jwt

$Token Inspection Gopher$

Typesafe parsing of Corti Keycloak access tokens.

Usage

import "github.com/corticph/gocomo/jwt"

claims, err := jwt.ParseUnverified(tokenString)
if err != nil {
    // handle malformed token
}

project := claims.ProjectID()         // corti.console_project_id, falling back to the project group
projectUUID := claims.ProjectUUID()   // corti.console_project_uuid, both token families

Context

SetClaimsInContext / GetClaimsFromContext store and retrieve parsed claims from a context.Context, mirroring the pattern in common-client/jwtcontext for raw token strings.

ctx = jwt.SetClaimsInContext(ctx, claims)
// later:
claims, err := jwt.GetClaimsFromContext(ctx)

Token model

Corti tokens come in two client families, with some differences in their claims:

	Direct	Delegated
`client_id`	present	absent
`corti.console_project_id`	present	absent
`corti.console_project_uuid`	present	present

Functionally, that becomes:

	Direct	Delegated
`IsDirect()`	`true`	`false`
`IsDelegated()`	`false`	`true`
`ProjectID()`	`"corti-..."`	`"group-proj"` (from `groups`)
`ProjectUUID()`	`"3290825c-...."`	`"3290825c-...."`

CustomerID() resolves the customer segment from a platform-api/{projectID}/{customerID} group entry.

Verification

ParseUnverified decodes claims without checking the signature. It is safe only behind a gateway that has already verified the token (Envoy SecurityPolicy with remoteJWKS). Services that receive tokens directly must verify first.