SignatureAlgorithm is a signature algorithm.

DPoPMode represents the operational mode for DPoP token validation.

AuthScheme represents the authorization scheme used in the request. This is used to enforce RFC 9449 Section 6.1 which specifies that Bearer tokens wi

Cache defines the interface for JWKS caching implementations. This abstraction allows swapping the underlying cache provider.

CachingProvider handles getting JWKS from the specified IssuerURL and caching them using an underlying cache implementation. It exposes KeyFunc which

============================================================================ CachingProvider Options =================================================

ConfirmationClaim represents the cnf (confirmation) claim per RFC 7800 and RFC 9449. It contains the JWK SHA-256 thumbprint that binds the access toke

Core is the framework-agnostic JWT validation engine. It contains the core logic for token validation without any dependency on specific transport pro

CustomClaims defines any custom data / claims wanted. The Validator will call the Validate function which is where custom validation logic can be defi

CustomClaims contains custom data we want from the token.

CustomClaims contains custom data we want from the token.

CustomClaims contains custom data we want from the token.

CustomClaimsExample contains custom data we want from the token.

CustomClaimsExample contains custom data we want from the token.

CustomClaimsExample contains custom data we want from the token.

CustomClaimsExample contains custom data we want from the token.

CustomClaimsExample contains custom data we want from the token.

DPoPContext contains validated DPoP information for the application. This is created by Core after successful DPoP validation and can be stored in the

DPoPProofClaims represents the essential claims extracted from a DPoP proof. This interface allows the core to work with different DPoP proof claim im

DPoPProofClaims represents the claims in a DPoP proof JWT per RFC 9449. These claims are extracted from the JWT sent in the DPoP HTTP header.

DiscoveryOptions controls optional security validations on OIDC discovery metadata.

ErrorHandler is a handler which is called when an error occurs in the JWTMiddleware. The handler determines the HTTP response when a token is not foun

ErrorHandler converts validation errors to gRPC status errors.

ErrorResponse represents a structured error response.

ExclusionHandler is a function that determines whether a gRPC method should be excluded from JWT validation. It receives the full method name (e.g., "

ExclusionURLHandler is a function that takes in a http.Request and returns true if the request should be excluded from JWT validation.

ExtractedToken holds both the extracted token and the authorization scheme used. This allows the middleware to enforce that DPoP scheme requires a DPo

GreeterClient is the client API for Greeter service. For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.d

GreeterServer is the server API for Greeter service. All implementations must embed UnimplementedGreeterServer for forward compatibility

Health check response.

Health check request.

The response message containing the greetings.

The request message containing the user's name.

IssuerInfo contains observability information about a single managed issuer.

IssuerKeyConfig configures key material for a specific issuer. Used with WithIssuerKeyConfig to support symmetric (HS256/HS384/HS512) issuers in MCD (

IssuerType represents the type of key management for an issuer.

JWTInterceptor provides JWT validation for gRPC servers.

JWTMiddleware is a middleware that validates JWTs and makes claims available in the request context. It wraps the core validation engine and provides

KeySet represents a set of JSON Web Keys. This interface abstracts the underlying JWKS implementation.

Logger defines an optional logging interface compatible with log/slog. This is the same interface used by core for consistent logging across the stack

Logger defines an optional logging interface for the core middleware.

Logger defines an optional logging interface compatible with log/slog. This is the same interface used by core for consistent logging across the stack

MultiIssuerProvider handles JWKS for multiple issuers dynamically. It creates and caches per-issuer JWKS providers on-demand, automatically routing re

============================================================================ MultiIssuerProvider Options =============================================

Option configures the JWTMiddleware. Returns error for validation failures.

Option is a function that configures the Core. Options return errors to enable validation during construction.

Option is how options for the Validator are set up. Options return errors to enable validation during construction.

Option configures the JWT interceptor. Returns error for validation failures.

Provider handles getting JWKS from the specified IssuerURL and exposes KeyFunc which adheres to the keyFunc signature that the Validator requires. Mos

============================================================================ Provider Options ========================================================

ProviderStats contains summary and per-issuer information about the MultiIssuerProvider's current state. Useful for monitoring dashboards and debuggin

RedisCache implements the jwks.Cache interface using Redis as the backing store. This is useful for multi-tenant applications with 100+ issuers to avo

RegisteredClaims represents public claim values (as specified in RFC 7519).

TokenClaims represents the essential claims from an access token. This interface allows the core to work with different token claim implementations.

TokenExtractor is a function that takes a request as input and returns an ExtractedToken containing both the token and its authorization scheme, or an

TokenExtractor extracts JWT tokens from gRPC metadata.

TrustedProxyConfig defines which reverse proxy headers to trust. SECURITY WARNING: Only enable when behind a trusted reverse proxy! Enabling this in

UnimplementedGreeterServer must be embedded to have forward compatible implementations.

UnsafeGreeterServer may be embedded to opt out of forward compatibility for this service. Use of this interface is not recommended, as added methods t

ValidatedClaims is the struct that will be inserted into the context for the user. CustomClaims will be nil unless WithCustomClaims is passed to New.

ValidationError wraps JWT validation errors with additional context. It provides structured error information that can be used for logging, metrics, a

Validator defines the interface for JWT and DPoP validation. Implementations should validate tokens and DPoP proofs, returning the validated claims.

Validator validates JWTs using the jwx v3 library.

WellKnownEndpoints holds the well known OIDC endpoints.

cachingProviderConfig holds internal configuration for creating a CachingProvider.

contextKey is an unexported type for context keys to prevent collisions. Using an unexported type ensures that only this package can create context ke

contextKey is an unexported type for context keys to prevent collisions. Using an unexported type ensures that only this package can create context ke

errorResponse mirrors the DefaultErrorHandler JSON response structure.

invalidError handles wrapping a JWT validation error with the concrete error ErrJWTInvalid. We do not expose this publicly because the interface metho

issuerCache provides simple in-memory caching for issuer resolution

jwxCache wraps jwx's Cache to implement our Cache interface with proper concurrency handling. This adapter allows us to swap out the underlying cache

mockCache is a test cache implementation

mockErrorCache is a cache implementation that always returns errors

mockLogger is a test implementation of the Logger interface

mockLogger is a mock implementation of Logger for testing.

mockLogger implements Logger interface for testing

mockMultiIssuerCache is a mock implementation of the Cache interface for testing multi-issuer providers

mockOIDCServer creates a mock OIDC/JWKS server for testing

mockOIDCServer creates a mock OIDC/JWKS server for testing

mockOIDCServer creates a mock OIDC/JWKS server for testing

mockServerStream implements grpc.ServerStream for testing

Mock implementations for testing

mockValidator is a mock implementation of Validator for testing.

multiIssuerConfig holds internal configuration for creating a MultiIssuerProvider.

providerEntry wraps a CachingProvider with metadata for LRU tracking

server implements the Greeter service.

tenantContextKey is the key for storing tenant ID in request context

validatorAdapter adapts the validator.Validator to the core.Validator interface

validatorAdapter adapts validator.Validator to core.Validator interface.

wrappedServerStream wraps grpc.ServerStream with a custom context.