jwt_validator.h

Go to the documentation of this file.

// BSD 3-Clause License
// Copyright (c) 2021-2025, 🍀☀🌕🌥 🌊
// See the LICENSE file in the project root for full license information.
 
#pragma once
 
#include "kcenon/pacs/web/auth/oauth2_config.h"
 
#include <cstdint>
#include <optional>
#include <string>
#include <string_view>
#include <vector>
 
namespace kcenon::pacs::web::auth {
 
// =============================================================================
// JWT Token Structures
// =============================================================================
 
struct jwt_header {
    std::string alg;    
    std::string typ;    
    std::string kid;    
};
 
struct jwt_claims {
    std::string iss;                    
    std::string sub;                    
    std::string aud;                    
    std::int64_t exp = 0;              
    std::int64_t iat = 0;              
    std::int64_t nbf = 0;              
    std::string jti;                    
    std::vector<std::string> scopes;    
};
 
struct jwt_token {
    jwt_header header;
    jwt_claims claims;
    std::string header_payload;     
    std::string signature_bytes;    
};
 
// =============================================================================
// JWT Error Types
// =============================================================================
 
enum class jwt_error {
    none,                       
    malformed_token,            
    invalid_base64,             
    invalid_json,               
    unsupported_algorithm,      
    invalid_signature,          
    token_expired,              
    token_not_yet_valid,        
    invalid_issuer,             
    invalid_audience,           
    missing_required_claim,     
    signature_not_available     
};
 
[[nodiscard]] std::string_view jwt_error_message(jwt_error error) noexcept;
 
// =============================================================================
// JWT Validator
// =============================================================================
 
class jwt_validator {
public:
    explicit jwt_validator(const oauth2_config& config);
 
    [[nodiscard]] std::pair<jwt_token, jwt_error> decode(
        std::string_view token_string) const;
 
    [[nodiscard]] jwt_error validate_claims(
        const jwt_claims& claims) const;
 
    [[nodiscard]] bool verify_rs256(
        const jwt_token& token,
        std::string_view public_key_pem) const;
 
    [[nodiscard]] bool verify_es256(
        const jwt_token& token,
        std::string_view public_key_pem) const;
 
    [[nodiscard]] static bool has_scope(
        const jwt_claims& claims,
        std::string_view scope) noexcept;
 
    [[nodiscard]] static bool has_any_scope(
        const jwt_claims& claims,
        const std::vector<std::string>& scopes) noexcept;
 
    [[nodiscard]] const oauth2_config& config() const noexcept;
 
private:
    oauth2_config config_;
};
 
// =============================================================================
// Base64url Utilities
// =============================================================================
 
[[nodiscard]] std::optional<std::string> base64url_decode(
    std::string_view input);
 
}  // namespace kcenon::pacs::web::auth