// jwtFromQuery returns a `jwtExtractor` that extracts token from query string.
424234
func jwtFromQuery(param string) jwtExtractor {
	return func(c echo.Context) (string, error) {
		token := c.Query(param)
		var err error
		if len(token) == 0 {
			return "", errors.New("empty jwt in query string")
		}
		return token, err
	}
}
1051291
func NewFromRawQuery(rawQuery string) *QueryString {
	qs := new(QueryString)
	qs.fields = make(map[string]string)

	for {
		i := strings.IndexRune(rawQuery, '=')
		if i == -1 {
			break
		}
		name := rawQuery[:i]
		rawQuery = rawQuery[i+1:]

		i = strings.IndexFunc(rawQuery, charClassDetector(1, 1))
		var value string
		if i == -1 {
			value = rawQuery
		} else {
			value = rawQuery[:i]
			rawQuery = rawQuery[i+1:]
		}

		qs.fields[name] = value

		if i == -1 {
			break
		}
	}

	return qs
}
289139
func jwtWrap(originalHandler http.HandlerFunc) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		addCommonJwtRespHeaders(w, r)
		// Look for JWT in both headers and request value "access_token".
		token, err := request.ParseFromRequest(r, TokenExtractor{}, func(token *jwt.Token) (interface{}, error) {
			// Token was signed with RSA method when it was initially granted
			if _, ok := token.Method.(*jwt.SigningMethodRSA); !ok {
				return nil, fmt.Errorf("Unexpected signing method: %v", token.Header["alg"])
			}
			return publicKey, nil
		})
		if err != nil || !token.Valid {
			http.Error(w, "", http.StatusUnauthorized)
			return
		}
		tokenClaims := token.Claims.(jwt.MapClaims)
		var url = strings.TrimPrefix(r.URL.Path, "/")
		var col = r.FormValue("col")
		// Call the API endpoint handler if authorization allows
		if tokenClaims[JWT_USER_ATTR] == JWT_USER_ADMIN {
			originalHandler(w, r)
			return
		}
		if !sliceContainsStr(tokenClaims[JWT_ENDPOINTS_ATTR], url) {
			http.Error(w, "", http.StatusUnauthorized)
			return
		} else if col != "" && !sliceContainsStr(tokenClaims[JWT_COLLECTIONS_ATTR], col) {
			http.Error(w, "", http.StatusUnauthorized)
			return
		}
		originalHandler(w, r)
	}
}
603159
func (q *Query) OrderExpr(order string, params ...interface{}) *Query {
	if order != "" {
		q.order = append(q.order, &queryParamsAppender{order, params})
	}
	return q
}
44039
func (token *JSONWebToken) decodeHeader() (err error) {
	var h ast.Value
	if h, err = builtinBase64UrlDecode(ast.String(token.header)); err != nil {
		return fmt.Errorf("JWT header had invalid encoding: %v", err)
	}
	if token.decodedHeader, err = validateJWTHeader(string(h.(ast.String))); err != nil {
		return err
	}
	return
}
699793
func (d *Data) ToClientQuery() *tap.Message {
	t := tap.Message_CLIENT_QUERY
	return &tap.Message{
		Type:           &t,
		SocketFamily:   &d.SocketFam,
		SocketProtocol: &d.SocketProto,
		QueryTimeSec:   &d.TimeSec,
		QueryMessage:   d.Packed,
		QueryAddress:   d.Address,
		QueryPort:      &d.Port,
	}
}
98944
func ExtractExactOnSingleWordQuery(opts ...interface{}) *opt.ExactOnSingleWordQueryOption {
	for _, o := range opts {
		if v, ok := o.(*opt.ExactOnSingleWordQueryOption); ok {
			return v
		}
	}
	return nil
}
321453
func (j *RS256JWTStrategy) Decode(ctx context.Context, token string) (*jwt.Token, error) {
	// Parse the token.
	parsedToken, err := jwt.Parse(token, func(t *jwt.Token) (interface{}, error) {
		if _, ok := t.Method.(*jwt.SigningMethodRSA); !ok {
			return nil, errors.Errorf("Unexpected signing method: %v", t.Header["alg"])
		}
		return &j.PrivateKey.PublicKey, nil
	})

	if err != nil {
		return parsedToken, errors.WithStack(err)
	} else if !parsedToken.Valid {
		return parsedToken, errors.WithStack(fosite.ErrInactiveToken)
	}

	return parsedToken, err
}
1073945
func (t *tokenWithProvider) fetchFromCache(ctx context.Context) error {
	key, err := t.provider.CacheKey(ctx)
	if err != nil {
		return err
	}
	tok, err := t.cache.GetToken(key)
	if err != nil {
		return err
	}
	t.token = tok
	return nil
}
863174
func getJWTConf(email string, pk PrivateKey) *jwt.Config {
	return &jwt.Config{
		Email:      email,
		PrivateKey: pk.Bytes(),
		Scopes:     []string{ContainerScope},
		TokenURL:   TokenURL,
	}
}
716403
func GetQuery(req *http.Request, key string) []string {
	if ok, value := extractQueries(req); ok {
		return value[key]
	}
	return nil
}
1125046
func ParseJWT(encoded []byte) (jwt.JWT, error) {
	t, err := parseCompact(encoded, true)
	if err != nil {
		return nil, err
	}
	c, ok := t.Payload().(map[string]interface{})
	if !ok {
		return nil, ErrIsNotJWT
	}
	t.SetPayload(Claims(c))
	return t, nil
}
127290
func GetScopestringFromJWT(token *jwt.Token) (scopestring string) {
	if token == nil {
		return
	}
	scopes := GetScopesFromJWT(token)
	scopestring = strings.Join(scopes, ",")
	return
}
583262
func (s *DB) QueryExpr() *expr {
	scope := s.NewScope(s.Value)
	scope.InstanceSet("skip_bindvar", true)
	scope.prepareQuerySQL()

	return Expr(scope.SQL, scope.SQLVars...)
}
573021
func initJWTAuthHandler() func(ctx *neptulon.ReqCtx) error {
	return func(ctx *neptulon.ReqCtx) error {
		// todo: this could rather send the remaining queue size for the client so client can disconnect if there is nothing else to do
		ctx.Res = client.ACK
		return ctx.Next()
	}
}
1139719
func csrfTokenFromQuery(param string) csrfTokenExtractor {
	return func(c echo.Context) (string, error) {
		token := c.Query(param)
		if token == "" {
			return "", errors.New("empty csrf token in query param")
		}
		return token, nil
	}
}
852856
func (txmgr *LockBasedTxMgr) NewQueryExecutor(txid string) (ledger.QueryExecutor, error) {
	qe := newQueryExecutor(txmgr, txid)
	txmgr.commitRWLock.RLock()
	return qe, nil
}