jose_verify.h

#ifndef SOURCEMETA_CORE_JOSE_VERIFY_H_
#define SOURCEMETA_CORE_JOSE_VERIFY_H_
 
#ifndef SOURCEMETA_CORE_JOSE_EXPORT
#include <sourcemeta/core/jose_export.h>
#endif
 
// NOLINTBEGIN(misc-include-cleaner)
#include <sourcemeta/core/jose_algorithm.h>
#include <sourcemeta/core/jose_jwk.h>
#include <sourcemeta/core/jose_jwks.h>
#include <sourcemeta/core/jose_jwt.h>
// NOLINTEND(misc-include-cleaner)
 
#include <chrono>      // std::chrono::seconds, std::chrono::system_clock
#include <cstdint>     // std::uint8_t
#include <optional>    // std::optional
#include <span>        // std::span
#include <string_view> // std::string_view
 
namespace sourcemeta::core {

enum class JWTClaimError : std::uint8_t {
  Issuer,
  Subject,
  Audience,
  Expiration,
  NotBefore,
  IssuedAt,
  Lifetime
};

struct JWTClockSkew {
  JWTClockSkew() noexcept = default;
 
  // The conversion is deliberately implicit so that a caller holding a single
  // uniform tolerance can keep passing plain seconds
  JWTClockSkew(const std::chrono::seconds uniform) noexcept
      : expiration{uniform}, not_before{uniform}, issued_at{uniform} {}

  JWTClockSkew(const std::chrono::seconds expiration_tolerance,
               const std::chrono::seconds not_before_tolerance,
               const std::chrono::seconds issued_at_tolerance) noexcept
      : expiration{expiration_tolerance}, not_before{not_before_tolerance},
        issued_at{issued_at_tolerance} {}

  std::chrono::seconds expiration{0};
  std::chrono::seconds not_before{0};
  std::chrono::seconds issued_at{0};
};

inline auto jwt_bounded_clock_skew(const std::chrono::seconds skew) noexcept
    -> std::chrono::seconds {
  // A mean Gregorian year, the widest grace period any deployment plausibly
  // needs, so an extreme value cannot widen the acceptance window without bound
  constexpr std::chrono::seconds MAXIMUM{31556952};
  return skew < std::chrono::seconds::zero() ? std::chrono::seconds::zero()
         : skew > MAXIMUM                    ? MAXIMUM
                                             : skew;
}

SOURCEMETA_CORE_JOSE_EXPORT
auto jwt_check_claims(
    const JWT &token, const std::string_view expected_issuer,
    const std::string_view expected_audience,
    const std::chrono::system_clock::time_point now,
    const JWTClockSkew clock_skew = {},
    const std::optional<std::string_view> expected_subject = std::nullopt,
    const std::optional<std::chrono::seconds> maximum_lifetime = std::nullopt)
    -> std::optional<JWTClaimError>;

SOURCEMETA_CORE_JOSE_EXPORT
auto jws_verify_signature(const std::optional<JWSAlgorithm> algorithm,
                          const std::string_view signing_input,
                          const std::string_view signature, const JWK &key)
    -> bool;

SOURCEMETA_CORE_JOSE_EXPORT
auto jwt_verify_signature(const JWT &token, const JWK &key) -> bool;

enum class JWTVerificationError : std::uint8_t {
  AlgorithmNotAllowed,
  UnknownKey,
  Signature,
  Type,
  Issuer,
  Subject,
  Audience,
  Expiration,
  NotBefore,
  IssuedAt,
  Lifetime
};

SOURCEMETA_CORE_JOSE_EXPORT
auto jwt_verify(const JWT &token, const JWKS &keys,
                const std::span<const JWSAlgorithm> allowed_algorithms,
                const std::string_view expected_issuer,
                const std::string_view expected_audience,
                const std::chrono::system_clock::time_point now,
                const JWTClockSkew clock_skew,
                const std::optional<std::string_view> expected_subject,
                const std::optional<std::string_view> expected_type,
                const std::optional<std::chrono::seconds> maximum_lifetime =
                    std::nullopt) -> std::optional<JWTVerificationError>;
 
} // namespace sourcemeta::core
 
#endif