435c0d9fc8
This PR switches the Nomad repository from using govendor to Go modules for managing dependencies. Aspects of the Nomad workflow remain pretty much the same. The usual Makefile targets should continue to work as they always did. The API submodule simply defers to the parent Nomad version on the repository, keeping the semantics of API versioning that currently exists.
95 lines
2.6 KiB
Go
95 lines
2.6 KiB
Go
package jwt
|
|
|
|
import (
|
|
"encoding/json"
|
|
"errors"
|
|
// "fmt"
|
|
)
|
|
|
|
// Claims type that uses the map[string]interface{} for JSON decoding
|
|
// This is the default claims type if you don't supply one
|
|
type MapClaims map[string]interface{}
|
|
|
|
// Compares the aud claim against cmp.
|
|
// If required is false, this method will return true if the value matches or is unset
|
|
func (m MapClaims) VerifyAudience(cmp string, req bool) bool {
|
|
aud, _ := m["aud"].(string)
|
|
return verifyAud(aud, cmp, req)
|
|
}
|
|
|
|
// Compares the exp claim against cmp.
|
|
// If required is false, this method will return true if the value matches or is unset
|
|
func (m MapClaims) VerifyExpiresAt(cmp int64, req bool) bool {
|
|
switch exp := m["exp"].(type) {
|
|
case float64:
|
|
return verifyExp(int64(exp), cmp, req)
|
|
case json.Number:
|
|
v, _ := exp.Int64()
|
|
return verifyExp(v, cmp, req)
|
|
}
|
|
return req == false
|
|
}
|
|
|
|
// Compares the iat claim against cmp.
|
|
// If required is false, this method will return true if the value matches or is unset
|
|
func (m MapClaims) VerifyIssuedAt(cmp int64, req bool) bool {
|
|
switch iat := m["iat"].(type) {
|
|
case float64:
|
|
return verifyIat(int64(iat), cmp, req)
|
|
case json.Number:
|
|
v, _ := iat.Int64()
|
|
return verifyIat(v, cmp, req)
|
|
}
|
|
return req == false
|
|
}
|
|
|
|
// Compares the iss claim against cmp.
|
|
// If required is false, this method will return true if the value matches or is unset
|
|
func (m MapClaims) VerifyIssuer(cmp string, req bool) bool {
|
|
iss, _ := m["iss"].(string)
|
|
return verifyIss(iss, cmp, req)
|
|
}
|
|
|
|
// Compares the nbf claim against cmp.
|
|
// If required is false, this method will return true if the value matches or is unset
|
|
func (m MapClaims) VerifyNotBefore(cmp int64, req bool) bool {
|
|
switch nbf := m["nbf"].(type) {
|
|
case float64:
|
|
return verifyNbf(int64(nbf), cmp, req)
|
|
case json.Number:
|
|
v, _ := nbf.Int64()
|
|
return verifyNbf(v, cmp, req)
|
|
}
|
|
return req == false
|
|
}
|
|
|
|
// Validates time based claims "exp, iat, nbf".
|
|
// There is no accounting for clock skew.
|
|
// As well, if any of the above claims are not in the token, it will still
|
|
// be considered a valid claim.
|
|
func (m MapClaims) Valid() error {
|
|
vErr := new(ValidationError)
|
|
now := TimeFunc().Unix()
|
|
|
|
if m.VerifyExpiresAt(now, false) == false {
|
|
vErr.Inner = errors.New("Token is expired")
|
|
vErr.Errors |= ValidationErrorExpired
|
|
}
|
|
|
|
if m.VerifyIssuedAt(now, false) == false {
|
|
vErr.Inner = errors.New("Token used before issued")
|
|
vErr.Errors |= ValidationErrorIssuedAt
|
|
}
|
|
|
|
if m.VerifyNotBefore(now, false) == false {
|
|
vErr.Inner = errors.New("Token is not valid yet")
|
|
vErr.Errors |= ValidationErrorNotValidYet
|
|
}
|
|
|
|
if vErr.valid() {
|
|
return nil
|
|
}
|
|
|
|
return vErr
|
|
}
|