jay brown
56 lines
1.9 KiB
Go
56 lines
1.9 KiB
Go
package cognitoauth
|
|
|
|
import (
|
|
"sync"
|
|
"time"
|
|
|
|
"github.com/lestrrat-go/jwx/v2/jwk"
|
|
)
|
|
|
|
// TokenResponse represents the response from the token endpoint
|
|
// Returned by Cognito when exchanging an authorization code for tokens
|
|
type TokenResponse struct {
|
|
IDToken string `json:"id_token"` // OpenID Connect ID token containing user claims
|
|
AccessToken string `json:"access_token"` // OAuth2 access token for accessing resources
|
|
RefreshToken string `json:"refresh_token"` // Token used to get new access tokens without re-authentication
|
|
ExpiresIn int `json:"expires_in"` // Token validity period in seconds
|
|
TokenType string `json:"token_type"` // Type of token, typically "Bearer"
|
|
}
|
|
|
|
// PKCESession stores PKCE code verifier for verification
|
|
// We need to store the code verifier temporarily to use during token exchange
|
|
type PKCESession struct {
|
|
CodeVerifier string
|
|
CreatedAt time.Time
|
|
ExpiresAt time.Time
|
|
}
|
|
|
|
// JWKSCache caches the JWKS to avoid frequent fetches
|
|
// Implements a thread-safe caching mechanism with expiration
|
|
type JWKSCache struct {
|
|
KeySet jwk.Set // The cached JSON Web Key Set
|
|
ExpiresAt time.Time // Expiration time for the cache
|
|
mutex sync.RWMutex // Mutex for thread-safe access
|
|
}
|
|
|
|
// Global map to store PKCE sessions by state parameter
|
|
// In a production environment, this should be replaced with a proper session store
|
|
var pkceSessionMap = struct {
|
|
sync.RWMutex
|
|
sessions map[string]*PKCESession
|
|
}{
|
|
sessions: make(map[string]*PKCESession),
|
|
}
|
|
|
|
// Global JWKS cache instance
|
|
var jwksCache = &JWKSCache{
|
|
ExpiresAt: time.Now(), // Initial state is expired, forcing a fetch on first use
|
|
}
|
|
|
|
// UserInfo represents the user information extracted from JWT claims
|
|
type UserInfo struct {
|
|
Username string // Username from the token
|
|
Email string // Email from the token
|
|
Groups []string // Groups the user belongs to
|
|
}
|