oidc_id_token.h

#ifndef SOURCEMETA_CORE_OIDC_ID_TOKEN_H_
#define SOURCEMETA_CORE_OIDC_ID_TOKEN_H_
 
#ifndef SOURCEMETA_CORE_OIDC_EXPORT
#include <sourcemeta/core/oidc_export.h>
#endif
 
#include <sourcemeta/core/jose.h>
#include <sourcemeta/core/json.h>
 
#include <chrono>      // std::chrono::system_clock, std::chrono::seconds
#include <optional>    // std::optional
#include <span>        // std::span
#include <string>      // std::string
#include <string_view> // std::string_view
 
namespace sourcemeta::core {

SOURCEMETA_CORE_OIDC_EXPORT
auto oidc_parse_id_token(const JSON &token_response)
    -> std::optional<std::string>;

struct OIDCIdentity {
  std::string subject;
  std::string issuer;
  std::optional<std::string> authentication_context_class;
  std::optional<std::chrono::system_clock::time_point> authentication_time;
};

struct OIDCValidationOptions {
  std::optional<std::string_view> nonce;
  std::span<const std::string_view> acceptable_authentication_context_classes;
  std::span<const std::string_view> trusted_audiences;
  std::optional<std::chrono::seconds> maximum_authentication_age;
  std::optional<std::chrono::seconds> maximum_issued_at_age;
  std::optional<std::string_view> access_token;
  std::optional<std::string_view> code;
  bool require_access_token_hash{false};
  bool require_code_hash{false};
};

SOURCEMETA_CORE_OIDC_EXPORT
auto oidc_validate_id_token(
    const JWT &token, const JWKS &keys,
    const std::span<const JWSAlgorithm> allowed_algorithms,
    const std::string_view issuer, const std::string_view client_id,
    const std::chrono::system_clock::time_point now,
    const OIDCValidationOptions &options = {},
    const JWTClockSkew clock_skew = {}) -> std::optional<OIDCIdentity>;

SOURCEMETA_CORE_OIDC_EXPORT
auto oidc_validate_id_token(
    JWKSProvider &provider, const JWT &token,
    const std::span<const JWSAlgorithm> allowed_algorithms,
    const std::string_view issuer, const std::string_view client_id,
    const OIDCValidationOptions &options = {}) -> std::optional<OIDCIdentity>;

struct OIDCIdTokenClaims {
  std::string_view issuer;
  std::string_view subject;
  std::string_view audience;
  std::chrono::system_clock::time_point issued_at;
  std::chrono::system_clock::time_point expiration;
  std::optional<std::string_view> nonce;
  std::optional<std::string_view> authorized_party;
  std::optional<std::string_view> authentication_context_class;
  std::optional<std::chrono::system_clock::time_point> authentication_time;
  std::optional<std::string_view> access_token;
  std::optional<std::string_view> code;
};

SOURCEMETA_CORE_OIDC_EXPORT
auto oidc_mint_id_token(const OIDCIdTokenClaims &claims, const JWKPrivate &key,
                        const JWSAlgorithm algorithm)
    -> std::optional<std::string>;
 
} // namespace sourcemeta::core
 
#endif