| | | 1 | | namespace ArturRios.Heimdall.Shared.Security; |
| | | 2 | | |
| | | 3 | | /// <summary>What a valid application token says, before the database is consulted (UC-57).</summary> |
| | | 4 | | /// <param name="ApplicationId">The application's <c>PublicId</c>.</param> |
| | | 5 | | /// <param name="ScopeId">Its scope's <c>PublicId</c>.</param> |
| | | 6 | | /// <param name="CredentialId">The issuing credential's <c>PublicId</c>.</param> |
| | | 7 | | /// <param name="ExpiresAt">When the token expires (UTC).</param> |
| | 64 | 8 | | public sealed record ApplicationTokenPrincipal(Guid ApplicationId, Guid ScopeId, Guid CredentialId, DateTime ExpiresAt); |
| | | 9 | | |
| | | 10 | | /// <summary> |
| | | 11 | | /// Validates an application token offline — signature against the current and previous keys, |
| | | 12 | | /// issuer, the application audience, lifetime with no clock skew, and the application kind |
| | | 13 | | /// (UC-57, TH-35). Whether the application, scope and credential are still live is the caller's |
| | | 14 | | /// question, answered against the database. |
| | | 15 | | /// </summary> |
| | | 16 | | public interface IApplicationTokenValidator |
| | | 17 | | { |
| | | 18 | | /// <param name="token">The bearer token presented to <c>GET /api/applications/self</c>.</param> |
| | | 19 | | /// <returns>The principal, or <see langword="null" /> when the token is not a valid application token.</returns> |
| | | 20 | | Task<ApplicationTokenPrincipal?> ValidateAsync(string? token); |
| | | 21 | | } |