├── LICENSE
├── composer.json
└── src
    ├── Builder.php
    ├── ClaimsFormatter.php
    ├── Configuration.php
    ├── Decoder.php
    ├── Encoder.php
    ├── Encoding
        ├── CannotDecodeContent.php
        ├── CannotEncodeContent.php
        ├── ChainedFormatter.php
        ├── JoseEncoder.php
        ├── MicrosecondBasedDateConversion.php
        ├── UnifyAudience.php
        └── UnixTimestampDates.php
    ├── Exception.php
    ├── JwtFacade.php
    ├── Parser.php
    ├── Signer.php
    ├── Signer
        ├── Blake2b.php
        ├── CannotSignPayload.php
        ├── Ecdsa.php
        ├── Ecdsa
        │   ├── ConversionFailed.php
        │   ├── MultibyteStringConverter.php
        │   ├── Sha256.php
        │   ├── Sha384.php
        │   ├── Sha512.php
        │   └── SignatureConverter.php
        ├── Eddsa.php
        ├── Hmac.php
        ├── Hmac
        │   ├── Sha256.php
        │   ├── Sha384.php
        │   └── Sha512.php
        ├── InvalidKeyProvided.php
        ├── Key.php
        ├── Key
        │   ├── FileCouldNotBeRead.php
        │   └── InMemory.php
        ├── OpenSSL.php
        ├── Rsa.php
        └── Rsa
        │   ├── Sha256.php
        │   ├── Sha384.php
        │   └── Sha512.php
    ├── SodiumBase64Polyfill.php
    ├── Token.php
    ├── Token
        ├── Builder.php
        ├── DataSet.php
        ├── InvalidTokenStructure.php
        ├── Parser.php
        ├── Plain.php
        ├── RegisteredClaimGiven.php
        ├── RegisteredClaims.php
        ├── Signature.php
        └── UnsupportedHeaderFound.php
    ├── UnencryptedToken.php
    ├── Validation
        ├── Constraint.php
        ├── Constraint
        │   ├── CannotValidateARegisteredClaim.php
        │   ├── HasClaim.php
        │   ├── HasClaimWithValue.php
        │   ├── IdentifiedBy.php
        │   ├── IssuedBy.php
        │   ├── LeewayCannotBeNegative.php
        │   ├── LooseValidAt.php
        │   ├── PermittedFor.php
        │   ├── RelatedTo.php
        │   ├── SignedWith.php
        │   ├── SignedWithOneInSet.php
        │   ├── SignedWithUntilDate.php
        │   └── StrictValidAt.php
        ├── ConstraintViolation.php
        ├── NoConstraintsGiven.php
        ├── RequiredConstraintsViolated.php
        ├── SignedWith.php
        ├── ValidAt.php
        └── Validator.php
    └── Validator.php


/LICENSE:
--------------------------------------------------------------------------------
 1 | Copyright (c) 2014, Luís Cobucci
 2 | All rights reserved.
 3 | 
 4 | Redistribution and use in source and binary forms, with or without
 5 | modification, are permitted provided that the following conditions are met:
 6 | 
 7 | * Redistributions of source code must retain the above copyright notice, this
 8 |   list of conditions and the following disclaimer.
 9 | 
10 | * Redistributions in binary form must reproduce the above copyright notice,
11 |   this list of conditions and the following disclaimer in the documentation
12 |   and/or other materials provided with the distribution.
13 | 
14 | * Neither the name of the {organization} nor the names of its
15 |   contributors may be used to endorse or promote products derived from
16 |   this software without specific prior written permission.
17 | 
18 | THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
19 | AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20 | IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
21 | DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
22 | FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23 | DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
24 | SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
25 | CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
26 | OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
27 | OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
28 | 


--------------------------------------------------------------------------------
/composer.json:
--------------------------------------------------------------------------------
 1 | {
 2 |     "name": "lcobucci/jwt",
 3 |     "description": "A simple library to work with JSON Web Token and JSON Web Signature",
 4 |     "license": [
 5 |         "BSD-3-Clause"
 6 |     ],
 7 |     "type": "library",
 8 |     "keywords": [
 9 |         "JWT",
10 |         "JWS"
11 |     ],
12 |     "authors": [
13 |         {
14 |             "name": "Luís Cobucci",
15 |             "email": "lcobucci@gmail.com",
16 |             "role": "Developer"
17 |         }
18 |     ],
19 |     "require": {
20 |         "php": "~8.3.0 || ~8.4.0",
21 |         "ext-openssl": "*",
22 |         "ext-sodium": "*",
23 |         "psr/clock": "^1.0"
24 |     },
25 |     "require-dev": {
26 |         "infection/infection": "^0.29.10",
27 |         "lcobucci/clock": "^3.3.1",
28 |         "lcobucci/coding-standard": "^11.1",
29 |         "phpbench/phpbench": "^1.4",
30 |         "phpstan/extension-installer": "^1.4.3",
31 |         "phpstan/phpstan": "^2.1.2",
32 |         "phpstan/phpstan-deprecation-rules": "^2.0.1",
33 |         "phpstan/phpstan-phpunit": "^2.0.4",
34 |         "phpstan/phpstan-strict-rules": "^2.0.3",
35 |         "phpunit/phpunit": "^12.0.0"
36 |     },
37 |     "suggest": {
38 |         "lcobucci/clock": ">= 3.2"
39 |     },
40 |     "autoload": {
41 |         "psr-4": {
42 |             "Lcobucci\\JWT\\": "src"
43 |         }
44 |     },
45 |     "autoload-dev": {
46 |         "psr-4": {
47 |             "Lcobucci\\JWT\\Tests\\": "tests"
48 |         }
49 |     },
50 |     "config": {
51 |         "allow-plugins": {
52 |             "dealerdirect/phpcodesniffer-composer-installer": true,
53 |             "infection/extension-installer": true,
54 |             "ocramius/package-versions": true,
55 |             "phpstan/extension-installer": true
56 |         },
57 |         "preferred-install": "dist",
58 |         "sort-packages": true
59 |     }
60 | }
61 | 


--------------------------------------------------------------------------------
/src/Builder.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT;
 5 | 
 6 | use DateTimeImmutable;
 7 | use Lcobucci\JWT\Encoding\CannotEncodeContent;
 8 | use Lcobucci\JWT\Signer\CannotSignPayload;
 9 | use Lcobucci\JWT\Signer\Ecdsa\ConversionFailed;
10 | use Lcobucci\JWT\Signer\InvalidKeyProvided;
11 | use Lcobucci\JWT\Signer\Key;
12 | use Lcobucci\JWT\Token\RegisteredClaimGiven;
13 | 
14 | /** @immutable */
15 | interface Builder
16 | {
17 |     /**
18 |      * Appends new items to audience
19 |      *
20 |      * @param non-empty-string ...$audiences
21 |      */
22 |     public function permittedFor(string ...$audiences): Builder;
23 | 
24 |     /**
25 |      * Configures the expiration time
26 |      */
27 |     public function expiresAt(DateTimeImmutable $expiration): Builder;
28 | 
29 |     /**
30 |      * Configures the token id
31 |      *
32 |      * @param non-empty-string $id
33 |      */
34 |     public function identifiedBy(string $id): Builder;
35 | 
36 |     /**
37 |      * Configures the time that the token was issued
38 |      */
39 |     public function issuedAt(DateTimeImmutable $issuedAt): Builder;
40 | 
41 |     /**
42 |      * Configures the issuer
43 |      *
44 |      * @param non-empty-string $issuer
45 |      */
46 |     public function issuedBy(string $issuer): Builder;
47 | 
48 |     /**
49 |      * Configures the time before which the token cannot be accepted
50 |      */
51 |     public function canOnlyBeUsedAfter(DateTimeImmutable $notBefore): Builder;
52 | 
53 |     /**
54 |      * Configures the subject
55 |      *
56 |      * @param non-empty-string $subject
57 |      */
58 |     public function relatedTo(string $subject): Builder;
59 | 
60 |     /**
61 |      * Configures a header item
62 |      *
63 |      * @param non-empty-string $name
64 |      */
65 |     public function withHeader(string $name, mixed $value): Builder;
66 | 
67 |     /**
68 |      * Configures a claim item
69 |      *
70 |      * @param non-empty-string $name
71 |      *
72 |      * @throws RegisteredClaimGiven When trying to set a registered claim.
73 |      */
74 |     public function withClaim(string $name, mixed $value): Builder;
75 | 
76 |     /**
77 |      * Returns a signed token to be used
78 |      *
79 |      * @throws CannotEncodeContent When data cannot be converted to JSON.
80 |      * @throws CannotSignPayload   When payload signing fails.
81 |      * @throws InvalidKeyProvided  When issue key is invalid/incompatible.
82 |      * @throws ConversionFailed    When signature could not be converted.
83 |      */
84 |     public function getToken(Signer $signer, Key $key): UnencryptedToken;
85 | }
86 | 


--------------------------------------------------------------------------------
/src/ClaimsFormatter.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT;
 5 | 
 6 | interface ClaimsFormatter
 7 | {
 8 |     /**
 9 |      * @param array<non-empty-string, mixed> $claims
10 |      *
11 |      * @return array<non-empty-string, mixed>
12 |      */
13 |     public function formatClaims(array $claims): array;
14 | }
15 | 


--------------------------------------------------------------------------------
/src/Configuration.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | declare(strict_types=1);
  3 | 
  4 | namespace Lcobucci\JWT;
  5 | 
  6 | use Closure;
  7 | use Lcobucci\JWT\Encoding\ChainedFormatter;
  8 | use Lcobucci\JWT\Encoding\JoseEncoder;
  9 | use Lcobucci\JWT\Signer\Key;
 10 | use Lcobucci\JWT\Validation\Constraint;
 11 | 
 12 | /**
 13 |  * Configuration container for the JWT Builder and Parser
 14 |  *
 15 |  * Serves like a small DI container to simplify the creation and usage
 16 |  * of the objects.
 17 |  */
 18 | final readonly class Configuration
 19 | {
 20 |     private Parser $parser;
 21 |     private Validator $validator;
 22 | 
 23 |     /** @var Closure(ClaimsFormatter $claimFormatter): Builder */
 24 |     private Closure $builderFactory;
 25 | 
 26 |     /** @var Constraint[] */
 27 |     private array $validationConstraints;
 28 | 
 29 |     /** @param Closure(ClaimsFormatter $claimFormatter): Builder|null $builderFactory */
 30 |     private function __construct(
 31 |         private Signer $signer,
 32 |         private Key $signingKey,
 33 |         private Key $verificationKey,
 34 |         private Encoder $encoder,
 35 |         private Decoder $decoder,
 36 |         ?Parser $parser,
 37 |         ?Validator $validator,
 38 |         ?Closure $builderFactory,
 39 |         Constraint ...$validationConstraints,
 40 |     ) {
 41 |         $this->parser    = $parser ?? new Token\Parser($decoder);
 42 |         $this->validator = $validator ?? new Validation\Validator();
 43 | 
 44 |         $this->builderFactory = $builderFactory
 45 |             ?? static function (ClaimsFormatter $claimFormatter) use ($encoder): Builder {
 46 |                 return Token\Builder::new($encoder, $claimFormatter);
 47 |             };
 48 | 
 49 |         $this->validationConstraints = $validationConstraints;
 50 |     }
 51 | 
 52 |     public static function forAsymmetricSigner(
 53 |         Signer $signer,
 54 |         Key $signingKey,
 55 |         Key $verificationKey,
 56 |         Encoder $encoder = new JoseEncoder(),
 57 |         Decoder $decoder = new JoseEncoder(),
 58 |     ): self {
 59 |         return new self(
 60 |             $signer,
 61 |             $signingKey,
 62 |             $verificationKey,
 63 |             $encoder,
 64 |             $decoder,
 65 |             null,
 66 |             null,
 67 |             null,
 68 |         );
 69 |     }
 70 | 
 71 |     public static function forSymmetricSigner(
 72 |         Signer $signer,
 73 |         Key $key,
 74 |         Encoder $encoder = new JoseEncoder(),
 75 |         Decoder $decoder = new JoseEncoder(),
 76 |     ): self {
 77 |         return new self(
 78 |             $signer,
 79 |             $key,
 80 |             $key,
 81 |             $encoder,
 82 |             $decoder,
 83 |             null,
 84 |             null,
 85 |             null,
 86 |         );
 87 |     }
 88 | 
 89 |     /** @param callable(ClaimsFormatter): Builder $builderFactory */
 90 |     public function withBuilderFactory(callable $builderFactory): self
 91 |     {
 92 |         return new self(
 93 |             $this->signer,
 94 |             $this->signingKey,
 95 |             $this->verificationKey,
 96 |             $this->encoder,
 97 |             $this->decoder,
 98 |             $this->parser,
 99 |             $this->validator,
100 |             $builderFactory(...),
101 |             ...$this->validationConstraints,
102 |         );
103 |     }
104 | 
105 |     public function builder(?ClaimsFormatter $claimFormatter = null): Builder
106 |     {
107 |         return ($this->builderFactory)($claimFormatter ?? ChainedFormatter::default());
108 |     }
109 | 
110 |     public function parser(): Parser
111 |     {
112 |         return $this->parser;
113 |     }
114 | 
115 |     public function withParser(Parser $parser): self
116 |     {
117 |         return new self(
118 |             $this->signer,
119 |             $this->signingKey,
120 |             $this->verificationKey,
121 |             $this->encoder,
122 |             $this->decoder,
123 |             $parser,
124 |             $this->validator,
125 |             $this->builderFactory,
126 |             ...$this->validationConstraints,
127 |         );
128 |     }
129 | 
130 |     public function signer(): Signer
131 |     {
132 |         return $this->signer;
133 |     }
134 | 
135 |     public function signingKey(): Key
136 |     {
137 |         return $this->signingKey;
138 |     }
139 | 
140 |     public function verificationKey(): Key
141 |     {
142 |         return $this->verificationKey;
143 |     }
144 | 
145 |     public function validator(): Validator
146 |     {
147 |         return $this->validator;
148 |     }
149 | 
150 |     public function withValidator(Validator $validator): self
151 |     {
152 |         return new self(
153 |             $this->signer,
154 |             $this->signingKey,
155 |             $this->verificationKey,
156 |             $this->encoder,
157 |             $this->decoder,
158 |             $this->parser,
159 |             $validator,
160 |             $this->builderFactory,
161 |             ...$this->validationConstraints,
162 |         );
163 |     }
164 | 
165 |     /** @return Constraint[] */
166 |     public function validationConstraints(): array
167 |     {
168 |         return $this->validationConstraints;
169 |     }
170 | 
171 |     public function withValidationConstraints(Constraint ...$validationConstraints): self
172 |     {
173 |         return new self(
174 |             $this->signer,
175 |             $this->signingKey,
176 |             $this->verificationKey,
177 |             $this->encoder,
178 |             $this->decoder,
179 |             $this->parser,
180 |             $this->validator,
181 |             $this->builderFactory,
182 |             ...$validationConstraints,
183 |         );
184 |     }
185 | }
186 | 


--------------------------------------------------------------------------------
/src/Decoder.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT;
 5 | 
 6 | use Lcobucci\JWT\Encoding\CannotDecodeContent;
 7 | 
 8 | interface Decoder
 9 | {
10 |     /**
11 |      * Decodes from JSON, validating the errors
12 |      *
13 |      * @param non-empty-string $json
14 |      *
15 |      * @throws CannotDecodeContent When something goes wrong while decoding.
16 |      */
17 |     public function jsonDecode(string $json): mixed;
18 | 
19 |     /**
20 |      * Decodes from Base64URL
21 |      *
22 |      * @link http://tools.ietf.org/html/rfc4648#section-5
23 |      *
24 |      * @return ($data is non-empty-string ? non-empty-string : string)
25 |      *
26 |      * @throws CannotDecodeContent When something goes wrong while decoding.
27 |      */
28 |     public function base64UrlDecode(string $data): string;
29 | }
30 | 


--------------------------------------------------------------------------------
/src/Encoder.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT;
 5 | 
 6 | use Lcobucci\JWT\Encoding\CannotEncodeContent;
 7 | 
 8 | interface Encoder
 9 | {
10 |     /**
11 |      * Encodes to JSON, validating the errors
12 |      *
13 |      * @return non-empty-string
14 |      *
15 |      * @throws CannotEncodeContent When something goes wrong while encoding.
16 |      */
17 |     public function jsonEncode(mixed $data): string;
18 | 
19 |     /**
20 |      * Encodes to base64url
21 |      *
22 |      * @link http://tools.ietf.org/html/rfc4648#section-5
23 |      *
24 |      * @return ($data is non-empty-string ? non-empty-string : string)
25 |      */
26 |     public function base64UrlEncode(string $data): string;
27 | }
28 | 


--------------------------------------------------------------------------------
/src/Encoding/CannotDecodeContent.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT\Encoding;
 5 | 
 6 | use JsonException;
 7 | use Lcobucci\JWT\Exception;
 8 | use RuntimeException;
 9 | 
10 | final class CannotDecodeContent extends RuntimeException implements Exception
11 | {
12 |     public static function jsonIssues(JsonException $previous): self
13 |     {
14 |         return new self(message: 'Error while decoding from JSON', previous: $previous);
15 |     }
16 | 
17 |     public static function invalidBase64String(): self
18 |     {
19 |         return new self('Error while decoding from Base64Url, invalid base64 characters detected');
20 |     }
21 | }
22 | 


--------------------------------------------------------------------------------
/src/Encoding/CannotEncodeContent.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT\Encoding;
 5 | 
 6 | use JsonException;
 7 | use Lcobucci\JWT\Exception;
 8 | use RuntimeException;
 9 | 
10 | final class CannotEncodeContent extends RuntimeException implements Exception
11 | {
12 |     public static function jsonIssues(JsonException $previous): self
13 |     {
14 |         return new self(message: 'Error while encoding to JSON', previous: $previous);
15 |     }
16 | }
17 | 


--------------------------------------------------------------------------------
/src/Encoding/ChainedFormatter.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT\Encoding;
 5 | 
 6 | use Lcobucci\JWT\ClaimsFormatter;
 7 | 
 8 | final readonly class ChainedFormatter implements ClaimsFormatter
 9 | {
10 |     /** @var array<ClaimsFormatter> */
11 |     private array $formatters;
12 | 
13 |     public function __construct(ClaimsFormatter ...$formatters)
14 |     {
15 |         $this->formatters = $formatters;
16 |     }
17 | 
18 |     public static function default(): self
19 |     {
20 |         return new self(new UnifyAudience(), new MicrosecondBasedDateConversion());
21 |     }
22 | 
23 |     public static function withUnixTimestampDates(): self
24 |     {
25 |         return new self(new UnifyAudience(), new UnixTimestampDates());
26 |     }
27 | 
28 |     /** @inheritdoc */
29 |     public function formatClaims(array $claims): array
30 |     {
31 |         foreach ($this->formatters as $formatter) {
32 |             $claims = $formatter->formatClaims($claims);
33 |         }
34 | 
35 |         return $claims;
36 |     }
37 | }
38 | 


--------------------------------------------------------------------------------
/src/Encoding/JoseEncoder.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT\Encoding;
 5 | 
 6 | use JsonException;
 7 | use Lcobucci\JWT\Decoder;
 8 | use Lcobucci\JWT\Encoder;
 9 | use Lcobucci\JWT\SodiumBase64Polyfill;
10 | 
11 | use function json_decode;
12 | use function json_encode;
13 | 
14 | use const JSON_THROW_ON_ERROR;
15 | use const JSON_UNESCAPED_SLASHES;
16 | use const JSON_UNESCAPED_UNICODE;
17 | 
18 | /**
19 |  * A utilitarian class that encodes and decodes data according to JOSE specifications
20 |  */
21 | final readonly class JoseEncoder implements Encoder, Decoder
22 | {
23 |     public function jsonEncode(mixed $data): string
24 |     {
25 |         try {
26 |             return json_encode($data, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE | JSON_THROW_ON_ERROR);
27 |         } catch (JsonException $exception) {
28 |             throw CannotEncodeContent::jsonIssues($exception);
29 |         }
30 |     }
31 | 
32 |     public function jsonDecode(string $json): mixed
33 |     {
34 |         try {
35 |             return json_decode(json: $json, associative: true, flags: JSON_THROW_ON_ERROR);
36 |         } catch (JsonException $exception) {
37 |             throw CannotDecodeContent::jsonIssues($exception);
38 |         }
39 |     }
40 | 
41 |     public function base64UrlEncode(string $data): string
42 |     {
43 |         return SodiumBase64Polyfill::bin2base64(
44 |             $data,
45 |             SodiumBase64Polyfill::SODIUM_BASE64_VARIANT_URLSAFE_NO_PADDING,
46 |         );
47 |     }
48 | 
49 |     public function base64UrlDecode(string $data): string
50 |     {
51 |         return SodiumBase64Polyfill::base642bin(
52 |             $data,
53 |             SodiumBase64Polyfill::SODIUM_BASE64_VARIANT_URLSAFE_NO_PADDING,
54 |         );
55 |     }
56 | }
57 | 


--------------------------------------------------------------------------------
/src/Encoding/MicrosecondBasedDateConversion.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT\Encoding;
 5 | 
 6 | use DateTimeImmutable;
 7 | use Lcobucci\JWT\ClaimsFormatter;
 8 | use Lcobucci\JWT\Token\RegisteredClaims;
 9 | 
10 | use function array_key_exists;
11 | 
12 | final readonly class MicrosecondBasedDateConversion implements ClaimsFormatter
13 | {
14 |     /** @inheritdoc */
15 |     public function formatClaims(array $claims): array
16 |     {
17 |         foreach (RegisteredClaims::DATE_CLAIMS as $claim) {
18 |             if (! array_key_exists($claim, $claims)) {
19 |                 continue;
20 |             }
21 | 
22 |             $claims[$claim] = $this->convertDate($claims[$claim]);
23 |         }
24 | 
25 |         return $claims;
26 |     }
27 | 
28 |     private function convertDate(DateTimeImmutable $date): int|float
29 |     {
30 |         if ($date->format('u') === '000000') {
31 |             return (int) $date->format('U');
32 |         }
33 | 
34 |         return (float) $date->format('U.u');
35 |     }
36 | }
37 | 


--------------------------------------------------------------------------------
/src/Encoding/UnifyAudience.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT\Encoding;
 5 | 
 6 | use Lcobucci\JWT\ClaimsFormatter;
 7 | use Lcobucci\JWT\Token\RegisteredClaims;
 8 | 
 9 | use function array_key_exists;
10 | use function count;
11 | use function current;
12 | 
13 | final readonly class UnifyAudience implements ClaimsFormatter
14 | {
15 |     /** @inheritdoc */
16 |     public function formatClaims(array $claims): array
17 |     {
18 |         if (
19 |             ! array_key_exists(RegisteredClaims::AUDIENCE, $claims)
20 |             || count($claims[RegisteredClaims::AUDIENCE]) !== 1
21 |         ) {
22 |             return $claims;
23 |         }
24 | 
25 |         $claims[RegisteredClaims::AUDIENCE] = current($claims[RegisteredClaims::AUDIENCE]);
26 | 
27 |         return $claims;
28 |     }
29 | }
30 | 


--------------------------------------------------------------------------------
/src/Encoding/UnixTimestampDates.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT\Encoding;
 5 | 
 6 | use DateTimeImmutable;
 7 | use Lcobucci\JWT\ClaimsFormatter;
 8 | use Lcobucci\JWT\Token\RegisteredClaims;
 9 | 
10 | use function array_key_exists;
11 | 
12 | final readonly class UnixTimestampDates implements ClaimsFormatter
13 | {
14 |     /** @inheritdoc */
15 |     public function formatClaims(array $claims): array
16 |     {
17 |         foreach (RegisteredClaims::DATE_CLAIMS as $claim) {
18 |             if (! array_key_exists($claim, $claims)) {
19 |                 continue;
20 |             }
21 | 
22 |             $claims[$claim] = $this->convertDate($claims[$claim]);
23 |         }
24 | 
25 |         return $claims;
26 |     }
27 | 
28 |     private function convertDate(DateTimeImmutable $date): int
29 |     {
30 |         return $date->getTimestamp();
31 |     }
32 | }
33 | 


--------------------------------------------------------------------------------
/src/Exception.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT;
 5 | 
 6 | use Throwable;
 7 | 
 8 | interface Exception extends Throwable
 9 | {
10 | }
11 | 


--------------------------------------------------------------------------------
/src/JwtFacade.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT;
 5 | 
 6 | use Closure;
 7 | use DateTimeImmutable;
 8 | use Lcobucci\JWT\Encoding\ChainedFormatter;
 9 | use Lcobucci\JWT\Encoding\JoseEncoder;
10 | use Lcobucci\JWT\Signer\Key;
11 | use Lcobucci\JWT\Validation\Constraint;
12 | use Lcobucci\JWT\Validation\SignedWith;
13 | use Lcobucci\JWT\Validation\ValidAt;
14 | use Lcobucci\JWT\Validation\Validator;
15 | use Psr\Clock\ClockInterface as Clock;
16 | 
17 | use function assert;
18 | 
19 | final readonly class JwtFacade
20 | {
21 |     private Clock $clock;
22 | 
23 |     public function __construct(
24 |         private Parser $parser = new Token\Parser(new JoseEncoder()),
25 |         ?Clock $clock = null,
26 |     ) {
27 |         $this->clock = $clock ?? new class implements Clock {
28 |             public function now(): DateTimeImmutable
29 |             {
30 |                 return new DateTimeImmutable();
31 |             }
32 |         };
33 |     }
34 | 
35 |     /** @param Closure(Builder, DateTimeImmutable):Builder $customiseBuilder */
36 |     public function issue(
37 |         Signer $signer,
38 |         Key $signingKey,
39 |         Closure $customiseBuilder,
40 |     ): UnencryptedToken {
41 |         $builder = Token\Builder::new(new JoseEncoder(), ChainedFormatter::withUnixTimestampDates());
42 | 
43 |         $now     = $this->clock->now();
44 |         $builder = $builder
45 |             ->issuedAt($now)
46 |             ->canOnlyBeUsedAfter($now)
47 |             ->expiresAt($now->modify('+5 minutes'));
48 | 
49 |         return $customiseBuilder($builder, $now)->getToken($signer, $signingKey);
50 |     }
51 | 
52 |     /** @param non-empty-string $jwt */
53 |     public function parse(
54 |         string $jwt,
55 |         SignedWith $signedWith,
56 |         ValidAt $validAt,
57 |         Constraint ...$constraints,
58 |     ): UnencryptedToken {
59 |         $token = $this->parser->parse($jwt);
60 |         assert($token instanceof UnencryptedToken);
61 | 
62 |         (new Validator())->assert(
63 |             $token,
64 |             $signedWith,
65 |             $validAt,
66 |             ...$constraints,
67 |         );
68 | 
69 |         return $token;
70 |     }
71 | }
72 | 


--------------------------------------------------------------------------------
/src/Parser.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT;
 5 | 
 6 | use Lcobucci\JWT\Encoding\CannotDecodeContent;
 7 | use Lcobucci\JWT\Token\InvalidTokenStructure;
 8 | use Lcobucci\JWT\Token\UnsupportedHeaderFound;
 9 | 
10 | interface Parser
11 | {
12 |     /**
13 |      * Parses the JWT and returns a token
14 |      *
15 |      * @param non-empty-string $jwt
16 |      *
17 |      * @throws CannotDecodeContent      When something goes wrong while decoding.
18 |      * @throws InvalidTokenStructure    When token string structure is invalid.
19 |      * @throws UnsupportedHeaderFound   When parsed token has an unsupported header.
20 |      */
21 |     public function parse(string $jwt): Token;
22 | }
23 | 


--------------------------------------------------------------------------------
/src/Signer.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT;
 5 | 
 6 | use Lcobucci\JWT\Signer\CannotSignPayload;
 7 | use Lcobucci\JWT\Signer\Ecdsa\ConversionFailed;
 8 | use Lcobucci\JWT\Signer\InvalidKeyProvided;
 9 | use Lcobucci\JWT\Signer\Key;
10 | 
11 | interface Signer
12 | {
13 |     /**
14 |      * Returns the algorithm id
15 |      *
16 |      * @return non-empty-string
17 |      */
18 |     public function algorithmId(): string;
19 | 
20 |     /**
21 |      * Creates a hash for the given payload
22 |      *
23 |      * @param non-empty-string $payload
24 |      *
25 |      * @return non-empty-string
26 |      *
27 |      * @throws CannotSignPayload  When payload signing fails.
28 |      * @throws InvalidKeyProvided When issue key is invalid/incompatible.
29 |      * @throws ConversionFailed   When signature could not be converted.
30 |      */
31 |     public function sign(string $payload, Key $key): string;
32 | 
33 |     /**
34 |      * Returns if the expected hash matches with the data and key
35 |      *
36 |      * @param non-empty-string $expected
37 |      * @param non-empty-string $payload
38 |      *
39 |      * @throws InvalidKeyProvided When issue key is invalid/incompatible.
40 |      * @throws ConversionFailed   When signature could not be converted.
41 |      */
42 |     public function verify(string $expected, string $payload, Key $key): bool;
43 | }
44 | 


--------------------------------------------------------------------------------
/src/Signer/Blake2b.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT\Signer;
 5 | 
 6 | use Lcobucci\JWT\Signer;
 7 | 
 8 | use function hash_equals;
 9 | use function sodium_crypto_generichash;
10 | use function strlen;
11 | 
12 | final readonly class Blake2b implements Signer
13 | {
14 |     private const MINIMUM_KEY_LENGTH_IN_BITS = 256;
15 | 
16 |     public function algorithmId(): string
17 |     {
18 |         return 'BLAKE2B';
19 |     }
20 | 
21 |     public function sign(string $payload, Key $key): string
22 |     {
23 |         $actualKeyLength = 8 * strlen($key->contents());
24 | 
25 |         if ($actualKeyLength < self::MINIMUM_KEY_LENGTH_IN_BITS) {
26 |             throw InvalidKeyProvided::tooShort(self::MINIMUM_KEY_LENGTH_IN_BITS, $actualKeyLength);
27 |         }
28 | 
29 |         return sodium_crypto_generichash($payload, $key->contents());
30 |     }
31 | 
32 |     public function verify(string $expected, string $payload, Key $key): bool
33 |     {
34 |         return hash_equals($expected, $this->sign($payload, $key));
35 |     }
36 | }
37 | 


--------------------------------------------------------------------------------
/src/Signer/CannotSignPayload.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT\Signer;
 5 | 
 6 | use InvalidArgumentException;
 7 | use Lcobucci\JWT\Exception;
 8 | 
 9 | final class CannotSignPayload extends InvalidArgumentException implements Exception
10 | {
11 |     public static function errorHappened(string $error): self
12 |     {
13 |         return new self('There was an error while creating the signature:' . $error);
14 |     }
15 | }
16 | 


--------------------------------------------------------------------------------
/src/Signer/Ecdsa.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT\Signer;
 5 | 
 6 | use Lcobucci\JWT\Signer\Ecdsa\MultibyteStringConverter;
 7 | use Lcobucci\JWT\Signer\Ecdsa\SignatureConverter;
 8 | 
 9 | use const OPENSSL_KEYTYPE_EC;
10 | 
11 | abstract readonly class Ecdsa extends OpenSSL
12 | {
13 |     public function __construct(
14 |         private SignatureConverter $converter = new MultibyteStringConverter(),
15 |     ) {
16 |     }
17 | 
18 |     final public function sign(string $payload, Key $key): string
19 |     {
20 |         return $this->converter->fromAsn1(
21 |             $this->createSignature($key, $payload),
22 |             $this->pointLength(),
23 |         );
24 |     }
25 | 
26 |     final public function verify(string $expected, string $payload, Key $key): bool
27 |     {
28 |         return $this->verifySignature(
29 |             $this->converter->toAsn1($expected, $this->pointLength()),
30 |             $payload,
31 |             $key,
32 |         );
33 |     }
34 | 
35 |     /** {@inheritDoc} */
36 |     final protected function guardAgainstIncompatibleKey(int $type, int $lengthInBits): void
37 |     {
38 |         if ($type !== OPENSSL_KEYTYPE_EC) {
39 |             throw InvalidKeyProvided::incompatibleKeyType(
40 |                 self::KEY_TYPE_MAP[OPENSSL_KEYTYPE_EC],
41 |                 self::KEY_TYPE_MAP[$type],
42 |             );
43 |         }
44 | 
45 |         $expectedKeyLength = $this->expectedKeyLength();
46 | 
47 |         if ($lengthInBits !== $expectedKeyLength) {
48 |             throw InvalidKeyProvided::incompatibleKeyLength($expectedKeyLength, $lengthInBits);
49 |         }
50 |     }
51 | 
52 |     /**
53 |      * @internal
54 |      *
55 |      * @return positive-int
56 |      */
57 |     abstract public function expectedKeyLength(): int;
58 | 
59 |     /**
60 |      * Returns the length of each point in the signature, so that we can calculate and verify R and S points properly
61 |      *
62 |      * @internal
63 |      *
64 |      * @return positive-int
65 |      */
66 |     abstract public function pointLength(): int;
67 | }
68 | 


--------------------------------------------------------------------------------
/src/Signer/Ecdsa/ConversionFailed.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT\Signer\Ecdsa;
 5 | 
 6 | use InvalidArgumentException;
 7 | use Lcobucci\JWT\Exception;
 8 | 
 9 | final class ConversionFailed extends InvalidArgumentException implements Exception
10 | {
11 |     public static function invalidLength(): self
12 |     {
13 |         return new self('Invalid signature length.');
14 |     }
15 | 
16 |     public static function incorrectStartSequence(): self
17 |     {
18 |         return new self('Invalid data. Should start with a sequence.');
19 |     }
20 | 
21 |     public static function integerExpected(): self
22 |     {
23 |         return new self('Invalid data. Should contain an integer.');
24 |     }
25 | }
26 | 


--------------------------------------------------------------------------------
/src/Signer/Ecdsa/MultibyteStringConverter.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | declare(strict_types=1);
  3 | 
  4 | /*
  5 |  * The MIT License (MIT)
  6 |  *
  7 |  * Copyright (c) 2014-2018 Spomky-Labs
  8 |  *
  9 |  * This software may be modified and distributed under the terms
 10 |  * of the MIT license.  See the LICENSE file for details.
 11 |  *
 12 |  * @link https://github.com/web-token/jwt-framework/blob/v1.2/src/Component/Core/Util/ECSignature.php
 13 |  */
 14 | 
 15 | namespace Lcobucci\JWT\Signer\Ecdsa;
 16 | 
 17 | use function assert;
 18 | use function bin2hex;
 19 | use function dechex;
 20 | use function hex2bin;
 21 | use function hexdec;
 22 | use function is_string;
 23 | use function str_pad;
 24 | use function strlen;
 25 | use function substr;
 26 | 
 27 | use const STR_PAD_LEFT;
 28 | 
 29 | /**
 30 |  * ECDSA signature converter using ext-mbstring
 31 |  *
 32 |  * @internal
 33 |  */
 34 | final readonly class MultibyteStringConverter implements SignatureConverter
 35 | {
 36 |     private const ASN1_SEQUENCE          = '30';
 37 |     private const ASN1_INTEGER           = '02';
 38 |     private const ASN1_MAX_SINGLE_BYTE   = 128;
 39 |     private const ASN1_LENGTH_2BYTES     = '81';
 40 |     private const ASN1_BIG_INTEGER_LIMIT = '7f';
 41 |     private const ASN1_NEGATIVE_INTEGER  = '00';
 42 |     private const BYTE_SIZE              = 2;
 43 | 
 44 |     public function toAsn1(string $points, int $length): string
 45 |     {
 46 |         $points = bin2hex($points);
 47 | 
 48 |         if (self::octetLength($points) !== $length) {
 49 |             throw ConversionFailed::invalidLength();
 50 |         }
 51 | 
 52 |         $pointR = self::preparePositiveInteger(substr($points, 0, $length));
 53 |         $pointS = self::preparePositiveInteger(substr($points, $length, null));
 54 | 
 55 |         $lengthR = self::octetLength($pointR);
 56 |         $lengthS = self::octetLength($pointS);
 57 | 
 58 |         $totalLength  = $lengthR + $lengthS + self::BYTE_SIZE + self::BYTE_SIZE;
 59 |         $lengthPrefix = $totalLength > self::ASN1_MAX_SINGLE_BYTE ? self::ASN1_LENGTH_2BYTES : '';
 60 | 
 61 |         $asn1 = hex2bin(
 62 |             self::ASN1_SEQUENCE
 63 |             . $lengthPrefix . dechex($totalLength)
 64 |             . self::ASN1_INTEGER . dechex($lengthR) . $pointR
 65 |             . self::ASN1_INTEGER . dechex($lengthS) . $pointS,
 66 |         );
 67 |         assert(is_string($asn1));
 68 |         assert($asn1 !== '');
 69 | 
 70 |         return $asn1;
 71 |     }
 72 | 
 73 |     private static function octetLength(string $data): int
 74 |     {
 75 |         return (int) (strlen($data) / self::BYTE_SIZE);
 76 |     }
 77 | 
 78 |     private static function preparePositiveInteger(string $data): string
 79 |     {
 80 |         if (substr($data, 0, self::BYTE_SIZE) > self::ASN1_BIG_INTEGER_LIMIT) {
 81 |             return self::ASN1_NEGATIVE_INTEGER . $data;
 82 |         }
 83 | 
 84 |         while (
 85 |             substr($data, 0, self::BYTE_SIZE) === self::ASN1_NEGATIVE_INTEGER
 86 |             && substr($data, 2, self::BYTE_SIZE) <= self::ASN1_BIG_INTEGER_LIMIT
 87 |         ) {
 88 |             $data = substr($data, 2, null);
 89 |         }
 90 | 
 91 |         return $data;
 92 |     }
 93 | 
 94 |     public function fromAsn1(string $signature, int $length): string
 95 |     {
 96 |         $message  = bin2hex($signature);
 97 |         $position = 0;
 98 | 
 99 |         if (self::readAsn1Content($message, $position, self::BYTE_SIZE) !== self::ASN1_SEQUENCE) {
100 |             throw ConversionFailed::incorrectStartSequence();
101 |         }
102 | 
103 |         // @phpstan-ignore-next-line
104 |         if (self::readAsn1Content($message, $position, self::BYTE_SIZE) === self::ASN1_LENGTH_2BYTES) {
105 |             $position += self::BYTE_SIZE;
106 |         }
107 | 
108 |         $pointR = self::retrievePositiveInteger(self::readAsn1Integer($message, $position));
109 |         $pointS = self::retrievePositiveInteger(self::readAsn1Integer($message, $position));
110 | 
111 |         $points = hex2bin(str_pad($pointR, $length, '0', STR_PAD_LEFT) . str_pad($pointS, $length, '0', STR_PAD_LEFT));
112 |         assert(is_string($points));
113 |         assert($points !== '');
114 | 
115 |         return $points;
116 |     }
117 | 
118 |     private static function readAsn1Content(string $message, int &$position, int $length): string
119 |     {
120 |         $content   = substr($message, $position, $length);
121 |         $position += $length;
122 | 
123 |         return $content;
124 |     }
125 | 
126 |     private static function readAsn1Integer(string $message, int &$position): string
127 |     {
128 |         if (self::readAsn1Content($message, $position, self::BYTE_SIZE) !== self::ASN1_INTEGER) {
129 |             throw ConversionFailed::integerExpected();
130 |         }
131 | 
132 |         $length = (int) hexdec(self::readAsn1Content($message, $position, self::BYTE_SIZE));
133 | 
134 |         return self::readAsn1Content($message, $position, $length * self::BYTE_SIZE);
135 |     }
136 | 
137 |     private static function retrievePositiveInteger(string $data): string
138 |     {
139 |         while (
140 |             substr($data, 0, self::BYTE_SIZE) === self::ASN1_NEGATIVE_INTEGER
141 |             && substr($data, 2, self::BYTE_SIZE) > self::ASN1_BIG_INTEGER_LIMIT
142 |         ) {
143 |             $data = substr($data, 2, null);
144 |         }
145 | 
146 |         return $data;
147 |     }
148 | }
149 | 


--------------------------------------------------------------------------------
/src/Signer/Ecdsa/Sha256.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT\Signer\Ecdsa;
 5 | 
 6 | use Lcobucci\JWT\Signer\Ecdsa;
 7 | 
 8 | use const OPENSSL_ALGO_SHA256;
 9 | 
10 | final readonly class Sha256 extends Ecdsa
11 | {
12 |     public function algorithmId(): string
13 |     {
14 |         return 'ES256';
15 |     }
16 | 
17 |     public function algorithm(): int
18 |     {
19 |         return OPENSSL_ALGO_SHA256;
20 |     }
21 | 
22 |     public function pointLength(): int
23 |     {
24 |         return 64;
25 |     }
26 | 
27 |     public function expectedKeyLength(): int
28 |     {
29 |         return 256;
30 |     }
31 | }
32 | 


--------------------------------------------------------------------------------
/src/Signer/Ecdsa/Sha384.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT\Signer\Ecdsa;
 5 | 
 6 | use Lcobucci\JWT\Signer\Ecdsa;
 7 | 
 8 | use const OPENSSL_ALGO_SHA384;
 9 | 
10 | final readonly class Sha384 extends Ecdsa
11 | {
12 |     public function algorithmId(): string
13 |     {
14 |         return 'ES384';
15 |     }
16 | 
17 |     public function algorithm(): int
18 |     {
19 |         return OPENSSL_ALGO_SHA384;
20 |     }
21 | 
22 |     public function pointLength(): int
23 |     {
24 |         return 96;
25 |     }
26 | 
27 |     public function expectedKeyLength(): int
28 |     {
29 |         return 384;
30 |     }
31 | }
32 | 


--------------------------------------------------------------------------------
/src/Signer/Ecdsa/Sha512.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT\Signer\Ecdsa;
 5 | 
 6 | use Lcobucci\JWT\Signer\Ecdsa;
 7 | 
 8 | use const OPENSSL_ALGO_SHA512;
 9 | 
10 | final readonly class Sha512 extends Ecdsa
11 | {
12 |     public function algorithmId(): string
13 |     {
14 |         return 'ES512';
15 |     }
16 | 
17 |     public function algorithm(): int
18 |     {
19 |         return OPENSSL_ALGO_SHA512;
20 |     }
21 | 
22 |     public function pointLength(): int
23 |     {
24 |         return 132;
25 |     }
26 | 
27 |     public function expectedKeyLength(): int
28 |     {
29 |         // ES512 means ECDSA using P-521 and SHA-512.
30 |         // The key size is indeed 521 bits.
31 |         return 521;
32 |     }
33 | }
34 | 


--------------------------------------------------------------------------------
/src/Signer/Ecdsa/SignatureConverter.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT\Signer\Ecdsa;
 5 | 
 6 | /**
 7 |  * Manipulates the result of a ECDSA signature (points R and S) according to the
 8 |  * JWA specs.
 9 |  *
10 |  * OpenSSL creates a signature using the ASN.1 format and, according the JWA specs,
11 |  * the signature for JWTs must be the concatenated values of points R and S (in
12 |  * big-endian octet order).
13 |  *
14 |  * @internal
15 |  *
16 |  * @see https://tools.ietf.org/html/rfc7518#page-9
17 |  * @see https://en.wikipedia.org/wiki/Abstract_Syntax_Notation_One
18 |  */
19 | interface SignatureConverter
20 | {
21 |     /**
22 |      * Converts the signature generated by OpenSSL into what JWA defines
23 |      *
24 |      * @return non-empty-string
25 |      *
26 |      * @throws ConversionFailed When there was an issue during the format conversion.
27 |      */
28 |     public function fromAsn1(string $signature, int $length): string;
29 | 
30 |     /**
31 |      * Converts the JWA signature into something OpenSSL understands
32 |      *
33 |      * @param non-empty-string $points
34 |      *
35 |      * @return non-empty-string
36 |      *
37 |      * @throws ConversionFailed When there was an issue during the format conversion.
38 |      */
39 |     public function toAsn1(string $points, int $length): string;
40 | }
41 | 


--------------------------------------------------------------------------------
/src/Signer/Eddsa.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT\Signer;
 5 | 
 6 | use Lcobucci\JWT\Signer;
 7 | use SodiumException;
 8 | 
 9 | use function sodium_crypto_sign_detached;
10 | use function sodium_crypto_sign_verify_detached;
11 | 
12 | final readonly class Eddsa implements Signer
13 | {
14 |     public function algorithmId(): string
15 |     {
16 |         return 'EdDSA';
17 |     }
18 | 
19 |     public function sign(string $payload, Key $key): string
20 |     {
21 |         try {
22 |             return sodium_crypto_sign_detached($payload, $key->contents());
23 |         } catch (SodiumException $sodiumException) {
24 |             throw new InvalidKeyProvided($sodiumException->getMessage(), 0, $sodiumException);
25 |         }
26 |     }
27 | 
28 |     public function verify(string $expected, string $payload, Key $key): bool
29 |     {
30 |         try {
31 |             return sodium_crypto_sign_verify_detached($expected, $payload, $key->contents());
32 |         } catch (SodiumException $sodiumException) {
33 |             throw new InvalidKeyProvided($sodiumException->getMessage(), 0, $sodiumException);
34 |         }
35 |     }
36 | }
37 | 


--------------------------------------------------------------------------------
/src/Signer/Hmac.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT\Signer;
 5 | 
 6 | use Lcobucci\JWT\Signer;
 7 | 
 8 | use function hash_equals;
 9 | use function hash_hmac;
10 | use function strlen;
11 | 
12 | abstract readonly class Hmac implements Signer
13 | {
14 |     final public function sign(string $payload, Key $key): string
15 |     {
16 |         $actualKeyLength   = 8 * strlen($key->contents());
17 |         $expectedKeyLength = $this->minimumBitsLengthForKey();
18 | 
19 |         if ($actualKeyLength < $expectedKeyLength) {
20 |             throw InvalidKeyProvided::tooShort($expectedKeyLength, $actualKeyLength);
21 |         }
22 | 
23 |         return hash_hmac($this->algorithm(), $payload, $key->contents(), true);
24 |     }
25 | 
26 |     final public function verify(string $expected, string $payload, Key $key): bool
27 |     {
28 |         return hash_equals($expected, $this->sign($payload, $key));
29 |     }
30 | 
31 |     /**
32 |      * @internal
33 |      *
34 |      * @return non-empty-string
35 |      */
36 |     abstract public function algorithm(): string;
37 | 
38 |     /**
39 |      * @internal
40 |      *
41 |      * @return positive-int
42 |      */
43 |     abstract public function minimumBitsLengthForKey(): int;
44 | }
45 | 


--------------------------------------------------------------------------------
/src/Signer/Hmac/Sha256.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT\Signer\Hmac;
 5 | 
 6 | use Lcobucci\JWT\Signer\Hmac;
 7 | 
 8 | final readonly class Sha256 extends Hmac
 9 | {
10 |     public function algorithmId(): string
11 |     {
12 |         return 'HS256';
13 |     }
14 | 
15 |     public function algorithm(): string
16 |     {
17 |         return 'sha256';
18 |     }
19 | 
20 |     public function minimumBitsLengthForKey(): int
21 |     {
22 |         return 256;
23 |     }
24 | }
25 | 


--------------------------------------------------------------------------------
/src/Signer/Hmac/Sha384.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT\Signer\Hmac;
 5 | 
 6 | use Lcobucci\JWT\Signer\Hmac;
 7 | 
 8 | final readonly class Sha384 extends Hmac
 9 | {
10 |     public function algorithmId(): string
11 |     {
12 |         return 'HS384';
13 |     }
14 | 
15 |     public function algorithm(): string
16 |     {
17 |         return 'sha384';
18 |     }
19 | 
20 |     public function minimumBitsLengthForKey(): int
21 |     {
22 |         return 384;
23 |     }
24 | }
25 | 


--------------------------------------------------------------------------------
/src/Signer/Hmac/Sha512.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT\Signer\Hmac;
 5 | 
 6 | use Lcobucci\JWT\Signer\Hmac;
 7 | 
 8 | final readonly class Sha512 extends Hmac
 9 | {
10 |     public function algorithmId(): string
11 |     {
12 |         return 'HS512';
13 |     }
14 | 
15 |     public function algorithm(): string
16 |     {
17 |         return 'sha512';
18 |     }
19 | 
20 |     public function minimumBitsLengthForKey(): int
21 |     {
22 |         return 512;
23 |     }
24 | }
25 | 


--------------------------------------------------------------------------------
/src/Signer/InvalidKeyProvided.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT\Signer;
 5 | 
 6 | use InvalidArgumentException;
 7 | use Lcobucci\JWT\Exception;
 8 | 
 9 | final class InvalidKeyProvided extends InvalidArgumentException implements Exception
10 | {
11 |     public static function cannotBeParsed(string $details): self
12 |     {
13 |         return new self('It was not possible to parse your key, reason:' . $details);
14 |     }
15 | 
16 |     /**
17 |      * @param non-empty-string $expectedType
18 |      * @param non-empty-string $actualType
19 |      */
20 |     public static function incompatibleKeyType(string $expectedType, string $actualType): self
21 |     {
22 |         return new self(
23 |             'The type of the provided key is not "' . $expectedType
24 |             . '", "' . $actualType . '" provided',
25 |         );
26 |     }
27 | 
28 |     /** @param positive-int $expectedLength */
29 |     public static function incompatibleKeyLength(int $expectedLength, int $actualLength): self
30 |     {
31 |         return new self(
32 |             'The length of the provided key is different than ' . $expectedLength . ' bits, '
33 |             . $actualLength . ' bits provided',
34 |         );
35 |     }
36 | 
37 |     public static function cannotBeEmpty(): self
38 |     {
39 |         return new self('Key cannot be empty');
40 |     }
41 | 
42 |     public static function tooShort(int $expectedLength, int $actualLength): self
43 |     {
44 |         return new self('Key provided is shorter than ' . $expectedLength . ' bits,'
45 |             . ' only ' . $actualLength . ' bits provided');
46 |     }
47 | }
48 | 


--------------------------------------------------------------------------------
/src/Signer/Key.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT\Signer;
 5 | 
 6 | interface Key
 7 | {
 8 |     /** @return non-empty-string */
 9 |     public function contents(): string;
10 | 
11 |     public function passphrase(): string;
12 | }
13 | 


--------------------------------------------------------------------------------
/src/Signer/Key/FileCouldNotBeRead.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT\Signer\Key;
 5 | 
 6 | use InvalidArgumentException;
 7 | use Lcobucci\JWT\Exception;
 8 | use Throwable;
 9 | 
10 | final class FileCouldNotBeRead extends InvalidArgumentException implements Exception
11 | {
12 |     /** @param non-empty-string $path */
13 |     public static function onPath(string $path, ?Throwable $cause = null): self
14 |     {
15 |         return new self(
16 |             message: 'The path "' . $path . '" does not contain a valid key file',
17 |             previous: $cause,
18 |         );
19 |     }
20 | }
21 | 


--------------------------------------------------------------------------------
/src/Signer/Key/InMemory.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT\Signer\Key;
 5 | 
 6 | use Lcobucci\JWT\Signer\InvalidKeyProvided;
 7 | use Lcobucci\JWT\Signer\Key;
 8 | use Lcobucci\JWT\SodiumBase64Polyfill;
 9 | use SensitiveParameter;
10 | use SplFileObject;
11 | use Throwable;
12 | 
13 | use function assert;
14 | use function is_string;
15 | 
16 | final readonly class InMemory implements Key
17 | {
18 |     /** @param non-empty-string $contents */
19 |     private function __construct(
20 |         #[SensitiveParameter]
21 |         public string $contents,
22 |         #[SensitiveParameter]
23 |         public string $passphrase,
24 |     ) {
25 |     }
26 | 
27 |     /** @param non-empty-string $contents */
28 |     public static function plainText(
29 |         #[SensitiveParameter]
30 |         string $contents,
31 |         #[SensitiveParameter]
32 |         string $passphrase = '',
33 |     ): self {
34 |         self::guardAgainstEmptyKey($contents); // @phpstan-ignore staticMethod.alreadyNarrowedType
35 | 
36 |         return new self($contents, $passphrase);
37 |     }
38 | 
39 |     /** @param non-empty-string $contents */
40 |     public static function base64Encoded(
41 |         #[SensitiveParameter]
42 |         string $contents,
43 |         #[SensitiveParameter]
44 |         string $passphrase = '',
45 |     ): self {
46 |         $decoded = SodiumBase64Polyfill::base642bin(
47 |             $contents,
48 |             SodiumBase64Polyfill::SODIUM_BASE64_VARIANT_ORIGINAL,
49 |         );
50 | 
51 |         self::guardAgainstEmptyKey($decoded); // @phpstan-ignore staticMethod.alreadyNarrowedType
52 | 
53 |         return new self($decoded, $passphrase);
54 |     }
55 | 
56 |     /**
57 |      * @param non-empty-string $path
58 |      *
59 |      * @throws FileCouldNotBeRead
60 |      */
61 |     public static function file(
62 |         string $path,
63 |         #[SensitiveParameter]
64 |         string $passphrase = '',
65 |     ): self {
66 |         try {
67 |             $file = new SplFileObject($path);
68 |         } catch (Throwable $exception) {
69 |             throw FileCouldNotBeRead::onPath($path, $exception);
70 |         }
71 | 
72 |         $fileSize = $file->getSize();
73 |         $contents = $fileSize > 0 ? $file->fread($file->getSize()) : '';
74 |         assert(is_string($contents));
75 | 
76 |         self::guardAgainstEmptyKey($contents);
77 | 
78 |         return new self($contents, $passphrase);
79 |     }
80 | 
81 |     /** @phpstan-assert non-empty-string $contents */
82 |     private static function guardAgainstEmptyKey(string $contents): void
83 |     {
84 |         if ($contents === '') {
85 |             throw InvalidKeyProvided::cannotBeEmpty();
86 |         }
87 |     }
88 | 
89 |     public function contents(): string
90 |     {
91 |         return $this->contents;
92 |     }
93 | 
94 |     public function passphrase(): string
95 |     {
96 |         return $this->passphrase;
97 |     }
98 | }
99 | 


--------------------------------------------------------------------------------
/src/Signer/OpenSSL.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | declare(strict_types=1);
  3 | 
  4 | namespace Lcobucci\JWT\Signer;
  5 | 
  6 | use Lcobucci\JWT\Signer;
  7 | use OpenSSLAsymmetricKey;
  8 | 
  9 | use function array_key_exists;
 10 | use function assert;
 11 | use function is_array;
 12 | use function is_bool;
 13 | use function is_int;
 14 | use function openssl_error_string;
 15 | use function openssl_pkey_get_details;
 16 | use function openssl_pkey_get_private;
 17 | use function openssl_pkey_get_public;
 18 | use function openssl_sign;
 19 | use function openssl_verify;
 20 | 
 21 | use const OPENSSL_KEYTYPE_DH;
 22 | use const OPENSSL_KEYTYPE_DSA;
 23 | use const OPENSSL_KEYTYPE_EC;
 24 | use const OPENSSL_KEYTYPE_RSA;
 25 | use const PHP_EOL;
 26 | 
 27 | abstract readonly class OpenSSL implements Signer
 28 | {
 29 |     protected const KEY_TYPE_MAP = [
 30 |         OPENSSL_KEYTYPE_RSA => 'RSA',
 31 |         OPENSSL_KEYTYPE_DSA => 'DSA',
 32 |         OPENSSL_KEYTYPE_DH => 'DH',
 33 |         OPENSSL_KEYTYPE_EC => 'EC',
 34 |     ];
 35 | 
 36 |     /**
 37 |      * @return non-empty-string
 38 |      *
 39 |      * @throws CannotSignPayload
 40 |      * @throws InvalidKeyProvided
 41 |      */
 42 |     final protected function createSignature(
 43 |         Key $key,
 44 |         string $payload,
 45 |     ): string {
 46 |         $opensslKey = $this->getPrivateKey($key);
 47 | 
 48 |         $signature = '';
 49 | 
 50 |         if (! openssl_sign($payload, $signature, $opensslKey, $this->algorithm())) {
 51 |             throw CannotSignPayload::errorHappened($this->fullOpenSSLErrorString());
 52 |         }
 53 | 
 54 |         return $signature;
 55 |     }
 56 | 
 57 |     /** @throws CannotSignPayload */
 58 |     private function getPrivateKey(
 59 |         Key $key,
 60 |     ): OpenSSLAsymmetricKey {
 61 |         return $this->validateKey(openssl_pkey_get_private($key->contents(), $key->passphrase()));
 62 |     }
 63 | 
 64 |     /** @throws InvalidKeyProvided */
 65 |     final protected function verifySignature(
 66 |         string $expected,
 67 |         string $payload,
 68 |         Key $key,
 69 |     ): bool {
 70 |         $opensslKey = $this->getPublicKey($key);
 71 |         $result     = openssl_verify($payload, $expected, $opensslKey, $this->algorithm());
 72 | 
 73 |         return $result === 1;
 74 |     }
 75 | 
 76 |     /** @throws InvalidKeyProvided */
 77 |     private function getPublicKey(Key $key): OpenSSLAsymmetricKey
 78 |     {
 79 |         return $this->validateKey(openssl_pkey_get_public($key->contents()));
 80 |     }
 81 | 
 82 |     /**
 83 |      * Raises an exception when the key type is not the expected type
 84 |      *
 85 |      * @throws InvalidKeyProvided
 86 |      */
 87 |     private function validateKey(OpenSSLAsymmetricKey|bool $key): OpenSSLAsymmetricKey
 88 |     {
 89 |         if (is_bool($key)) {
 90 |             throw InvalidKeyProvided::cannotBeParsed($this->fullOpenSSLErrorString());
 91 |         }
 92 | 
 93 |         $details = openssl_pkey_get_details($key);
 94 |         assert(is_array($details));
 95 | 
 96 |         assert(array_key_exists('bits', $details));
 97 |         assert(is_int($details['bits']));
 98 |         assert(array_key_exists('type', $details));
 99 |         assert(is_int($details['type']));
100 | 
101 |         $this->guardAgainstIncompatibleKey($details['type'], $details['bits']);
102 | 
103 |         return $key;
104 |     }
105 | 
106 |     private function fullOpenSSLErrorString(): string
107 |     {
108 |         $error = '';
109 | 
110 |         while ($msg = openssl_error_string()) {
111 |             $error .= PHP_EOL . '* ' . $msg;
112 |         }
113 | 
114 |         return $error;
115 |     }
116 | 
117 |     /** @throws InvalidKeyProvided */
118 |     abstract protected function guardAgainstIncompatibleKey(int $type, int $lengthInBits): void;
119 | 
120 |     /**
121 |      * Returns which algorithm to be used to create/verify the signature (using OpenSSL constants)
122 |      *
123 |      * @internal
124 |      */
125 |     abstract public function algorithm(): int;
126 | }
127 | 


--------------------------------------------------------------------------------
/src/Signer/Rsa.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT\Signer;
 5 | 
 6 | use const OPENSSL_KEYTYPE_RSA;
 7 | 
 8 | abstract readonly class Rsa extends OpenSSL
 9 | {
10 |     private const MINIMUM_KEY_LENGTH = 2048;
11 | 
12 |     final public function sign(string $payload, Key $key): string
13 |     {
14 |         return $this->createSignature($key, $payload);
15 |     }
16 | 
17 |     final public function verify(string $expected, string $payload, Key $key): bool
18 |     {
19 |         return $this->verifySignature($expected, $payload, $key);
20 |     }
21 | 
22 |     final protected function guardAgainstIncompatibleKey(int $type, int $lengthInBits): void
23 |     {
24 |         if ($type !== OPENSSL_KEYTYPE_RSA) {
25 |             throw InvalidKeyProvided::incompatibleKeyType(
26 |                 self::KEY_TYPE_MAP[OPENSSL_KEYTYPE_RSA],
27 |                 self::KEY_TYPE_MAP[$type],
28 |             );
29 |         }
30 | 
31 |         if ($lengthInBits < self::MINIMUM_KEY_LENGTH) {
32 |             throw InvalidKeyProvided::tooShort(self::MINIMUM_KEY_LENGTH, $lengthInBits);
33 |         }
34 |     }
35 | }
36 | 


--------------------------------------------------------------------------------
/src/Signer/Rsa/Sha256.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT\Signer\Rsa;
 5 | 
 6 | use Lcobucci\JWT\Signer\Rsa;
 7 | 
 8 | use const OPENSSL_ALGO_SHA256;
 9 | 
10 | final readonly class Sha256 extends Rsa
11 | {
12 |     public function algorithmId(): string
13 |     {
14 |         return 'RS256';
15 |     }
16 | 
17 |     public function algorithm(): int
18 |     {
19 |         return OPENSSL_ALGO_SHA256;
20 |     }
21 | }
22 | 


--------------------------------------------------------------------------------
/src/Signer/Rsa/Sha384.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT\Signer\Rsa;
 5 | 
 6 | use Lcobucci\JWT\Signer\Rsa;
 7 | 
 8 | use const OPENSSL_ALGO_SHA384;
 9 | 
10 | final readonly class Sha384 extends Rsa
11 | {
12 |     public function algorithmId(): string
13 |     {
14 |         return 'RS384';
15 |     }
16 | 
17 |     public function algorithm(): int
18 |     {
19 |         return OPENSSL_ALGO_SHA384;
20 |     }
21 | }
22 | 


--------------------------------------------------------------------------------
/src/Signer/Rsa/Sha512.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT\Signer\Rsa;
 5 | 
 6 | use Lcobucci\JWT\Signer\Rsa;
 7 | 
 8 | use const OPENSSL_ALGO_SHA512;
 9 | 
10 | final readonly class Sha512 extends Rsa
11 | {
12 |     public function algorithmId(): string
13 |     {
14 |         return 'RS512';
15 |     }
16 | 
17 |     public function algorithm(): int
18 |     {
19 |         return OPENSSL_ALGO_SHA512;
20 |     }
21 | }
22 | 


--------------------------------------------------------------------------------
/src/SodiumBase64Polyfill.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT;
 5 | 
 6 | use Lcobucci\JWT\Encoding\CannotDecodeContent;
 7 | use SodiumException;
 8 | 
 9 | use function base64_decode;
10 | use function base64_encode;
11 | use function function_exists;
12 | use function is_string;
13 | use function rtrim;
14 | use function sodium_base642bin;
15 | use function sodium_bin2base64;
16 | use function strtr;
17 | 
18 | /** @internal */
19 | final readonly class SodiumBase64Polyfill
20 | {
21 |     public const SODIUM_BASE64_VARIANT_ORIGINAL            = 1;
22 |     public const SODIUM_BASE64_VARIANT_ORIGINAL_NO_PADDING = 3;
23 |     public const SODIUM_BASE64_VARIANT_URLSAFE             = 5;
24 |     public const SODIUM_BASE64_VARIANT_URLSAFE_NO_PADDING  = 7;
25 | 
26 |     /** @return ($decoded is non-empty-string ? non-empty-string : string) */
27 |     public static function bin2base64(string $decoded, int $variant): string
28 |     {
29 |         if (! function_exists('sodium_bin2base64')) {
30 |             return self::bin2base64Fallback($decoded, $variant); // @codeCoverageIgnore
31 |         }
32 | 
33 |         return sodium_bin2base64($decoded, $variant);
34 |     }
35 | 
36 |     /** @return ($decoded is non-empty-string ? non-empty-string : string) */
37 |     public static function bin2base64Fallback(string $decoded, int $variant): string
38 |     {
39 |         $encoded = base64_encode($decoded);
40 | 
41 |         if (
42 |             $variant === self::SODIUM_BASE64_VARIANT_URLSAFE
43 |             || $variant === self::SODIUM_BASE64_VARIANT_URLSAFE_NO_PADDING
44 |         ) {
45 |             $encoded = strtr($encoded, '+/', '-_');
46 |         }
47 | 
48 |         if (
49 |             $variant === self::SODIUM_BASE64_VARIANT_ORIGINAL_NO_PADDING
50 |             || $variant === self::SODIUM_BASE64_VARIANT_URLSAFE_NO_PADDING
51 |         ) {
52 |             $encoded = rtrim($encoded, '=');
53 |         }
54 | 
55 |         return $encoded;
56 |     }
57 | 
58 |     /**
59 |      * @return ($encoded is non-empty-string ? non-empty-string : string)
60 |      *
61 |      * @throws CannotDecodeContent
62 |      */
63 |     public static function base642bin(string $encoded, int $variant): string
64 |     {
65 |         if (! function_exists('sodium_base642bin')) {
66 |             return self::base642binFallback($encoded, $variant); // @codeCoverageIgnore
67 |         }
68 | 
69 |         try {
70 |             return sodium_base642bin($encoded, $variant, '');
71 |         } catch (SodiumException) {
72 |             throw CannotDecodeContent::invalidBase64String();
73 |         }
74 |     }
75 | 
76 |     /**
77 |      * @return ($encoded is non-empty-string ? non-empty-string : string)
78 |      *
79 |      * @throws CannotDecodeContent
80 |      */
81 |     public static function base642binFallback(string $encoded, int $variant): string
82 |     {
83 |         if (
84 |             $variant === self::SODIUM_BASE64_VARIANT_URLSAFE
85 |             || $variant === self::SODIUM_BASE64_VARIANT_URLSAFE_NO_PADDING
86 |         ) {
87 |             $encoded = strtr($encoded, '-_', '+/');
88 |         }
89 | 
90 |         $decoded = base64_decode($encoded, true);
91 | 
92 |         if (! is_string($decoded)) {
93 |             throw CannotDecodeContent::invalidBase64String();
94 |         }
95 | 
96 |         return $decoded;
97 |     }
98 | }
99 | 


--------------------------------------------------------------------------------
/src/Token.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT;
 5 | 
 6 | use DateTimeInterface;
 7 | use Lcobucci\JWT\Token\DataSet;
 8 | 
 9 | interface Token
10 | {
11 |     /**
12 |      * Returns the token headers
13 |      */
14 |     public function headers(): DataSet;
15 | 
16 |     /**
17 |      * Returns if the token is allowed to be used by the audience
18 |      *
19 |      * @param non-empty-string $audience
20 |      */
21 |     public function isPermittedFor(string $audience): bool;
22 | 
23 |     /**
24 |      * Returns if the token has the given id
25 |      *
26 |      * @param non-empty-string $id
27 |      */
28 |     public function isIdentifiedBy(string $id): bool;
29 | 
30 |     /**
31 |      * Returns if the token has the given subject
32 |      *
33 |      * @param non-empty-string $subject
34 |      */
35 |     public function isRelatedTo(string $subject): bool;
36 | 
37 |     /**
38 |      * Returns if the token was issued by any of given issuers
39 |      *
40 |      * @param non-empty-string ...$issuers
41 |      */
42 |     public function hasBeenIssuedBy(string ...$issuers): bool;
43 | 
44 |     /**
45 |      * Returns if the token was issued before of given time
46 |      */
47 |     public function hasBeenIssuedBefore(DateTimeInterface $now): bool;
48 | 
49 |     /**
50 |      * Returns if the token minimum time is before than given time
51 |      */
52 |     public function isMinimumTimeBefore(DateTimeInterface $now): bool;
53 | 
54 |     /**
55 |      * Returns if the token is expired
56 |      */
57 |     public function isExpired(DateTimeInterface $now): bool;
58 | 
59 |     /**
60 |      * Returns an encoded representation of the token
61 |      *
62 |      * @return non-empty-string
63 |      */
64 |     public function toString(): string;
65 | }
66 | 


--------------------------------------------------------------------------------
/src/Token/Builder.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | declare(strict_types=1);
  3 | 
  4 | namespace Lcobucci\JWT\Token;
  5 | 
  6 | use DateTimeImmutable;
  7 | use Lcobucci\JWT\Builder as BuilderInterface;
  8 | use Lcobucci\JWT\ClaimsFormatter;
  9 | use Lcobucci\JWT\Encoder;
 10 | use Lcobucci\JWT\Encoding\CannotEncodeContent;
 11 | use Lcobucci\JWT\Signer;
 12 | use Lcobucci\JWT\Signer\Key;
 13 | use Lcobucci\JWT\UnencryptedToken;
 14 | 
 15 | use function array_diff;
 16 | use function array_merge;
 17 | use function in_array;
 18 | 
 19 | /** @immutable */
 20 | final readonly class Builder implements BuilderInterface
 21 | {
 22 |     /**
 23 |      * @param array<non-empty-string, mixed> $headers
 24 |      * @param array<non-empty-string, mixed> $claims
 25 |      */
 26 |     private function __construct(
 27 |         private Encoder $encoder,
 28 |         private ClaimsFormatter $claimFormatter,
 29 |         private array $headers = ['typ' => 'JWT', 'alg' => null],
 30 |         private array $claims = [],
 31 |     ) {
 32 |     }
 33 | 
 34 |     public static function new(Encoder $encoder, ClaimsFormatter $claimFormatter): self
 35 |     {
 36 |         return new self($encoder, $claimFormatter);
 37 |     }
 38 | 
 39 |     public function permittedFor(string ...$audiences): BuilderInterface
 40 |     {
 41 |         $configured = $this->claims[RegisteredClaims::AUDIENCE] ?? [];
 42 |         $toAppend   = array_diff($audiences, $configured);
 43 | 
 44 |         return $this->newWithClaim(RegisteredClaims::AUDIENCE, array_merge($configured, $toAppend));
 45 |     }
 46 | 
 47 |     public function expiresAt(DateTimeImmutable $expiration): BuilderInterface
 48 |     {
 49 |         return $this->newWithClaim(RegisteredClaims::EXPIRATION_TIME, $expiration);
 50 |     }
 51 | 
 52 |     public function identifiedBy(string $id): BuilderInterface
 53 |     {
 54 |         return $this->newWithClaim(RegisteredClaims::ID, $id);
 55 |     }
 56 | 
 57 |     public function issuedAt(DateTimeImmutable $issuedAt): BuilderInterface
 58 |     {
 59 |         return $this->newWithClaim(RegisteredClaims::ISSUED_AT, $issuedAt);
 60 |     }
 61 | 
 62 |     public function issuedBy(string $issuer): BuilderInterface
 63 |     {
 64 |         return $this->newWithClaim(RegisteredClaims::ISSUER, $issuer);
 65 |     }
 66 | 
 67 |     public function canOnlyBeUsedAfter(DateTimeImmutable $notBefore): BuilderInterface
 68 |     {
 69 |         return $this->newWithClaim(RegisteredClaims::NOT_BEFORE, $notBefore);
 70 |     }
 71 | 
 72 |     public function relatedTo(string $subject): BuilderInterface
 73 |     {
 74 |         return $this->newWithClaim(RegisteredClaims::SUBJECT, $subject);
 75 |     }
 76 | 
 77 |     public function withHeader(string $name, mixed $value): BuilderInterface
 78 |     {
 79 |         $headers        = $this->headers;
 80 |         $headers[$name] = $value;
 81 | 
 82 |         return new self(
 83 |             $this->encoder,
 84 |             $this->claimFormatter,
 85 |             $headers,
 86 |             $this->claims,
 87 |         );
 88 |     }
 89 | 
 90 |     public function withClaim(string $name, mixed $value): BuilderInterface
 91 |     {
 92 |         if (in_array($name, RegisteredClaims::ALL, true)) {
 93 |             throw RegisteredClaimGiven::forClaim($name);
 94 |         }
 95 | 
 96 |         return $this->newWithClaim($name, $value);
 97 |     }
 98 | 
 99 |     /** @param non-empty-string $name */
100 |     private function newWithClaim(string $name, mixed $value): BuilderInterface
101 |     {
102 |         $claims        = $this->claims;
103 |         $claims[$name] = $value;
104 | 
105 |         return new self(
106 |             $this->encoder,
107 |             $this->claimFormatter,
108 |             $this->headers,
109 |             $claims,
110 |         );
111 |     }
112 | 
113 |     /**
114 |      * @param array<non-empty-string, mixed> $items
115 |      *
116 |      * @throws CannotEncodeContent When data cannot be converted to JSON.
117 |      */
118 |     private function encode(array $items): string
119 |     {
120 |         return $this->encoder->base64UrlEncode(
121 |             $this->encoder->jsonEncode($items),
122 |         );
123 |     }
124 | 
125 |     public function getToken(Signer $signer, Key $key): UnencryptedToken
126 |     {
127 |         $headers        = $this->headers;
128 |         $headers['alg'] = $signer->algorithmId();
129 | 
130 |         $encodedHeaders = $this->encode($headers);
131 |         $encodedClaims  = $this->encode($this->claimFormatter->formatClaims($this->claims));
132 | 
133 |         $signature        = $signer->sign($encodedHeaders . '.' . $encodedClaims, $key);
134 |         $encodedSignature = $this->encoder->base64UrlEncode($signature);
135 | 
136 |         return new Plain(
137 |             new DataSet($headers, $encodedHeaders),
138 |             new DataSet($this->claims, $encodedClaims),
139 |             new Signature($signature, $encodedSignature),
140 |         );
141 |     }
142 | }
143 | 


--------------------------------------------------------------------------------
/src/Token/DataSet.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT\Token;
 5 | 
 6 | use function array_key_exists;
 7 | 
 8 | final readonly class DataSet
 9 | {
10 |     /** @param array<non-empty-string, mixed> $data */
11 |     public function __construct(private array $data, private string $encoded)
12 |     {
13 |     }
14 | 
15 |     /** @param non-empty-string $name */
16 |     public function get(string $name, mixed $default = null): mixed
17 |     {
18 |         return $this->data[$name] ?? $default;
19 |     }
20 | 
21 |     /** @param non-empty-string $name */
22 |     public function has(string $name): bool
23 |     {
24 |         return array_key_exists($name, $this->data);
25 |     }
26 | 
27 |     /** @return array<non-empty-string, mixed> */
28 |     public function all(): array
29 |     {
30 |         return $this->data;
31 |     }
32 | 
33 |     public function toString(): string
34 |     {
35 |         return $this->encoded;
36 |     }
37 | }
38 | 


--------------------------------------------------------------------------------
/src/Token/InvalidTokenStructure.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT\Token;
 5 | 
 6 | use InvalidArgumentException;
 7 | use Lcobucci\JWT\Exception;
 8 | 
 9 | final class InvalidTokenStructure extends InvalidArgumentException implements Exception
10 | {
11 |     public static function missingOrNotEnoughSeparators(): self
12 |     {
13 |         return new self('The JWT string must have two dots');
14 |     }
15 | 
16 |     public static function missingHeaderPart(): self
17 |     {
18 |         return new self('The JWT string is missing the Header part');
19 |     }
20 | 
21 |     public static function missingClaimsPart(): self
22 |     {
23 |         return new self('The JWT string is missing the Claim part');
24 |     }
25 | 
26 |     public static function missingSignaturePart(): self
27 |     {
28 |         return new self('The JWT string is missing the Signature part');
29 |     }
30 | 
31 |     /** @param non-empty-string $part */
32 |     public static function arrayExpected(string $part): self
33 |     {
34 |         return new self($part . ' must be an array with non-empty-string keys');
35 |     }
36 | 
37 |     public static function dateIsNotParseable(string $value): self
38 |     {
39 |         return new self('Value is not in the allowed date format: ' . $value);
40 |     }
41 | }
42 | 


--------------------------------------------------------------------------------
/src/Token/Parser.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | declare(strict_types=1);
  3 | 
  4 | namespace Lcobucci\JWT\Token;
  5 | 
  6 | use DateTimeImmutable;
  7 | use Lcobucci\JWT\Decoder;
  8 | use Lcobucci\JWT\Parser as ParserInterface;
  9 | use Lcobucci\JWT\Token as TokenInterface;
 10 | 
 11 | use function array_key_exists;
 12 | use function count;
 13 | use function explode;
 14 | use function is_array;
 15 | use function is_numeric;
 16 | use function number_format;
 17 | 
 18 | final readonly class Parser implements ParserInterface
 19 | {
 20 |     private const MICROSECOND_PRECISION = 6;
 21 | 
 22 |     public function __construct(private Decoder $decoder)
 23 |     {
 24 |     }
 25 | 
 26 |     public function parse(string $jwt): TokenInterface
 27 |     {
 28 |         [$encodedHeaders, $encodedClaims, $encodedSignature] = $this->splitJwt($jwt);
 29 | 
 30 |         if ($encodedHeaders === '') {
 31 |             throw InvalidTokenStructure::missingHeaderPart();
 32 |         }
 33 | 
 34 |         if ($encodedClaims === '') {
 35 |             throw InvalidTokenStructure::missingClaimsPart();
 36 |         }
 37 | 
 38 |         if ($encodedSignature === '') {
 39 |             throw InvalidTokenStructure::missingSignaturePart();
 40 |         }
 41 | 
 42 |         $header = $this->parseHeader($encodedHeaders);
 43 | 
 44 |         return new Plain(
 45 |             new DataSet($header, $encodedHeaders),
 46 |             new DataSet($this->parseClaims($encodedClaims), $encodedClaims),
 47 |             $this->parseSignature($encodedSignature),
 48 |         );
 49 |     }
 50 | 
 51 |     /**
 52 |      * Splits the JWT string into an array
 53 |      *
 54 |      * @param non-empty-string $jwt
 55 |      *
 56 |      * @return string[]
 57 |      *
 58 |      * @throws InvalidTokenStructure When JWT doesn't have all parts.
 59 |      */
 60 |     private function splitJwt(string $jwt): array
 61 |     {
 62 |         $data = explode('.', $jwt);
 63 | 
 64 |         if (count($data) !== 3) {
 65 |             throw InvalidTokenStructure::missingOrNotEnoughSeparators();
 66 |         }
 67 | 
 68 |         return $data;
 69 |     }
 70 | 
 71 |     /**
 72 |      * Parses the header from a string
 73 |      *
 74 |      * @param non-empty-string $data
 75 |      *
 76 |      * @return array<non-empty-string, mixed>
 77 |      *
 78 |      * @throws UnsupportedHeaderFound When an invalid header is informed.
 79 |      * @throws InvalidTokenStructure  When parsed content isn't an array.
 80 |      */
 81 |     private function parseHeader(string $data): array
 82 |     {
 83 |         $header = $this->decoder->jsonDecode($this->decoder->base64UrlDecode($data));
 84 | 
 85 |         if (! is_array($header)) {
 86 |             throw InvalidTokenStructure::arrayExpected('headers');
 87 |         }
 88 | 
 89 |         $this->guardAgainstEmptyStringKeys($header, 'headers');
 90 | 
 91 |         if (array_key_exists('enc', $header)) {
 92 |             throw UnsupportedHeaderFound::encryption();
 93 |         }
 94 | 
 95 |         if (! array_key_exists('typ', $header)) {
 96 |             $header['typ'] = 'JWT';
 97 |         }
 98 | 
 99 |         return $header;
100 |     }
101 | 
102 |     /**
103 |      * Parses the claim set from a string
104 |      *
105 |      * @param non-empty-string $data
106 |      *
107 |      * @return array<non-empty-string, mixed>
108 |      *
109 |      * @throws InvalidTokenStructure When parsed content isn't an array or contains non-parseable dates.
110 |      */
111 |     private function parseClaims(string $data): array
112 |     {
113 |         $claims = $this->decoder->jsonDecode($this->decoder->base64UrlDecode($data));
114 | 
115 |         if (! is_array($claims)) {
116 |             throw InvalidTokenStructure::arrayExpected('claims');
117 |         }
118 | 
119 |         $this->guardAgainstEmptyStringKeys($claims, 'claims');
120 | 
121 |         if (array_key_exists(RegisteredClaims::AUDIENCE, $claims)) {
122 |             $claims[RegisteredClaims::AUDIENCE] = (array) $claims[RegisteredClaims::AUDIENCE];
123 |         }
124 | 
125 |         foreach (RegisteredClaims::DATE_CLAIMS as $claim) {
126 |             if (! array_key_exists($claim, $claims)) {
127 |                 continue;
128 |             }
129 | 
130 |             $claims[$claim] = $this->convertDate($claims[$claim]);
131 |         }
132 | 
133 |         return $claims;
134 |     }
135 | 
136 |     /**
137 |      * @param array<string, mixed> $array
138 |      * @param non-empty-string     $part
139 |      *
140 |      * @phpstan-assert array<non-empty-string, mixed> $array
141 |      */
142 |     private function guardAgainstEmptyStringKeys(array $array, string $part): void
143 |     {
144 |         foreach ($array as $key => $value) {
145 |             if ($key === '') {
146 |                 throw InvalidTokenStructure::arrayExpected($part);
147 |             }
148 |         }
149 |     }
150 | 
151 |     /** @throws InvalidTokenStructure */
152 |     private function convertDate(int|float|string $timestamp): DateTimeImmutable
153 |     {
154 |         if (! is_numeric($timestamp)) {
155 |             throw InvalidTokenStructure::dateIsNotParseable($timestamp);
156 |         }
157 | 
158 |         $normalizedTimestamp = number_format((float) $timestamp, self::MICROSECOND_PRECISION, '.', '');
159 | 
160 |         $date = DateTimeImmutable::createFromFormat('U.u', $normalizedTimestamp);
161 | 
162 |         if ($date === false) {
163 |             throw InvalidTokenStructure::dateIsNotParseable($normalizedTimestamp);
164 |         }
165 | 
166 |         return $date;
167 |     }
168 | 
169 |     /**
170 |      * Returns the signature from given data
171 |      *
172 |      * @param non-empty-string $data
173 |      */
174 |     private function parseSignature(string $data): Signature
175 |     {
176 |         $hash = $this->decoder->base64UrlDecode($data);
177 | 
178 |         return new Signature($hash, $data);
179 |     }
180 | }
181 | 


--------------------------------------------------------------------------------
/src/Token/Plain.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT\Token;
 5 | 
 6 | use DateTimeInterface;
 7 | use Lcobucci\JWT\UnencryptedToken;
 8 | 
 9 | use function in_array;
10 | 
11 | final readonly class Plain implements UnencryptedToken
12 | {
13 |     public function __construct(
14 |         private DataSet $headers,
15 |         private DataSet $claims,
16 |         private Signature $signature,
17 |     ) {
18 |     }
19 | 
20 |     public function headers(): DataSet
21 |     {
22 |         return $this->headers;
23 |     }
24 | 
25 |     public function claims(): DataSet
26 |     {
27 |         return $this->claims;
28 |     }
29 | 
30 |     public function signature(): Signature
31 |     {
32 |         return $this->signature;
33 |     }
34 | 
35 |     public function payload(): string
36 |     {
37 |         return $this->headers->toString() . '.' . $this->claims->toString();
38 |     }
39 | 
40 |     public function isPermittedFor(string $audience): bool
41 |     {
42 |         return in_array($audience, $this->claims->get(RegisteredClaims::AUDIENCE, []), true);
43 |     }
44 | 
45 |     public function isIdentifiedBy(string $id): bool
46 |     {
47 |         return $this->claims->get(RegisteredClaims::ID) === $id;
48 |     }
49 | 
50 |     public function isRelatedTo(string $subject): bool
51 |     {
52 |         return $this->claims->get(RegisteredClaims::SUBJECT) === $subject;
53 |     }
54 | 
55 |     public function hasBeenIssuedBy(string ...$issuers): bool
56 |     {
57 |         return in_array($this->claims->get(RegisteredClaims::ISSUER), $issuers, true);
58 |     }
59 | 
60 |     public function hasBeenIssuedBefore(DateTimeInterface $now): bool
61 |     {
62 |         return $now >= $this->claims->get(RegisteredClaims::ISSUED_AT);
63 |     }
64 | 
65 |     public function isMinimumTimeBefore(DateTimeInterface $now): bool
66 |     {
67 |         return $now >= $this->claims->get(RegisteredClaims::NOT_BEFORE);
68 |     }
69 | 
70 |     public function isExpired(DateTimeInterface $now): bool
71 |     {
72 |         if (! $this->claims->has(RegisteredClaims::EXPIRATION_TIME)) {
73 |             return false;
74 |         }
75 | 
76 |         return $now >= $this->claims->get(RegisteredClaims::EXPIRATION_TIME);
77 |     }
78 | 
79 |     public function toString(): string
80 |     {
81 |         return $this->headers->toString() . '.'
82 |              . $this->claims->toString() . '.'
83 |              . $this->signature->toString();
84 |     }
85 | }
86 | 


--------------------------------------------------------------------------------
/src/Token/RegisteredClaimGiven.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT\Token;
 5 | 
 6 | use InvalidArgumentException;
 7 | use Lcobucci\JWT\Exception;
 8 | 
 9 | use function sprintf;
10 | 
11 | final class RegisteredClaimGiven extends InvalidArgumentException implements Exception
12 | {
13 |     private const DEFAULT_MESSAGE = 'Builder#withClaim() is meant to be used for non-registered claims, '
14 |                                   . 'check the documentation on how to set claim "%s"';
15 | 
16 |     /** @param non-empty-string $name */
17 |     public static function forClaim(string $name): self
18 |     {
19 |         return new self(sprintf(self::DEFAULT_MESSAGE, $name));
20 |     }
21 | }
22 | 


--------------------------------------------------------------------------------
/src/Token/RegisteredClaims.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT\Token;
 5 | 
 6 | /**
 7 |  * Defines the list of claims that are registered in the IANA "JSON Web Token Claims" registry
 8 |  *
 9 |  * @see https://tools.ietf.org/html/rfc7519#section-4.1
10 |  */
11 | interface RegisteredClaims
12 | {
13 |     public const ALL = [
14 |         self::AUDIENCE,
15 |         self::EXPIRATION_TIME,
16 |         self::ID,
17 |         self::ISSUED_AT,
18 |         self::ISSUER,
19 |         self::NOT_BEFORE,
20 |         self::SUBJECT,
21 |     ];
22 | 
23 |     public const DATE_CLAIMS = [
24 |         self::ISSUED_AT,
25 |         self::NOT_BEFORE,
26 |         self::EXPIRATION_TIME,
27 |     ];
28 | 
29 |     /**
30 |      * Identifies the recipients that the JWT is intended for
31 |      *
32 |      * @see https://tools.ietf.org/html/rfc7519#section-4.1.3
33 |      */
34 |     public const AUDIENCE = 'aud';
35 | 
36 |     /**
37 |      * Identifies the expiration time on or after which the JWT MUST NOT be accepted for processing
38 |      *
39 |      * @see https://tools.ietf.org/html/rfc7519#section-4.1.4
40 |      */
41 |     public const EXPIRATION_TIME = 'exp';
42 | 
43 |     /**
44 |      * Provides a unique identifier for the JWT
45 |      *
46 |      * @see https://tools.ietf.org/html/rfc7519#section-4.1.7
47 |      */
48 |     public const ID = 'jti';
49 | 
50 |     /**
51 |      * Identifies the time at which the JWT was issued
52 |      *
53 |      * @see https://tools.ietf.org/html/rfc7519#section-4.1.6
54 |      */
55 |     public const ISSUED_AT = 'iat';
56 | 
57 |     /**
58 |      * Identifies the principal that issued the JWT
59 |      *
60 |      * @see https://tools.ietf.org/html/rfc7519#section-4.1.1
61 |      */
62 |     public const ISSUER = 'iss';
63 | 
64 |     /**
65 |      * Identifies the time before which the JWT MUST NOT be accepted for processing
66 |      *
67 |      * https://tools.ietf.org/html/rfc7519#section-4.1.5
68 |      */
69 |     public const NOT_BEFORE = 'nbf';
70 | 
71 |     /**
72 |      * Identifies the principal that is the subject of the JWT.
73 |      *
74 |      * https://tools.ietf.org/html/rfc7519#section-4.1.2
75 |      */
76 |     public const SUBJECT = 'sub';
77 | }
78 | 


--------------------------------------------------------------------------------
/src/Token/Signature.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT\Token;
 5 | 
 6 | final readonly class Signature
 7 | {
 8 |     /**
 9 |      * @param non-empty-string $hash
10 |      * @param non-empty-string $encoded
11 |      */
12 |     public function __construct(private string $hash, private string $encoded)
13 |     {
14 |     }
15 | 
16 |     /** @return non-empty-string */
17 |     public function hash(): string
18 |     {
19 |         return $this->hash;
20 |     }
21 | 
22 |     /**
23 |      * Returns the encoded version of the signature
24 |      *
25 |      * @return non-empty-string
26 |      */
27 |     public function toString(): string
28 |     {
29 |         return $this->encoded;
30 |     }
31 | }
32 | 


--------------------------------------------------------------------------------
/src/Token/UnsupportedHeaderFound.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT\Token;
 5 | 
 6 | use InvalidArgumentException;
 7 | use Lcobucci\JWT\Exception;
 8 | 
 9 | final class UnsupportedHeaderFound extends InvalidArgumentException implements Exception
10 | {
11 |     public static function encryption(): self
12 |     {
13 |         return new self('Encryption is not supported yet');
14 |     }
15 | }
16 | 


--------------------------------------------------------------------------------
/src/UnencryptedToken.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT;
 5 | 
 6 | use Lcobucci\JWT\Token\DataSet;
 7 | use Lcobucci\JWT\Token\Signature;
 8 | 
 9 | interface UnencryptedToken extends Token
10 | {
11 |     /**
12 |      * Returns the token claims
13 |      */
14 |     public function claims(): DataSet;
15 | 
16 |     /**
17 |      * Returns the token signature
18 |      */
19 |     public function signature(): Signature;
20 | 
21 |     /**
22 |      * Returns the token payload
23 |      *
24 |      * @return non-empty-string
25 |      */
26 |     public function payload(): string;
27 | }
28 | 


--------------------------------------------------------------------------------
/src/Validation/Constraint.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT\Validation;
 5 | 
 6 | use Lcobucci\JWT\Token;
 7 | 
 8 | interface Constraint
 9 | {
10 |     /** @throws ConstraintViolation */
11 |     public function assert(Token $token): void;
12 | }
13 | 


--------------------------------------------------------------------------------
/src/Validation/Constraint/CannotValidateARegisteredClaim.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT\Validation\Constraint;
 5 | 
 6 | use InvalidArgumentException;
 7 | use Lcobucci\JWT\Exception;
 8 | 
 9 | final class CannotValidateARegisteredClaim extends InvalidArgumentException implements Exception
10 | {
11 |     /** @param non-empty-string $claim */
12 |     public static function create(string $claim): self
13 |     {
14 |         return new self(
15 |             'The claim "' . $claim . '" is a registered claim, another constraint must be used to validate its value',
16 |         );
17 |     }
18 | }
19 | 


--------------------------------------------------------------------------------
/src/Validation/Constraint/HasClaim.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT\Validation\Constraint;
 5 | 
 6 | use Lcobucci\JWT\Token;
 7 | use Lcobucci\JWT\UnencryptedToken;
 8 | use Lcobucci\JWT\Validation\Constraint;
 9 | use Lcobucci\JWT\Validation\ConstraintViolation;
10 | 
11 | use function in_array;
12 | 
13 | final readonly class HasClaim implements Constraint
14 | {
15 |     /** @param non-empty-string $claim */
16 |     public function __construct(private string $claim)
17 |     {
18 |         if (in_array($claim, Token\RegisteredClaims::ALL, true)) {
19 |             throw CannotValidateARegisteredClaim::create($claim);
20 |         }
21 |     }
22 | 
23 |     public function assert(Token $token): void
24 |     {
25 |         if (! $token instanceof UnencryptedToken) {
26 |             throw ConstraintViolation::error('You should pass a plain token', $this);
27 |         }
28 | 
29 |         $claims = $token->claims();
30 | 
31 |         if (! $claims->has($this->claim)) {
32 |             throw ConstraintViolation::error('The token does not have the claim "' . $this->claim . '"', $this);
33 |         }
34 |     }
35 | }
36 | 


--------------------------------------------------------------------------------
/src/Validation/Constraint/HasClaimWithValue.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT\Validation\Constraint;
 5 | 
 6 | use Lcobucci\JWT\Token;
 7 | use Lcobucci\JWT\UnencryptedToken;
 8 | use Lcobucci\JWT\Validation\Constraint;
 9 | use Lcobucci\JWT\Validation\ConstraintViolation;
10 | 
11 | use function in_array;
12 | 
13 | final readonly class HasClaimWithValue implements Constraint
14 | {
15 |     /** @param non-empty-string $claim */
16 |     public function __construct(private string $claim, private mixed $expectedValue)
17 |     {
18 |         if (in_array($claim, Token\RegisteredClaims::ALL, true)) {
19 |             throw CannotValidateARegisteredClaim::create($claim);
20 |         }
21 |     }
22 | 
23 |     public function assert(Token $token): void
24 |     {
25 |         if (! $token instanceof UnencryptedToken) {
26 |             throw ConstraintViolation::error('You should pass a plain token', $this);
27 |         }
28 | 
29 |         $claims = $token->claims();
30 | 
31 |         if (! $claims->has($this->claim)) {
32 |             throw ConstraintViolation::error('The token does not have the claim "' . $this->claim . '"', $this);
33 |         }
34 | 
35 |         if ($claims->get($this->claim) !== $this->expectedValue) {
36 |             throw ConstraintViolation::error(
37 |                 'The claim "' . $this->claim . '" does not have the expected value',
38 |                 $this,
39 |             );
40 |         }
41 |     }
42 | }
43 | 


--------------------------------------------------------------------------------
/src/Validation/Constraint/IdentifiedBy.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT\Validation\Constraint;
 5 | 
 6 | use Lcobucci\JWT\Token;
 7 | use Lcobucci\JWT\Validation\Constraint;
 8 | use Lcobucci\JWT\Validation\ConstraintViolation;
 9 | 
10 | final readonly class IdentifiedBy implements Constraint
11 | {
12 |     /** @param non-empty-string $id */
13 |     public function __construct(private string $id)
14 |     {
15 |     }
16 | 
17 |     public function assert(Token $token): void
18 |     {
19 |         if (! $token->isIdentifiedBy($this->id)) {
20 |             throw ConstraintViolation::error(
21 |                 'The token is not identified with the expected ID',
22 |                 $this,
23 |             );
24 |         }
25 |     }
26 | }
27 | 


--------------------------------------------------------------------------------
/src/Validation/Constraint/IssuedBy.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT\Validation\Constraint;
 5 | 
 6 | use Lcobucci\JWT\Token;
 7 | use Lcobucci\JWT\Validation\Constraint;
 8 | use Lcobucci\JWT\Validation\ConstraintViolation;
 9 | 
10 | final readonly class IssuedBy implements Constraint
11 | {
12 |     /** @var non-empty-string[] */
13 |     private array $issuers;
14 | 
15 |     /** @param non-empty-string ...$issuers */
16 |     public function __construct(string ...$issuers)
17 |     {
18 |         $this->issuers = $issuers;
19 |     }
20 | 
21 |     public function assert(Token $token): void
22 |     {
23 |         if (! $token->hasBeenIssuedBy(...$this->issuers)) {
24 |             throw ConstraintViolation::error(
25 |                 'The token was not issued by the given issuers',
26 |                 $this,
27 |             );
28 |         }
29 |     }
30 | }
31 | 


--------------------------------------------------------------------------------
/src/Validation/Constraint/LeewayCannotBeNegative.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT\Validation\Constraint;
 5 | 
 6 | use InvalidArgumentException;
 7 | use Lcobucci\JWT\Exception;
 8 | 
 9 | final class LeewayCannotBeNegative extends InvalidArgumentException implements Exception
10 | {
11 |     public static function create(): self
12 |     {
13 |         return new self('Leeway cannot be negative');
14 |     }
15 | }
16 | 


--------------------------------------------------------------------------------
/src/Validation/Constraint/LooseValidAt.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT\Validation\Constraint;
 5 | 
 6 | use DateInterval;
 7 | use DateTimeInterface;
 8 | use Lcobucci\JWT\Token;
 9 | use Lcobucci\JWT\Validation\ConstraintViolation;
10 | use Lcobucci\JWT\Validation\ValidAt as ValidAtInterface;
11 | use Psr\Clock\ClockInterface as Clock;
12 | 
13 | final readonly class LooseValidAt implements ValidAtInterface
14 | {
15 |     private DateInterval $leeway;
16 | 
17 |     public function __construct(private Clock $clock, ?DateInterval $leeway = null)
18 |     {
19 |         $this->leeway = $this->guardLeeway($leeway);
20 |     }
21 | 
22 |     private function guardLeeway(?DateInterval $leeway): DateInterval
23 |     {
24 |         if ($leeway === null) {
25 |             return new DateInterval('PT0S');
26 |         }
27 | 
28 |         if ($leeway->invert === 1) {
29 |             throw LeewayCannotBeNegative::create();
30 |         }
31 | 
32 |         return $leeway;
33 |     }
34 | 
35 |     public function assert(Token $token): void
36 |     {
37 |         $now = $this->clock->now();
38 | 
39 |         $this->assertIssueTime($token, $now->add($this->leeway));
40 |         $this->assertMinimumTime($token, $now->add($this->leeway));
41 |         $this->assertExpiration($token, $now->sub($this->leeway));
42 |     }
43 | 
44 |     /** @throws ConstraintViolation */
45 |     private function assertExpiration(Token $token, DateTimeInterface $now): void
46 |     {
47 |         if ($token->isExpired($now)) {
48 |             throw ConstraintViolation::error('The token is expired', $this);
49 |         }
50 |     }
51 | 
52 |     /** @throws ConstraintViolation */
53 |     private function assertMinimumTime(Token $token, DateTimeInterface $now): void
54 |     {
55 |         if (! $token->isMinimumTimeBefore($now)) {
56 |             throw ConstraintViolation::error('The token cannot be used yet', $this);
57 |         }
58 |     }
59 | 
60 |     /** @throws ConstraintViolation */
61 |     private function assertIssueTime(Token $token, DateTimeInterface $now): void
62 |     {
63 |         if (! $token->hasBeenIssuedBefore($now)) {
64 |             throw ConstraintViolation::error('The token was issued in the future', $this);
65 |         }
66 |     }
67 | }
68 | 


--------------------------------------------------------------------------------
/src/Validation/Constraint/PermittedFor.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT\Validation\Constraint;
 5 | 
 6 | use Lcobucci\JWT\Token;
 7 | use Lcobucci\JWT\Validation\Constraint;
 8 | use Lcobucci\JWT\Validation\ConstraintViolation;
 9 | 
10 | final readonly class PermittedFor implements Constraint
11 | {
12 |     /** @param non-empty-string $audience */
13 |     public function __construct(private string $audience)
14 |     {
15 |     }
16 | 
17 |     public function assert(Token $token): void
18 |     {
19 |         if (! $token->isPermittedFor($this->audience)) {
20 |             throw ConstraintViolation::error(
21 |                 'The token is not allowed to be used by this audience',
22 |                 $this,
23 |             );
24 |         }
25 |     }
26 | }
27 | 


--------------------------------------------------------------------------------
/src/Validation/Constraint/RelatedTo.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT\Validation\Constraint;
 5 | 
 6 | use Lcobucci\JWT\Token;
 7 | use Lcobucci\JWT\Validation\Constraint;
 8 | use Lcobucci\JWT\Validation\ConstraintViolation;
 9 | 
10 | final readonly class RelatedTo implements Constraint
11 | {
12 |     /** @param non-empty-string $subject */
13 |     public function __construct(private string $subject)
14 |     {
15 |     }
16 | 
17 |     public function assert(Token $token): void
18 |     {
19 |         if (! $token->isRelatedTo($this->subject)) {
20 |             throw ConstraintViolation::error(
21 |                 'The token is not related to the expected subject',
22 |                 $this,
23 |             );
24 |         }
25 |     }
26 | }
27 | 


--------------------------------------------------------------------------------
/src/Validation/Constraint/SignedWith.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT\Validation\Constraint;
 5 | 
 6 | use Lcobucci\JWT\Signer;
 7 | use Lcobucci\JWT\Token;
 8 | use Lcobucci\JWT\UnencryptedToken;
 9 | use Lcobucci\JWT\Validation\ConstraintViolation;
10 | use Lcobucci\JWT\Validation\SignedWith as SignedWithInterface;
11 | 
12 | final readonly class SignedWith implements SignedWithInterface
13 | {
14 |     public function __construct(private Signer $signer, private Signer\Key $key)
15 |     {
16 |     }
17 | 
18 |     public function assert(Token $token): void
19 |     {
20 |         if (! $token instanceof UnencryptedToken) {
21 |             throw ConstraintViolation::error('You should pass a plain token', $this);
22 |         }
23 | 
24 |         if ($token->headers()->get('alg') !== $this->signer->algorithmId()) {
25 |             throw ConstraintViolation::error('Token signer mismatch', $this);
26 |         }
27 | 
28 |         if (! $this->signer->verify($token->signature()->hash(), $token->payload(), $this->key)) {
29 |             throw ConstraintViolation::error('Token signature mismatch', $this);
30 |         }
31 |     }
32 | }
33 | 


--------------------------------------------------------------------------------
/src/Validation/Constraint/SignedWithOneInSet.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT\Validation\Constraint;
 5 | 
 6 | use Lcobucci\JWT\Token;
 7 | use Lcobucci\JWT\Validation\ConstraintViolation;
 8 | use Lcobucci\JWT\Validation\SignedWith as SignedWithInterface;
 9 | 
10 | use const PHP_EOL;
11 | 
12 | final readonly class SignedWithOneInSet implements SignedWithInterface
13 | {
14 |     /** @var array<SignedWithUntilDate> */
15 |     private array $constraints;
16 | 
17 |     public function __construct(SignedWithUntilDate ...$constraints)
18 |     {
19 |         $this->constraints = $constraints;
20 |     }
21 | 
22 |     public function assert(Token $token): void
23 |     {
24 |         $errorMessage = 'It was not possible to verify the signature of the token, reasons:';
25 | 
26 |         foreach ($this->constraints as $constraint) {
27 |             try {
28 |                 $constraint->assert($token);
29 | 
30 |                 return;
31 |             } catch (ConstraintViolation $violation) {
32 |                 $errorMessage .= PHP_EOL . '- ' . $violation->getMessage();
33 |             }
34 |         }
35 | 
36 |         throw ConstraintViolation::error($errorMessage, $this);
37 |     }
38 | }
39 | 


--------------------------------------------------------------------------------
/src/Validation/Constraint/SignedWithUntilDate.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT\Validation\Constraint;
 5 | 
 6 | use DateTimeImmutable;
 7 | use DateTimeInterface;
 8 | use Lcobucci\JWT\Signer;
 9 | use Lcobucci\JWT\Token;
10 | use Lcobucci\JWT\Validation\ConstraintViolation;
11 | use Lcobucci\JWT\Validation\SignedWith as SignedWithInterface;
12 | use Psr\Clock\ClockInterface;
13 | 
14 | final readonly class SignedWithUntilDate implements SignedWithInterface
15 | {
16 |     private SignedWith $verifySignature;
17 |     private ClockInterface $clock;
18 | 
19 |     public function __construct(
20 |         Signer $signer,
21 |         Signer\Key $key,
22 |         private DateTimeImmutable $validUntil,
23 |         ?ClockInterface $clock = null,
24 |     ) {
25 |         $this->verifySignature = new SignedWith($signer, $key);
26 | 
27 |         $this->clock = $clock ?? new class () implements ClockInterface {
28 |             public function now(): DateTimeImmutable
29 |             {
30 |                 return new DateTimeImmutable();
31 |             }
32 |         };
33 |     }
34 | 
35 |     public function assert(Token $token): void
36 |     {
37 |         if ($this->validUntil < $this->clock->now()) {
38 |             throw ConstraintViolation::error(
39 |                 'This constraint was only usable until '
40 |                 . $this->validUntil->format(DateTimeInterface::RFC3339),
41 |                 $this,
42 |             );
43 |         }
44 | 
45 |         $this->verifySignature->assert($token);
46 |     }
47 | }
48 | 


--------------------------------------------------------------------------------
/src/Validation/Constraint/StrictValidAt.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT\Validation\Constraint;
 5 | 
 6 | use DateInterval;
 7 | use DateTimeInterface;
 8 | use Lcobucci\JWT\Token;
 9 | use Lcobucci\JWT\UnencryptedToken;
10 | use Lcobucci\JWT\Validation\ConstraintViolation;
11 | use Lcobucci\JWT\Validation\ValidAt as ValidAtInterface;
12 | use Psr\Clock\ClockInterface as Clock;
13 | 
14 | final readonly class StrictValidAt implements ValidAtInterface
15 | {
16 |     private DateInterval $leeway;
17 | 
18 |     public function __construct(private Clock $clock, ?DateInterval $leeway = null)
19 |     {
20 |         $this->leeway = $this->guardLeeway($leeway);
21 |     }
22 | 
23 |     private function guardLeeway(?DateInterval $leeway): DateInterval
24 |     {
25 |         if ($leeway === null) {
26 |             return new DateInterval('PT0S');
27 |         }
28 | 
29 |         if ($leeway->invert === 1) {
30 |             throw LeewayCannotBeNegative::create();
31 |         }
32 | 
33 |         return $leeway;
34 |     }
35 | 
36 |     public function assert(Token $token): void
37 |     {
38 |         if (! $token instanceof UnencryptedToken) {
39 |             throw ConstraintViolation::error('You should pass a plain token', $this);
40 |         }
41 | 
42 |         $now = $this->clock->now();
43 | 
44 |         $this->assertIssueTime($token, $now->add($this->leeway));
45 |         $this->assertMinimumTime($token, $now->add($this->leeway));
46 |         $this->assertExpiration($token, $now->sub($this->leeway));
47 |     }
48 | 
49 |     /** @throws ConstraintViolation */
50 |     private function assertExpiration(UnencryptedToken $token, DateTimeInterface $now): void
51 |     {
52 |         if (! $token->claims()->has(Token\RegisteredClaims::EXPIRATION_TIME)) {
53 |             throw ConstraintViolation::error('"Expiration Time" claim missing', $this);
54 |         }
55 | 
56 |         if ($token->isExpired($now)) {
57 |             throw ConstraintViolation::error('The token is expired', $this);
58 |         }
59 |     }
60 | 
61 |     /** @throws ConstraintViolation */
62 |     private function assertMinimumTime(UnencryptedToken $token, DateTimeInterface $now): void
63 |     {
64 |         if (! $token->claims()->has(Token\RegisteredClaims::NOT_BEFORE)) {
65 |             throw ConstraintViolation::error('"Not Before" claim missing', $this);
66 |         }
67 | 
68 |         if (! $token->isMinimumTimeBefore($now)) {
69 |             throw ConstraintViolation::error('The token cannot be used yet', $this);
70 |         }
71 |     }
72 | 
73 |     /** @throws ConstraintViolation */
74 |     private function assertIssueTime(UnencryptedToken $token, DateTimeInterface $now): void
75 |     {
76 |         if (! $token->claims()->has(Token\RegisteredClaims::ISSUED_AT)) {
77 |             throw ConstraintViolation::error('"Issued At" claim missing', $this);
78 |         }
79 | 
80 |         if (! $token->hasBeenIssuedBefore($now)) {
81 |             throw ConstraintViolation::error('The token was issued in the future', $this);
82 |         }
83 |     }
84 | }
85 | 


--------------------------------------------------------------------------------
/src/Validation/ConstraintViolation.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT\Validation;
 5 | 
 6 | use Lcobucci\JWT\Exception;
 7 | use RuntimeException;
 8 | 
 9 | final class ConstraintViolation extends RuntimeException implements Exception
10 | {
11 |     /** @param class-string<Constraint>|null $constraint */
12 |     public function __construct(
13 |         string $message = '',
14 |         public readonly ?string $constraint = null,
15 |     ) {
16 |         parent::__construct($message);
17 |     }
18 | 
19 |     /** @param non-empty-string $message */
20 |     public static function error(string $message, Constraint $constraint): self
21 |     {
22 |         return new self(message: $message, constraint: $constraint::class);
23 |     }
24 | }
25 | 


--------------------------------------------------------------------------------
/src/Validation/NoConstraintsGiven.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT\Validation;
 5 | 
 6 | use Lcobucci\JWT\Exception;
 7 | use RuntimeException;
 8 | 
 9 | final class NoConstraintsGiven extends RuntimeException implements Exception
10 | {
11 | }
12 | 


--------------------------------------------------------------------------------
/src/Validation/RequiredConstraintsViolated.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT\Validation;
 5 | 
 6 | use Lcobucci\JWT\Exception;
 7 | use RuntimeException;
 8 | 
 9 | use function array_map;
10 | use function implode;
11 | 
12 | final class RequiredConstraintsViolated extends RuntimeException implements Exception
13 | {
14 |     /** @param ConstraintViolation[] $violations */
15 |     public function __construct(
16 |         string $message = '',
17 |         public readonly array $violations = [],
18 |     ) {
19 |         parent::__construct($message);
20 |     }
21 | 
22 |     public static function fromViolations(ConstraintViolation ...$violations): self
23 |     {
24 |         return new self(message: self::buildMessage($violations), violations: $violations);
25 |     }
26 | 
27 |     /** @param ConstraintViolation[] $violations */
28 |     private static function buildMessage(array $violations): string
29 |     {
30 |         $violations = array_map(
31 |             static function (ConstraintViolation $violation): string {
32 |                 return '- ' . $violation->getMessage();
33 |             },
34 |             $violations,
35 |         );
36 | 
37 |         $message  = "The token violates some mandatory constraints, details:\n";
38 |         $message .= implode("\n", $violations);
39 | 
40 |         return $message;
41 |     }
42 | 
43 |     /** @return ConstraintViolation[] */
44 |     public function violations(): array
45 |     {
46 |         return $this->violations;
47 |     }
48 | }
49 | 


--------------------------------------------------------------------------------
/src/Validation/SignedWith.php:
--------------------------------------------------------------------------------
1 | <?php
2 | declare(strict_types=1);
3 | 
4 | namespace Lcobucci\JWT\Validation;
5 | 
6 | interface SignedWith extends Constraint
7 | {
8 | }
9 | 


--------------------------------------------------------------------------------
/src/Validation/ValidAt.php:
--------------------------------------------------------------------------------
1 | <?php
2 | declare(strict_types=1);
3 | 
4 | namespace Lcobucci\JWT\Validation;
5 | 
6 | interface ValidAt extends Constraint
7 | {
8 | }
9 | 


--------------------------------------------------------------------------------
/src/Validation/Validator.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT\Validation;
 5 | 
 6 | use Lcobucci\JWT\Token;
 7 | 
 8 | final readonly class Validator implements \Lcobucci\JWT\Validator
 9 | {
10 |     public function assert(Token $token, Constraint ...$constraints): void
11 |     {
12 |         if ($constraints === []) {
13 |             throw new NoConstraintsGiven('No constraint given.');
14 |         }
15 | 
16 |         $violations = [];
17 | 
18 |         foreach ($constraints as $constraint) {
19 |             $this->checkConstraint($constraint, $token, $violations);
20 |         }
21 | 
22 |         if ($violations !== []) {
23 |             throw RequiredConstraintsViolated::fromViolations(...$violations);
24 |         }
25 |     }
26 | 
27 |     /** @param ConstraintViolation[] $violations */
28 |     private function checkConstraint(
29 |         Constraint $constraint,
30 |         Token $token,
31 |         array &$violations,
32 |     ): void {
33 |         try {
34 |             $constraint->assert($token);
35 |         } catch (ConstraintViolation $e) {
36 |             $violations[] = $e;
37 |         }
38 |     }
39 | 
40 |     public function validate(Token $token, Constraint ...$constraints): bool
41 |     {
42 |         if ($constraints === []) {
43 |             throw new NoConstraintsGiven('No constraint given.');
44 |         }
45 | 
46 |         try {
47 |             foreach ($constraints as $constraint) {
48 |                 $constraint->assert($token);
49 |             }
50 | 
51 |             return true;
52 |         } catch (ConstraintViolation) {
53 |             return false;
54 |         }
55 |     }
56 | }
57 | 


--------------------------------------------------------------------------------
/src/Validator.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | declare(strict_types=1);
 3 | 
 4 | namespace Lcobucci\JWT;
 5 | 
 6 | use Lcobucci\JWT\Validation\Constraint;
 7 | use Lcobucci\JWT\Validation\NoConstraintsGiven;
 8 | use Lcobucci\JWT\Validation\RequiredConstraintsViolated;
 9 | 
10 | interface Validator
11 | {
12 |     /**
13 |      * @throws RequiredConstraintsViolated
14 |      * @throws NoConstraintsGiven
15 |      */
16 |     public function assert(Token $token, Constraint ...$constraints): void;
17 | 
18 |     /** @throws NoConstraintsGiven */
19 |     public function validate(Token $token, Constraint ...$constraints): bool;
20 | }
21 | 


--------------------------------------------------------------------------------