-
Notifications
You must be signed in to change notification settings - Fork 0
/
jwt_service.go
90 lines (71 loc) · 1.69 KB
/
jwt_service.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
package jwtx
import (
"context"
"fmt"
"github.com/lestrrat-go/jwx/v2/jwk"
"github.com/lestrrat-go/jwx/v2/jwt"
)
// Options is a struct for specifying configuration options for the JWT service.
type Options struct {
JWKS string `json:"jwks"`
Aud string `json:"aud"`
Iss string `json:"iss"`
}
type JWTService struct {
Options Options
keyset jwk.Set
}
// NewService constructs a new JWTService instance with supplied options.
func NewService(options ...Options) (*JWTService, error) {
var opts Options
if len(options) == 0 {
opts = Options{}
} else {
opts = options[0]
}
var keyset jwk.Set
if opts.JWKS != "" {
var err error
keyset, err = fetchKeyset(opts.JWKS)
if err != nil {
return nil, err
}
}
return &JWTService{
Options: opts,
keyset: keyset,
}, nil
}
func fetchKeyset(url string) (jwk.Set, error) {
keyset, err := jwk.Fetch(context.Background(), url)
if err != nil {
return nil, fmt.Errorf("failed to parse JWK: %w", err)
}
return keyset, nil
}
func (s *JWTService) Parse(payload []byte) (jwt.Token, error) {
token, err := jwt.Parse(payload,
jwt.WithKeySet(s.keyset),
jwt.WithValidate(false),
)
if err != nil {
return nil, fmt.Errorf("failed to parse payload: %w", err)
}
return token, nil
}
func (s *JWTService) Validate(token jwt.Token) error {
options := make([]jwt.ValidateOption, 0)
if s.Options.Aud != "" {
// Verify 'aud' claim
options = append(options, jwt.WithAudience(s.Options.Aud))
}
if s.Options.Iss != "" {
// Verify 'iss' claim
options = append(options, jwt.WithIssuer(s.Options.Iss))
}
err := jwt.Validate(token, options...)
if err != nil {
return fmt.Errorf("failed to validate token: %w", err)
}
return nil
}