jwt.c

Go to the documentation of this file.

#include <cwist/security/jwt/jwt.h>
#include <cwist/core/mem/alloc.h>
#include <cwist/core/sstring/sstring.h>
#include <cwist/core/seq/seq.h>
 
#include <cjson/cJSON.h>
 
#if defined(CWIST_TLS_MBEDTLS)
/* mbedTLS backend: HS256 via the md module, ES256 via pk/ecp. Ed25519 has no
 * mbedTLS 3.6 implementation, so EdDSA sign/verify fails at runtime (the
 * public API surface is unchanged). */
#include <mbedtls/pk.h>
#include <mbedtls/ecp.h>
#include <mbedtls/ecdsa.h>
#include <mbedtls/md.h>
#include <mbedtls/bignum.h>
#include <openssl/rand.h> /* seam shim: RAND_bytes over CTR-DRBG */
#include <stdint.h>
#else
#include <openssl/hmac.h>
#include <openssl/sha.h>
#include <openssl/evp.h>
#include <openssl/pem.h>
#include <openssl/bio.h>
#include <openssl/ec.h>
#include <openssl/ecdsa.h>
#include <openssl/bn.h>
#include <openssl/obj.h>
#endif
 
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <time.h>
 
/* --------------------------------------------------------------------------
 * Internal: Base64URL helpers
 * -------------------------------------------------------------------------- */
 
static size_t b64url_encoded_len(size_t input_len) {
    return ((input_len + 2) / 3) * 4 + 1; /* +1 for '\0' */
}
 
static void b64url_encode(const unsigned char *src, size_t src_len, char *dst) {
    static const char tbl[] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
    size_t i = 0, j = 0;
    while (i + 2 < src_len) {
        uint32_t v = ((uint32_t)src[i] << 16) | ((uint32_t)src[i + 1] << 8) | src[i + 2];
        dst[j++] = tbl[(v >> 18) & 0x3F];
        dst[j++] = tbl[(v >> 12) & 0x3F];
        dst[j++] = tbl[(v >> 6) & 0x3F];
        dst[j++] = tbl[v & 0x3F];
        i += 3;
    }
    if (i + 1 == src_len) {
        uint32_t v = (uint32_t)src[i] << 4;
        dst[j++] = tbl[(v >> 6) & 0x3F];
        dst[j++] = tbl[v & 0x3F];
    } else if (i + 2 == src_len) {
        uint32_t v = ((uint32_t)src[i] << 10) | ((uint32_t)src[i + 1] << 2);
        dst[j++] = tbl[(v >> 12) & 0x3F];
        dst[j++] = tbl[(v >> 6) & 0x3F];
        dst[j++] = tbl[v & 0x3F];
    }
    dst[j] = '\0';
}
 
static unsigned char *b64url_decode(const char *src, size_t src_len, size_t *out_len) {
    /* Accept either standard or url-safe alphabet; strip '=' padding. */
    static const signed char lut[256] = {
        -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
        -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 62,
        -1, 62, -1, 63, /* '+' -> 62, '-' -> 62, '/' & '_' -> 63 */
        52, 53, 54, 55, 56, 57, 58, 59, 60, 61, -1, -1, -1, 0,  -1, -1, /* '0'-'9', '=' -> 0 */
        -1, 0,  1,  2,  3,  4,  5,  6,  7,  8,  9,  10, 11, 12, 13, 14, /* 'A'-'O' */
        15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, -1, -1, -1, -1, 63, /* 'P'-'Z', '_' -> 63 */
        -1, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, /* 'a'-'o' */
        41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, -1, -1, -1, -1, -1, /* 'p'-'z' */
        -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
        -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
        -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
        -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
        -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
        -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
    };
 
    /* Calculate how many padding chars to expect */
    size_t padded_len = src_len;
    while (padded_len > 0 && src[padded_len - 1] == '=') {
        padded_len--;
    }
 
    size_t decoded_len = (padded_len * 3) / 4;
    unsigned char *out = (unsigned char *)cwist_alloc(decoded_len + 1);
    if (!out) return NULL;
 
    size_t i = 0, j = 0;
    while (i + 3 < padded_len) {
        signed char a = lut[(unsigned char)src[i]];
        signed char b = lut[(unsigned char)src[i + 1]];
        signed char c = lut[(unsigned char)src[i + 2]];
        signed char d = lut[(unsigned char)src[i + 3]];
        if (a < 0 || b < 0 || c < 0 || d < 0) {
            cwist_free(out);
            return NULL;
        }
        out[j++] = (unsigned char)((a << 2) | (b >> 4));
        out[j++] = (unsigned char)((b << 4) | (c >> 2));
        out[j++] = (unsigned char)((c << 6) | d);
        i += 4;
    }
 
    size_t rem = padded_len - i;
    if (rem == 2) {
        signed char a = lut[(unsigned char)src[i]];
        signed char b = lut[(unsigned char)src[i + 1]];
        if (a < 0 || b < 0) {
            cwist_free(out);
            return NULL;
        }
        out[j++] = (unsigned char)((a << 2) | (b >> 4));
    } else if (rem == 3) {
        signed char a = lut[(unsigned char)src[i]];
        signed char b = lut[(unsigned char)src[i + 1]];
        signed char c = lut[(unsigned char)src[i + 2]];
        if (a < 0 || b < 0 || c < 0) {
            cwist_free(out);
            return NULL;
        }
        out[j++] = (unsigned char)((a << 2) | (b >> 4));
        out[j++] = (unsigned char)((b << 4) | (c >> 2));
    } else if (rem == 1) {
        /* RFC 4648 section 4: 1 base64 character (6 bits) cannot encode a whole byte.
         * A remainder of 1 is malformed and must be rejected. */
        cwist_free(out);
        return NULL;
    }
 
    out[j] = '\0';
    *out_len = j;
    return out;
}
 
/* --------------------------------------------------------------------------
 * Internal: algorithm dispatch (HS256, ES256, Ed25519)
 * -------------------------------------------------------------------------- */
 
typedef enum {
    JWT_ALG_HS256,
    JWT_ALG_ES256,
    JWT_ALG_ED25519,
} jwt_alg_t;
 
static const char *jwt_alg_name(jwt_alg_t alg) {
    switch (alg) {
    case JWT_ALG_HS256: return "HS256";
    case JWT_ALG_ES256: return "ES256";
    case JWT_ALG_ED25519: return "EdDSA";
    }
    return NULL;
}
 
static bool hmac_sha256(const char *key, size_t key_len, const char *msg, size_t msg_len,
                        unsigned char out[32]) {
#if defined(CWIST_TLS_MBEDTLS)
    return mbedtls_md_hmac(mbedtls_md_info_from_type(MBEDTLS_MD_SHA256),
                           (const unsigned char *)key, key_len,
                           (const unsigned char *)msg, msg_len, out) == 0;
#else
    unsigned int out_len = 0;
    unsigned char *r =
        HMAC(EVP_sha256(), key, (int)key_len, (const unsigned char *)msg, msg_len, out, &out_len);
    return r != NULL && out_len == 32;
#endif
}
 
#if defined(CWIST_TLS_MBEDTLS)
 
static int jwt_mbedtls_rng(void *p_rng, unsigned char *buf, size_t len) {
    (void)p_rng;
    return len <= (size_t)INT32_MAX && RAND_bytes(buf, (int)len) == 1 ? 0 : -1;
}
 
static bool jwt_load_private_key(mbedtls_pk_context *pk, const char *pem) {
    mbedtls_pk_init(pk);
    return mbedtls_pk_parse_key(pk, (const unsigned char *)pem, strlen(pem) + 1, NULL, 0,
                                jwt_mbedtls_rng, NULL) == 0;
}
 
static bool jwt_load_public_key(mbedtls_pk_context *pk, const char *pem) {
    mbedtls_pk_init(pk);
    if (mbedtls_pk_parse_public_key(pk, (const unsigned char *)pem, strlen(pem) + 1) == 0) {
        return true;
    }
    mbedtls_pk_free(pk);
    mbedtls_pk_init(pk);
    return mbedtls_pk_parse_key(pk, (const unsigned char *)pem, strlen(pem) + 1, NULL, 0,
                                jwt_mbedtls_rng, NULL) == 0;
}
 
static bool jwt_key_is_p256(const mbedtls_pk_context *pk) {
    return mbedtls_pk_get_type(pk) == MBEDTLS_PK_ECKEY &&
           mbedtls_pk_ec(*pk)->MBEDTLS_PRIVATE(grp).id == MBEDTLS_ECP_DP_SECP256R1;
}
 
static bool jwt_sha256(const char *msg, size_t msg_len, unsigned char out[32]) {
    return mbedtls_md(mbedtls_md_info_from_type(MBEDTLS_MD_SHA256), (const unsigned char *)msg,
                      msg_len, out) == 0;
}
 
static unsigned char *jwt_mbedtls_es256_sign(const char *key, const unsigned char *hash,
                                             size_t *out_len) {
    mbedtls_pk_context pk;
    if (!jwt_load_private_key(&pk, key)) return NULL;
    if (!jwt_key_is_p256(&pk)) {
        mbedtls_pk_free(&pk);
        return NULL;
    }
    mbedtls_ecp_keypair *kp = mbedtls_pk_ec(pk);
    mbedtls_mpi r, s;
    mbedtls_mpi_init(&r);
    mbedtls_mpi_init(&s);
    unsigned char *sig = NULL;
    if (mbedtls_ecdsa_sign(&kp->MBEDTLS_PRIVATE(grp), &r, &s, &kp->MBEDTLS_PRIVATE(d), hash, 32,
                           jwt_mbedtls_rng, NULL) == 0) {
        sig = (unsigned char *)cwist_alloc(64);
        if (sig && (mbedtls_mpi_write_binary(&r, sig, 32) != 0 ||
                    mbedtls_mpi_write_binary(&s, sig + 32, 32) != 0)) {
            cwist_free(sig);
            sig = NULL;
        }
        if (sig) *out_len = 64;
    }
    mbedtls_mpi_free(&r);
    mbedtls_mpi_free(&s);
    mbedtls_pk_free(&pk);
    return sig;
}
 
static bool jwt_mbedtls_es256_verify(const char *key, const unsigned char *hash,
                                     const unsigned char *sig, size_t sig_len) {
    if (sig_len != 64) return false;
    mbedtls_pk_context pk;
    if (!jwt_load_public_key(&pk, key)) return false;
    if (!jwt_key_is_p256(&pk)) {
        mbedtls_pk_free(&pk);
        return false;
    }
    mbedtls_ecp_keypair *kp = mbedtls_pk_ec(pk);
    mbedtls_mpi r, s;
    mbedtls_mpi_init(&r);
    mbedtls_mpi_init(&s);
    bool ok = mbedtls_mpi_read_binary(&r, sig, 32) == 0 &&
              mbedtls_mpi_read_binary(&s, sig + 32, 32) == 0 &&
              mbedtls_ecdsa_verify(&kp->MBEDTLS_PRIVATE(grp), hash, 32, &kp->MBEDTLS_PRIVATE(Q), &r,
                                   &s) == 0;
    mbedtls_mpi_free(&r);
    mbedtls_mpi_free(&s);
    mbedtls_pk_free(&pk);
    return ok;
}
 
#else /* BoringSSL backend */
 
static EVP_PKEY *jwt_load_private_key(const char *pem) {
    BIO *bio = BIO_new_mem_buf(pem, (int)strlen(pem));
    if (!bio) return NULL;
    EVP_PKEY *key = PEM_read_bio_PrivateKey(bio, NULL, NULL, NULL);
    BIO_free(bio);
    return key;
}
 
static EVP_PKEY *jwt_load_public_key(const char *pem) {
    BIO *bio = BIO_new_mem_buf(pem, (int)strlen(pem));
    if (!bio) return NULL;
    EVP_PKEY *key = PEM_read_bio_PUBKEY(bio, NULL, NULL, NULL);
    if (!key) {
        /* The first read consumed the buffer; rewind before the fallback. */
        BIO_reset(bio);
        key = PEM_read_bio_PrivateKey(bio, NULL, NULL, NULL);
    }
    BIO_free(bio);
    return key;
}
 
static bool jwt_key_is_p256(EVP_PKEY *key) {
    if (EVP_PKEY_id(key) != EVP_PKEY_EC) return false;
    EC_KEY *ec = EVP_PKEY_get0_EC_KEY(key);
    if (!ec) return false;
    const EC_GROUP *group = EC_KEY_get0_group(ec);
    return group && EC_GROUP_get_curve_name(group) == NID_X9_62_prime256v1;
}
 
#endif /* CWIST_TLS_MBEDTLS */
 
static unsigned char *jwt_sign_bytes(jwt_alg_t alg, const char *key, const char *msg,
                                     size_t msg_len, size_t *out_len) {
    if (alg == JWT_ALG_HS256) {
        unsigned char *sig = (unsigned char *)cwist_alloc(32);
        if (!sig) return NULL;
        if (!hmac_sha256(key, strlen(key), msg, msg_len, sig)) {
            cwist_free(sig);
            return NULL;
        }
        *out_len = 32;
        return sig;
    }
 
#if defined(CWIST_TLS_MBEDTLS)
    if (alg == JWT_ALG_ES256) {
        unsigned char hash[32];
        if (!jwt_sha256(msg, msg_len, hash)) return NULL;
        return jwt_mbedtls_es256_sign(key, hash, out_len);
    }
    /* EdDSA: mbedTLS 3.6 LTS has no Ed25519; report signing failure rather
     * than emitting an unverifiable token. */
    return NULL;
#else
    EVP_PKEY *pkey = jwt_load_private_key(key);
    if (!pkey) return NULL;
    if (alg == JWT_ALG_ES256 && !jwt_key_is_p256(pkey)) {
        EVP_PKEY_free(pkey);
        return NULL;
    }
    if (alg == JWT_ALG_ED25519 && EVP_PKEY_id(pkey) != EVP_PKEY_ED25519) {
        EVP_PKEY_free(pkey);
        return NULL;
    }
 
    EVP_MD_CTX *ctx = EVP_MD_CTX_new();
    if (!ctx) {
        EVP_PKEY_free(pkey);
        return NULL;
    }
    const EVP_MD *md = (alg == JWT_ALG_ES256) ? EVP_sha256() : NULL;
    unsigned char *sig = NULL;
    if (EVP_DigestSignInit(ctx, NULL, md, NULL, pkey) != 1) goto fail;
 
    size_t raw_len = 0;
    if (EVP_DigestSign(ctx, NULL, &raw_len, (const unsigned char *)msg, msg_len) != 1) goto fail;
    {
        unsigned char *raw = (unsigned char *)cwist_alloc(raw_len);
        if (!raw) goto fail;
        if (EVP_DigestSign(ctx, raw, &raw_len, (const unsigned char *)msg, msg_len) != 1) {
            cwist_free(raw);
            goto fail;
        }
        if (alg == JWT_ALG_ED25519) {
            sig = raw; /* Ed25519 signs directly in JOSE form (64 bytes) */
            *out_len = raw_len;
        } else {
            /* Convert the ASN.1 DER ECDSA signature to raw 32-byte R||S. */
            sig = (unsigned char *)cwist_alloc(64);
            if (!sig) {
                cwist_free(raw);
                goto fail;
            }
            ECDSA_SIG *ecsig = ECDSA_SIG_from_bytes(raw, raw_len);
            cwist_free(raw);
            if (!ecsig) {
                cwist_free(sig);
                sig = NULL;
                goto fail;
            }
            const BIGNUM *r, *s;
            ECDSA_SIG_get0(ecsig, &r, &s);
            if (BN_bn2bin_padded(sig, 32, r) != 1 ||
                BN_bn2bin_padded(sig + 32, 32, s) != 1) {
                ECDSA_SIG_free(ecsig);
                cwist_free(sig);
                sig = NULL;
                goto fail;
            }
            ECDSA_SIG_free(ecsig);
            *out_len = 64;
        }
    }
 
    EVP_MD_CTX_free(ctx);
    EVP_PKEY_free(pkey);
    return sig;
 
fail:
    EVP_MD_CTX_free(ctx);
    EVP_PKEY_free(pkey);
    return NULL;
#endif /* CWIST_TLS_MBEDTLS */
}
 
static bool jwt_verify_bytes(jwt_alg_t alg, const char *key, const char *msg, size_t msg_len,
                             const unsigned char *sig, size_t sig_len) {
 
    if (alg == JWT_ALG_HS256) {
        unsigned char expected[32];
        if (sig_len != 32) return false;
        if (!hmac_sha256(key, strlen(key), msg, msg_len, expected)) return false;
        int cmp = 0;
        for (int i = 0; i < 32; i++) {
            cmp |= expected[i] ^ sig[i];
        }
        return cmp == 0;
    }
 
#if defined(CWIST_TLS_MBEDTLS)
    if (alg == JWT_ALG_ES256) {
        unsigned char hash[32];
        if (!jwt_sha256(msg, msg_len, hash)) return false;
        return jwt_mbedtls_es256_verify(key, hash, sig, sig_len);
    }
    /* EdDSA: mbedTLS 3.6 LTS has no Ed25519; verification always fails. */
    return false;
#else
    bool ok = false;
    EVP_MD_CTX *ctx = NULL;
    EVP_PKEY *pkey = jwt_load_public_key(key);
    if (!pkey) return false;
    if (alg == JWT_ALG_ES256 && !jwt_key_is_p256(pkey)) goto fail;
    if (alg == JWT_ALG_ED25519 && EVP_PKEY_id(pkey) != EVP_PKEY_ED25519) goto fail;
 
    ctx = EVP_MD_CTX_new();
    if (!ctx) goto fail;
    const EVP_MD *md = (alg == JWT_ALG_ES256) ? EVP_sha256() : NULL;
    if (EVP_DigestVerifyInit(ctx, NULL, md, NULL, pkey) != 1) goto out_ctx;
 
    if (alg == JWT_ALG_ED25519) {
        ok = EVP_DigestVerify(ctx, sig, sig_len, (const unsigned char *)msg, msg_len) == 1;
    } else {
        /* Re-encode raw R||S as the ASN.1 DER the EVP interface expects. */
        if (sig_len != 64) goto out_ctx;
        BIGNUM *r = BN_bin2bn(sig, 32, NULL);
        BIGNUM *s = BN_bin2bn(sig + 32, 32, NULL);
        ECDSA_SIG *ecsig = ECDSA_SIG_new();
        if (!r || !s || !ecsig || ECDSA_SIG_set0(ecsig, r, s) != 1) {
            BN_free(r);
            BN_free(s);
            ECDSA_SIG_free(ecsig);
            goto out_ctx;
        }
        uint8_t *der = NULL;
        size_t der_len = 0;
        if (ECDSA_SIG_to_bytes(&der, &der_len, ecsig) == 1) {
            ok = EVP_DigestVerify(ctx, der, der_len, (const unsigned char *)msg, msg_len) == 1;
            OPENSSL_free(der);
        }
        ECDSA_SIG_free(ecsig); /* takes r and s */
    }
 
out_ctx:
    EVP_MD_CTX_free(ctx);
fail:
    EVP_PKEY_free(pkey);
    return ok;
#endif /* CWIST_TLS_MBEDTLS */
}
 
/* --------------------------------------------------------------------------
 * JWT claims (opaque struct)
 * -------------------------------------------------------------------------- */
 
struct cwist_jwt_claims {
    cJSON *json; 
};
 
/* --------------------------------------------------------------------------
 * Public API
 * -------------------------------------------------------------------------- */
 
static char *jwt_sign_common(jwt_alg_t alg, const char *payload_json, const char *key,
                             const char *kid, long exp_seconds) {
    if (!payload_json || !key) return NULL;
 
    /* --- Build header JSON ------------------------------------------------ */
    cJSON *header = cJSON_CreateObject();
    if (!header) return NULL;
    cJSON_AddStringToObject(header, "alg", jwt_alg_name(alg));
    cJSON_AddStringToObject(header, "typ", "JWT");
    if (kid) {
        cJSON_AddStringToObject(header, "kid", kid);
    }
    char *header_json = cJSON_PrintUnformatted(header);
    cJSON_Delete(header);
    if (!header_json) return NULL;
 
    /* --- Optionally inject exp/iat into payload --------------------------- */
    cJSON *payload = cJSON_Parse(payload_json);
    if (!payload) {
        cJSON_free(header_json);
        return NULL;
    }
 
    if (exp_seconds > 0) {
        time_t now = time(NULL);
        /* Only add if not already present */
        if (!cJSON_GetObjectItemCaseSensitive(payload, "iat")) {
            cJSON_AddNumberToObject(payload, "iat", (double)now);
        }
        if (!cJSON_GetObjectItemCaseSensitive(payload, "exp")) {
            cJSON_AddNumberToObject(payload, "exp", (double)(now + exp_seconds));
        }
    }
 
    char *final_payload_json = cJSON_PrintUnformatted(payload);
    cJSON_Delete(payload);
    if (!final_payload_json) {
        cJSON_free(header_json);
        return NULL;
    }
 
    /* --- Base64URL encode header and payload ------------------------------ */
    size_t hdr_enc_len = b64url_encoded_len(strlen(header_json));
    size_t pay_enc_len = b64url_encoded_len(strlen(final_payload_json));
 
    char *hdr_enc CWIST_DEFER_FREE = (char *)cwist_alloc(hdr_enc_len);
    char *pay_enc CWIST_DEFER_FREE = (char *)cwist_alloc(pay_enc_len);
    if (!hdr_enc || !pay_enc) {
        cJSON_free(header_json);
        cJSON_free(final_payload_json);
        return NULL;
    }
 
    b64url_encode((const unsigned char *)header_json, strlen(header_json), hdr_enc);
    b64url_encode((const unsigned char *)final_payload_json, strlen(final_payload_json), pay_enc);
    cJSON_free(header_json);
    cJSON_free(final_payload_json);
 
    /* --- Build "header.payload" signing input using sstring --------------- */
    cwist_sstring *signing_input = cwist_sstring_create();
    if (!signing_input) {
        return NULL;
    }
    cwist_sstring_append(signing_input, hdr_enc);
    cwist_sstring_append(signing_input, ".");
    cwist_sstring_append(signing_input, pay_enc);
 
    /* --- Compute the signature -------------------------------------------- */
    size_t sig_len = 0;
    unsigned char *sig_raw = jwt_sign_bytes(alg, key, signing_input->data, signing_input->size,
                                            &sig_len);
    if (!sig_raw) {
        cwist_sstring_destroy(signing_input);
        return NULL;
    }
 
    size_t sig_enc_len = b64url_encoded_len(sig_len);
    char *sig_enc CWIST_DEFER_FREE = (char *)cwist_alloc(sig_enc_len);
    if (!sig_enc) {
        cwist_free(sig_raw);
        cwist_sstring_destroy(signing_input);
        return NULL;
    }
    b64url_encode(sig_raw, sig_len, sig_enc);
    cwist_free(sig_raw);
 
    /* --- Assemble final token using sstring ------------------------------- */
    cwist_sstring *token = cwist_sstring_create();
    if (!token) {
        cwist_sstring_destroy(signing_input);
        return NULL;
    }
    cwist_sstring_append(token, signing_input->data);
    cwist_sstring_append(token, ".");
    cwist_sstring_append(token, sig_enc);
 
    char *result = cwist_strdup(token->data);
 
    cwist_sstring_destroy(token);
    cwist_sstring_destroy(signing_input);
 
    return result;
}
 
char *cwist_jwt_sign(const char *payload_json, const char *secret, long exp_seconds) {
    return jwt_sign_common(JWT_ALG_HS256, payload_json, secret, NULL, exp_seconds);
}
 
char *cwist_jwt_sign_es256(const char *payload_json, const char *pem_private_key, const char *kid,
                           long exp_seconds) {
    return jwt_sign_common(JWT_ALG_ES256, payload_json, pem_private_key, kid, exp_seconds);
}
 
char *cwist_jwt_sign_ed25519(const char *payload_json, const char *pem_private_key,
                             const char *kid, long exp_seconds) {
    return jwt_sign_common(JWT_ALG_ED25519, payload_json, pem_private_key, kid, exp_seconds);
}
 
static cwist_jwt_claims *jwt_verify_common(jwt_alg_t alg, const char *token, const char *key) {
    if (!token || !key) return NULL;
 
    /* --- Split the token into three parts --------------------------------- */
    /* We need mutable copies to split on '.' */
    char *tok_copy = cwist_strdup(token);
    if (!tok_copy) return NULL;
 
    char *dot1 = strchr(tok_copy, '.');
    if (!dot1) {
        cwist_free(tok_copy);
        return NULL;
    }
    *dot1 = '\0';
 
    char *dot2 = strchr(dot1 + 1, '.');
    if (!dot2) {
        cwist_free(tok_copy);
        return NULL;
    }
    *dot2 = '\0';
 
    /* --- Validate the header: must declare exactly our alg (RFC 8725 3.1) - */
    size_t hdr_json_len = 0;
    unsigned char *hdr_json = b64url_decode(tok_copy, strlen(tok_copy), &hdr_json_len);
    if (!hdr_json) {
        cwist_free(tok_copy);
        return NULL;
    }
    cJSON *hdr = cJSON_ParseWithLength((const char *)hdr_json, hdr_json_len);
    cwist_free(hdr_json);
    if (!hdr) {
        cwist_free(tok_copy);
        return NULL;
    }
    cJSON *alg_item = cJSON_GetObjectItemCaseSensitive(hdr, "alg");
    bool alg_ok = alg_item && cJSON_IsString(alg_item) &&
                  strcmp(alg_item->valuestring, jwt_alg_name(alg)) == 0;
    cJSON_Delete(hdr);
    if (!alg_ok) {
        cwist_free(tok_copy);
        return NULL;
    }
 
    const char *pay_enc = dot1 + 1;
    const char *sig_enc = dot2 + 1;
 
    /* --- Decode the provided signature ------------------------------------ */
    size_t provided_sig_len = 0;
    unsigned char *provided_sig = b64url_decode(sig_enc, strlen(sig_enc), &provided_sig_len);
    if (!provided_sig) {
        cwist_free(tok_copy);
        return NULL;
    }
 
    /* --- Verify over the original "hdr_enc.pay_enc" signing input --------- */
    size_t first_two_len = (size_t)(dot2 - tok_copy);
    bool sig_ok = jwt_verify_bytes(alg, key, token, first_two_len, provided_sig,
                                   provided_sig_len);
    cwist_free(provided_sig);
    if (!sig_ok) {
        cwist_free(tok_copy);
        return NULL; /* signature mismatch */
    }
 
    /* --- Decode and parse the payload ------------------------------------- */
    size_t pay_json_len = 0;
    unsigned char *pay_json = b64url_decode(pay_enc, strlen(pay_enc), &pay_json_len);
    cwist_free(tok_copy);
 
    if (!pay_json) return NULL;
 
    cJSON *json = cJSON_ParseWithLength((const char *)pay_json, pay_json_len);
    cwist_free(pay_json);
 
    if (!json) return NULL;
 
    /* --- Validate "exp" and "nbf" claims with leeway for clock skew/high-RTT --- */
#define CWIST_JWT_TIME_LEEWAY 300
    time_t now = time(NULL);
    cJSON *exp_item = cJSON_GetObjectItemCaseSensitive(json, "exp");
    if (exp_item && cJSON_IsNumber(exp_item)) {
        time_t exp_time = (time_t)exp_item->valuedouble;
        if (now > CWIST_JWT_TIME_LEEWAY && exp_time < now - CWIST_JWT_TIME_LEEWAY) {
            cJSON_Delete(json);
            return NULL; /* token expired */
        }
    }
    cJSON *nbf_item = cJSON_GetObjectItemCaseSensitive(json, "nbf");
    if (nbf_item && cJSON_IsNumber(nbf_item)) {
        time_t nbf_time = (time_t)nbf_item->valuedouble;
        if (nbf_time > now && (nbf_time - now) > CWIST_JWT_TIME_LEEWAY) {
            cJSON_Delete(json);
            return NULL; /* token not yet valid */
        }
    }
 
    /* --- Build and return claims object ----------------------------------- */
    cwist_jwt_claims *claims = (cwist_jwt_claims *)cwist_alloc(sizeof(cwist_jwt_claims));
    if (!claims) {
        cJSON_Delete(json);
        return NULL;
    }
    claims->json = json;
    return claims;
}
 
cwist_jwt_claims *cwist_jwt_verify(const char *token, const char *secret) {
    return jwt_verify_common(JWT_ALG_HS256, token, secret);
}
 
cwist_jwt_claims *cwist_jwt_verify_es256(const char *token, const char *pem_key) {
    return jwt_verify_common(JWT_ALG_ES256, token, pem_key);
}
 
cwist_jwt_claims *cwist_jwt_verify_ed25519(const char *token, const char *pem_key) {
    return jwt_verify_common(JWT_ALG_ED25519, token, pem_key);
}
 
const char *cwist_jwt_claims_get(const cwist_jwt_claims *claims, const char *key) {
    if (!claims || !key) return NULL;
    cJSON *item = cJSON_GetObjectItemCaseSensitive(claims->json, key);
    if (!item) return NULL;
    if (cJSON_IsString(item)) return item->valuestring;
    /* For numeric claims return the raw JSON representation */
    return NULL;
}
 
void cwist_jwt_claims_destroy(cwist_jwt_claims *claims) {
    if (!claims) return;
    cJSON_Delete(claims->json);
    cwist_free(claims);
}
 
/* --------------------------------------------------------------------------
 * Sequenced JWT transport helpers
 * -------------------------------------------------------------------------- */
 
cwist_jwt_chunk_t *cwist_jwt_split_chunks(const char *token, uint16_t chunk_payload_size,
                                          size_t *out_count) {
    if (!token || chunk_payload_size == 0 || !out_count) return NULL;
    *out_count = 0;
 
    size_t token_len = strlen(token);
    if (token_len == 0) return NULL;
 
    cwist_seq_message_t msg;
    if (!cwist_seq_split((const uint8_t *)token, token_len, chunk_payload_size, &msg)) {
        return NULL;
    }
 
    cwist_jwt_chunk_t *chunks =
        (cwist_jwt_chunk_t *)cwist_alloc_array(msg.count, sizeof(cwist_jwt_chunk_t));
    if (!chunks) {
        cwist_seq_message_free(&msg);
        return NULL;
    }
 
    for (size_t i = 0; i < msg.count; i++) {
        chunks[i].data = msg.chunks[i];
        chunks[i].len = msg.chunk_lens[i];
        msg.chunks[i] = NULL; /* ownership transferred */
    }
 
    size_t count = msg.count;
    cwist_seq_message_free(&msg);
    *out_count = count;
    return chunks;
}
 
void cwist_jwt_chunks_free(cwist_jwt_chunk_t *chunks, size_t count) {
    if (!chunks) return;
    for (size_t i = 0; i < count; i++) cwist_free(chunks[i].data);
    cwist_free(chunks);
}
 
char *cwist_jwt_join_chunks(const cwist_jwt_chunk_t *chunks, size_t count) {
    if (!chunks || count == 0) return NULL;
 
    cwist_seq_assembler_t *a = cwist_seq_assembler_create();
    if (!a) return NULL;
 
    for (size_t i = 0; i < count; i++) {
        cwist_seq_chunk_t chunk;
        if (!cwist_seq_chunk_parse(chunks[i].data, chunks[i].len, &chunk)) {
            cwist_seq_assembler_destroy(a);
            return NULL;
        }
        if (!cwist_seq_assembler_feed(a, &chunk)) {
            cwist_seq_assembler_destroy(a);
            return NULL;
        }
    }
 
    const uint8_t *data = NULL;
    size_t len = 0;
    bool ok = cwist_seq_assembler_get_data(a, &data, &len);
    char *token = NULL;
    if (ok && len > 0) {
        token = (char *)cwist_alloc(len + 1);
        if (token) {
            memcpy(token, data, len);
            token[len] = '\0';
        }
    }
 
    cwist_seq_assembler_destroy(a);
    return token;
}
 
cwist_jwt_chunk_t *cwist_jwt_sign_chunks(const char *payload_json, const char *secret,
                                         long exp_seconds, uint16_t chunk_payload_size,
                                         size_t *out_count) {
    if (!payload_json || !secret || chunk_payload_size == 0 || !out_count) return NULL;
    *out_count = 0;
 
    char *token = cwist_jwt_sign(payload_json, secret, exp_seconds);
    if (!token) return NULL;
 
    cwist_jwt_chunk_t *chunks = cwist_jwt_split_chunks(token, chunk_payload_size, out_count);
    cwist_free(token);
    return chunks;
}
 
cwist_jwt_claims *cwist_jwt_verify_chunks(const cwist_jwt_chunk_t *chunks, size_t count,
                                          const char *secret) {
    if (!chunks || count == 0 || !secret) return NULL;
    char *token = cwist_jwt_join_chunks(chunks, count);
    if (!token) return NULL;
    cwist_jwt_claims *claims = cwist_jwt_verify(token, secret);
    cwist_free(token);
    return claims;
}