oauth_assertion.h

#ifndef SOURCEMETA_CORE_OAUTH_ASSERTION_H_
#define SOURCEMETA_CORE_OAUTH_ASSERTION_H_
 
#ifndef SOURCEMETA_CORE_OAUTH_EXPORT
#include <sourcemeta/core/oauth_export.h>
#endif
 
#include <sourcemeta/core/crypto.h>
#include <sourcemeta/core/jose_algorithm.h>
#include <sourcemeta/core/jose_jwk_private.h>
#include <sourcemeta/core/jose_jwks.h>
#include <sourcemeta/core/oauth_dpop.h>
 
#include <chrono>      // std::chrono::seconds, std::chrono::system_clock
#include <cstdint>     // std::uint8_t
#include <optional>    // std::optional
#include <span>        // std::span
#include <string>      // std::string
#include <string_view> // std::string_view
 
namespace sourcemeta::core {

inline constexpr std::string_view OAUTH_GRANT_TYPE_JWT_BEARER{
    "urn:ietf:params:oauth:grant-type:jwt-bearer"};

inline constexpr std::string_view OAUTH_CLIENT_ASSERTION_TYPE_JWT_BEARER{
    "urn:ietf:params:oauth:client-assertion-type:jwt-bearer"};

[[nodiscard]] SOURCEMETA_CORE_OAUTH_EXPORT auto oauth_build_assertion(
    const std::string_view issuer, const std::string_view subject,
    const std::string_view audience, const std::chrono::seconds lifetime,
    const std::chrono::system_clock::time_point now, const JWKPrivate &key,
    const JWSAlgorithm algorithm) -> std::optional<std::string>;

[[nodiscard]] SOURCEMETA_CORE_OAUTH_EXPORT auto oauth_build_client_assertion(
    const std::string_view client_id, const std::string_view audience,
    const std::chrono::seconds lifetime,
    const std::chrono::system_clock::time_point now, const JWKPrivate &key,
    const JWSAlgorithm algorithm) -> std::optional<std::string>;

SOURCEMETA_CORE_OAUTH_EXPORT
auto oauth_client_assertion(const std::string_view assertion,
                            SecureString &sink) -> void;

SOURCEMETA_CORE_OAUTH_EXPORT
auto oauth_build_token_request_jwt_bearer(const std::string_view assertion,
                                          const std::string_view scope,
                                          SecureString &sink) -> void;

enum class OAuthAssertionError : std::uint8_t {
  Malformed,
  UnsupportedAlgorithm,
  UnknownKey,
  Signature,
  Issuer,
  Subject,
  Audience,
  Expired,
  NotYetValid,
  IssuedInFuture,
  Replay
};

struct OAuthAssertionVerifyOptions {
  std::span<const JWSAlgorithm> allowed_algorithms{};
  std::chrono::seconds clock_skew{std::chrono::seconds{0}};
  OAuthDPoPReplayStore *replay_store{nullptr};
};

[[nodiscard]] SOURCEMETA_CORE_OAUTH_EXPORT auto oauth_verify_client_assertion(
    const std::string_view assertion,
    const std::span<const std::string_view> expected_audiences,
    const std::string_view request_client_id, const JWKS &keys,
    const std::chrono::system_clock::time_point now,
    const OAuthAssertionVerifyOptions &options)
    -> std::optional<OAuthAssertionError>;

[[nodiscard]] SOURCEMETA_CORE_OAUTH_EXPORT auto oauth_verify_assertion_grant(
    const std::string_view assertion, const std::string_view expected_issuer,
    const std::span<const std::string_view> expected_audiences,
    const JWKS &keys, const std::chrono::system_clock::time_point now,
    const OAuthAssertionVerifyOptions &options)
    -> std::optional<OAuthAssertionError>;
 
} // namespace sourcemeta::core
 
#endif