crypto_jwt.h

Go to the documentation of this file.

 
#ifndef QB_IO_CRYPTO_JWT_H
#define QB_IO_CRYPTO_JWT_H
 
#include <chrono>
#include <map>
#include <optional>
#include <string>
#include <vector>
#include "crypto.h"
 
namespace qb {

class jwt {
public:
    enum class Algorithm {
        HS256, 
        HS384, 
        HS512, 
        RS256, 
        RS384, 
        RS512, 
        ES256, 
        ES384, 
        ES512, 
        EdDSA  
    };

    enum class ValidationError {
        NONE,
        INVALID_FORMAT,
        INVALID_SIGNATURE,
        TOKEN_EXPIRED,
        TOKEN_NOT_ACTIVE,
        INVALID_ISSUER,
        INVALID_AUDIENCE,
        INVALID_SUBJECT,
        CLAIM_MISMATCH
    };

    struct ValidationResult {
        ValidationError error; 
        std::map<std::string, std::string> payload; 
        
        bool is_valid() const { return error == ValidationError::NONE; }
        
        ValidationResult() : error(ValidationError::NONE) {}
        ValidationResult(ValidationError err) : error(err) {}
    };

    struct TokenParts {
        std::string header;    
        std::string payload;   
        std::string signature; 
    };
    
    struct CreateOptions {
        Algorithm algorithm; 
        std::string key;     
        std::optional<std::string> type; 
        std::optional<std::string> content_type; 
        std::optional<std::string> key_id;       
        std::map<std::string, std::string> header_claims; 
        
        CreateOptions() : algorithm(Algorithm::HS256), type("JWT") {}
    };
    
    struct VerifyOptions {
        Algorithm algorithm; 
        std::string key;     
        bool verify_expiration; 
        bool verify_not_before; 
        bool verify_issuer;     
        std::optional<std::string> issuer; 
        bool verify_audience;   
        std::optional<std::string> audience; 
        bool verify_subject;    
        std::optional<std::string> subject;  
        bool verify_jti;        
        std::optional<std::string> jti;      
        std::chrono::seconds clock_skew; 
        std::map<std::string, std::string> required_claims; 
        
        VerifyOptions() 
            : algorithm(Algorithm::HS256),
              verify_expiration(true),
              verify_not_before(true),
              verify_issuer(false),
              verify_audience(false),
              verify_subject(false),
              verify_jti(false),
              clock_skew(std::chrono::seconds(0)) {}
    };

    static std::string create(const std::map<std::string, std::string>& payload, 
                             const CreateOptions& options);
    
    static std::string create_token(
        const std::map<std::string, std::string>& payload,
        const std::string& issuer,
        const std::string& subject,
        const std::string& audience,
        std::chrono::seconds expires_in,
        std::chrono::seconds not_before = std::chrono::seconds(0),
        const std::string& jti = "",
        const CreateOptions& options = CreateOptions());
    
    static ValidationResult verify(const std::string& token, const VerifyOptions& options);
    
    static TokenParts decode(const std::string& token);
    
    static std::string algorithm_to_string(Algorithm algorithm);
    
    static std::optional<Algorithm> algorithm_from_string(const std::string& algorithm_str);
 
private:
    static std::vector<unsigned char> sign_data(const std::string& data, 
                                               const CreateOptions& options);
    
    static bool verify_signature(const std::string& data,
                                const std::vector<unsigned char>& signature,
                                const VerifyOptions& options);
    
    static crypto::DigestAlgorithm get_digest_algorithm(Algorithm algorithm);
    
    static int64_t current_timestamp();
};
 
} // namespace qb
 
#endif // QB_IO_CRYPTO_JWT_H