVerificationError>;
  auto fetch_and_install_locked(std::chrono::system_clock::time_point now)
      -> bool;
  auto refresh_locked(std::chrono::system_clock::time_point now)
      -> std::shared_ptr<const JWKS>;
  auto refetch_for_unknown_kid_locked(std::chrono::system_clock::time_point now)
      -> std::shared_ptr<const JWKS>;
 
#if defined(_MSC_VER)
#pragma warning(disable : 4251)
#endif
  const std::string jwks_uri_;
  const Fetcher fetcher_;
  const Options options_;
  const Clock clock_;
  std::mutex mutex_;
  std::shared_ptr<const JWKS> keys_;
  std::chrono::system_clock::time_point next_refresh_{};
  std::chrono::system_clock::time_point unknown_kid_cooldown_until_{};
#if defined(_MSC_VER)
#pragma warning(default : 4251)
#endif
};
 
} // namespace sourcemeta::core
 
#endif