1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64

package main

import (
	captokens "codeberg.org/Profpatsch/Profpatsch/users/Profpatsch/capability-tokens-lib"
	"crypto/ed25519"
	"errors"
	"time"
)

// TokenValidator validates capability tokens
type TokenValidator struct {
	publicKey      ed25519.PublicKey
	sessionManager *SessionManager
}

// NewTokenValidator creates a new token validator
func NewTokenValidator(publicKey ed25519.PublicKey, sessionManager *SessionManager) *TokenValidator {
	return &TokenValidator{
		publicKey:      publicKey,
		sessionManager: sessionManager,
	}
}

// VerifyToken performs all validation checks on a token:
// 1. Signature verification (via library)
// 2. Token expiration (via library)
// 3. Session is active (service-specific)
// 4. Effective expiry considers both token and session expiry
// Returns error if any check fails
func (v *TokenValidator) VerifyToken(token map[string]any) error {
	// 1-2. Verify signature and basic expiration using library function
	tokenExpiry, err := captokens.VerifyTokenSignature(token, v.publicKey)
	if err != nil {
		return err
	}

	// 3. Extract session ID
	sessionID, err := captokens.ExtractSessionID(token)
	if err != nil {
		return err
	}

	// 4. Check session is active (LOCAL CHECK - no network call)
	if !v.sessionManager.IsActive(sessionID) {
		return errors.New("session not active or expired")
	}

	// 5. Token is valid only until min(token expiry, session expiry)
	sessionExpiry, exists := v.sessionManager.GetExpiry(sessionID)
	if !exists {
		return errors.New("session not found")
	}

	effectiveExpiry := tokenExpiry
	if sessionExpiry.Before(tokenExpiry) {
		effectiveExpiry = sessionExpiry
	}

	if time.Now().After(effectiveExpiry) {
		return errors.New("token expired")
	}

	return nil
}