mirror of
https://github.com/twofas/2fas-server.git
synced 2024-12-12 12:09:56 +01:00
46 lines
1015 B
Go
46 lines
1015 B
Go
package sign
|
|
|
|
import (
|
|
"errors"
|
|
"fmt"
|
|
|
|
"github.com/golang-jwt/jwt/v5"
|
|
)
|
|
|
|
var ErrInvalidClaims = errors.New("invalid claims")
|
|
|
|
// CanI establish connection with type tp given claims in token.
|
|
func (s Service) CanI(tokenString string, ct ConnectionType) error {
|
|
cl := jwt.MapClaims{}
|
|
|
|
// In Sign we removed `jwtHeader` from JWT before returning it.
|
|
// We need to add it again before doing the verification.
|
|
tokenString = jwtHeader + tokenString
|
|
|
|
token, err := jwt.ParseWithClaims(
|
|
tokenString,
|
|
&cl,
|
|
func(token *jwt.Token) (interface{}, error) {
|
|
return s.publicKey, nil
|
|
},
|
|
jwt.WithValidMethods([]string{"ES256"}),
|
|
jwt.WithExpirationRequired(),
|
|
)
|
|
if err != nil {
|
|
return fmt.Errorf("failed to parse token: %w", err)
|
|
}
|
|
|
|
claims, err := token.Claims.GetAudience()
|
|
if err != nil {
|
|
return fmt.Errorf("failed to get claims: %w", err)
|
|
}
|
|
|
|
for _, aud := range claims {
|
|
if aud == string(ct) {
|
|
return nil
|
|
}
|
|
}
|
|
|
|
return fmt.Errorf("%w: claim %q not found in claims", ErrInvalidClaims, ct)
|
|
}
|