Function Verify

pkg/packetbroker/token.go:189–210

Verify verifies the token and returns the claims. If issuer is non-empty, the token's issuer must match the issuer. If audience is non-empty, one of the token's audiences must match the audience. The current system timestamp is used as reference to verify not before, issued at and expiry.

(ctx context.Context, token *jwt.JSONWebToken, keyProvider PublicKeyProvider, issuer, audience string)

// If audience is non-empty, one of the token's audiences must match the audience.
// The current system timestamp is used as reference to verify not before, issued at and expiry.
func Verify(ctx context.Context, token *jwt.JSONWebToken, keyProvider PublicKeyProvider, issuer, audience string) (TokenClaims, error) {
	keys, err := keyProvider.PublicKeys(ctx)
	if err != nil {
		return TokenClaims{}, err
	}
	var claims TokenClaims
	if err := token.Claims(keys, &claims); err != nil {
		return TokenClaims{}, errOAuth2Token.WithCause(err)
	}

	exp := jwt.Expected{
		Issuer: issuer,
		Time:   time.Now(),
	}
	if audience != "" {
		exp.Audience = jwt.Audience{audience}
	}
	if err := claims.Validate(exp); err != nil {
		return TokenClaims{}, errNotAuthorized.WithCause(err)
	}
	return claims, nil
}

// CachePublicKey caches the result from the given PublicKeyProvider with the TTL.
func CachePublicKey(provider PublicKeyProvider, ttl time.Duration) PublicKeyProvider {