// KeyFunction returns a function that can be used to extract the key ID (kid) claim value from a JWT token
436999
func (m *tokenManager) KeyFunction(ctx context.Context) jwt.Keyfunc {
	return func(token *jwt.Token) (interface{}, error) {
		kid := token.Header["kid"]
		if kid == nil {
			log.Error(ctx, map[string]interface{}{}, "There is no 'kid' header in the token")
			return nil, errors.New("There is no 'kid' header in the token")
		}
		key := m.PublicKey(fmt.Sprintf("%s", kid))
		if key == nil {
			log.Error(ctx, map[string]interface{}{
				"kid": kid,
			}, "There is no public key with such ID")
			return nil, errors.New(fmt.Sprintf("There is no public key with such ID: %s", kid))
		}
		return key, nil
	}
}
746020
func keyFunc(name, namespace string, tr *authenticationv1.TokenRequest) string {
	var exp int64
	if tr.Spec.ExpirationSeconds != nil {
		exp = *tr.Spec.ExpirationSeconds
	}

	var ref authenticationv1.BoundObjectReference
	if tr.Spec.BoundObjectRef != nil {
		ref = *tr.Spec.BoundObjectRef
	}

	return fmt.Sprintf("%q/%q/%#v/%#v/%#v", name, namespace, tr.Spec.Audiences, exp, ref)
}
923095
func (l *State) ToGoFunction(index int) Function {
	switch v := l.indexToValue(index).(type) {
	case *goFunction:
		return v.Function
	case *goClosure:
		return v.function
	}
	return nil
}
610868
func KeyDown(listener func(*vecty.Event)) *vecty.EventListener {
	return &vecty.EventListener{Name: "keydown", Listener: listener}
}
814649
func BasicAuthHandlerFunc(h http.HandlerFunc,
	authFn func(string, string) (interface{}, bool), realm string) http.HandlerFunc {
	return BasicAuthHandler(h, authFn, realm)
}
731096
func (k *Kite) AuthenticateSimpleKiteKey(key string) (string, error) {
	claims := &kitekey.KiteClaims{}

	token, err := jwt.ParseWithClaims(key, claims, k.verify)
	if err != nil {
		return "", err
	}

	if !token.Valid {
		return "", errors.New("Invalid signature in token")
	}

	if claims.Subject == "" {
		return "", errors.New("token has no username")
	}

	return claims.Subject, nil
}
1298985
func ServiceFunction(g Generator, s *compile.ServiceSpec, f *compile.FunctionSpec) error {
	argsName := functionNamePrefix(s, f) + "Args"
	argsGen := fieldGroupGenerator{
		Namespace: NewNamespace(),
		Name:      argsName,
		Fields:    compile.FieldGroup(f.ArgsSpec),
		Doc: fmt.Sprintf(
			"%v represents the arguments for the %v.%v function.\n\n"+
				"The arguments for %v are sent and received over the wire as this struct.",
			argsName, s.Name, f.Name, f.Name,
		),
	}
	if err := argsGen.Generate(g); err != nil {
		return wrapGenerateError(fmt.Sprintf("%s.%s", s.Name, f.Name), err)
	}
	if err := functionArgsEnveloper(g, s, f); err != nil {
		return wrapGenerateError(fmt.Sprintf("%s.%s", s.Name, f.Name), err)
	}

	if err := functionHelper(g, s, f); err != nil {
		return wrapGenerateError(fmt.Sprintf("%s.%s", s.Name, f.Name), err)
	}

	if f.ResultSpec == nil {
		return nil
	}

	resultFields := make(compile.FieldGroup, 0, len(f.ResultSpec.Exceptions)+1)
	if f.ResultSpec.ReturnType != nil {
		resultFields = append(resultFields, &compile.FieldSpec{
			ID:   0,
			Name: "success",
			Type: f.ResultSpec.ReturnType,
			Doc:  fmt.Sprintf("Value returned by %v after a successful execution.", f.Name),
		})
	}
	resultFields = append(resultFields, f.ResultSpec.Exceptions...)

	resultName := functionNamePrefix(s, f) + "Result"
	resultDoc := fmt.Sprintf(
		"%v represents the result of a %v.%v function call.\n\n"+
			"The result of a %v execution is sent and received over the wire as this struct.",
		resultName, s.Name, f.Name, f.Name,
	)
	if f.ResultSpec.ReturnType != nil {
		resultDoc += fmt.Sprintf("\n\nSuccess is set only if the function did not throw an exception.")
	}

	resultGen := fieldGroupGenerator{
		Namespace:       NewNamespace(),
		Name:            resultName,
		Fields:          resultFields,
		IsUnion:         true,
		AllowEmptyUnion: f.ResultSpec.ReturnType == nil,
		Doc:             resultDoc,
	}
	if err := resultGen.Generate(g); err != nil {
		return wrapGenerateError(fmt.Sprintf("%s.%s", s.Name, f.Name), err)
	}
	if err := functionResponseEnveloper(g, s, f); err != nil {
		return wrapGenerateError(fmt.Sprintf("%s.%s", s.Name, f.Name), err)
	}

	// TODO(abg): If we receive unknown exceptions over the wire, we need to
	// throw a generic error.
	return nil
}
674101
func (a *Core) GetKeyAuthorization(token string) (string, error) {
	return a.jws.GetKeyAuthorization(token)
}
87814
func (b *Box) OnKeyEvent(ev KeyEvent) {
	for _, child := range b.children {
		child.OnKeyEvent(ev)
	}
}
1151351
func jwtFromCookie(name string) jwtExtractor {
	return func(c echo.Context) (string, error) {
		cookie, err := c.Cookie(name)
		if err != nil {
			return "", ErrJWTMissing
		}
		return cookie.Value, nil
	}
}
1306512
func (c LoginClient) PaperKeySubmit(ctx context.Context, __arg PaperKeySubmitArg) (err error) {
	err = c.Cli.Call(ctx, "keybase.1.login.paperKeySubmit", []interface{}{__arg}, nil)
	return
}
1230147
func (d RSAOAEPKeyDecrypt) KeyDecrypt(enckey []byte) ([]byte, error) {
	if debug.Enabled {
		debug.Printf("START OAEP.KeyDecrypt")
	}
	var hash hash.Hash
	switch d.alg {
	case jwa.RSA_OAEP:
		hash = sha1.New()
	case jwa.RSA_OAEP_256:
		hash = sha256.New()
	default:
		return nil, errors.New("failed to generate key encrypter for RSA-OAEP: RSA_OAEP/RSA_OAEP_256 required")
	}
	return rsa.DecryptOAEP(hash, rand.Reader, d.privkey, enckey, []byte{})
}
1188250
func getClaimsFromToken(r *http.Request) (map[string]interface{}, error) {
	claims := make(map[string]interface{})
	token := getSessionToken(r)
	if token == "" {
		return claims, nil
	}
	stsTokenCallback := func(jwtToken *jwtgo.Token) (interface{}, error) {
		// JWT token for x-amz-security-token is signed with admin
		// secret key, temporary credentials become invalid if
		// server admin credentials change. This is done to ensure
		// that clients cannot decode the token using the temp
		// secret keys and generate an entirely new claim by essentially
		// hijacking the policies. We need to make sure that this is
		// based an admin credential such that token cannot be decoded
		// on the client side and is treated like an opaque value.
		return []byte(globalServerConfig.GetCredential().SecretKey), nil
	}
	p := &jwtgo.Parser{
		ValidMethods: []string{
			jwtgo.SigningMethodHS256.Alg(),
			jwtgo.SigningMethodHS512.Alg(),
		},
	}
	jtoken, err := p.ParseWithClaims(token, jwtgo.MapClaims(claims), stsTokenCallback)
	if err != nil {
		return nil, err
	}
	if !jtoken.Valid {
		return nil, errAuthentication
	}
	v, ok := claims["accessKey"]
	if !ok {
		return nil, errInvalidAccessKeyID
	}
	if _, ok = v.(string); !ok {
		return nil, errInvalidAccessKeyID
	}
	return claims, nil
}
133784
func (k *Kite) AuthenticateFromToken(r *Request) error {
	k.verifyOnce.Do(k.verifyInit)

	token, err := jwt.ParseWithClaims(r.Auth.Key, &kitekey.KiteClaims{}, r.LocalKite.RSAKey)

	if e, ok := err.(*jwt.ValidationError); ok {
		// Translate public key mismatch errors to token-is-expired one.
		// This is to signal remote client the key pairs have been
		// updated on kontrol and it should invalidate all tokens.
		if (e.Errors & jwt.ValidationErrorSignatureInvalid) != 0 {
			return errors.New("token is expired")
		}
	}

	if err != nil {
		return err
	}

	if !token.Valid {
		return errors.New("Invalid signature in token")
	}

	claims, ok := token.Claims.(*kitekey.KiteClaims)
	if !ok {
		return errors.New("token does not have valid claims")
	}

	if claims.Audience == "" {
		return errors.New("token has no audience")
	}

	if claims.Subject == "" {
		return errors.New("token has no username")
	}

	// check if we have an audience and it matches our own signature
	if err := k.verifyAudienceFunc(k.Kite(), claims.Audience); err != nil {
		return err
	}

	// We don't check for exp and nbf claims here because jwt-go package
	// already checks them.

	// replace the requester username so we reflect the validated
	r.Username = claims.Subject

	return nil
}
756092
func (csp *impl) KeyGen(opts bccsp.KeyGenOpts) (k bccsp.Key, err error) {
	return nil, nil
}
441850
func PublicKeyAuth(fn PublicKeyHandler) Option {
	return func(srv *Server) error {
		srv.PublicKeyHandler = fn
		return nil
	}
}
784986
func (k *Kite) AuthenticateFromKiteKey(r *Request) error {
	claims := &kitekey.KiteClaims{}

	token, err := jwt.ParseWithClaims(r.Auth.Key, claims, k.verify)
	if err != nil {
		return err
	}

	if !token.Valid {
		return errors.New("Invalid signature in kite key")
	}

	if claims.Subject == "" {
		return errors.New("token has no username")
	}

	r.Username = claims.Subject

	return nil
}