Sessão, JWT e OAuth2

import { SignJWT, jwtVerify } from "jose";

const segredo = new TextEncoder().encode(process.env.JWT_SECRET);
const EMISSOR = "https://api.loja.com.br";
const PUBLICO = "loja-web";

export async function emitirToken(usuarioId: string) {
  return new SignJWT({ papel: "cliente" })
    .setProtectedHeader({ alg: "HS256" })
    .setSubject(usuarioId)
    .setIssuer(EMISSOR)
    .setAudience(PUBLICO)
    .setIssuedAt()
    .setExpirationTime("15m")
    .sign(segredo);
}

export async function validarToken(token: string) {
  const { payload } = await jwtVerify(token, segredo, {
    algorithms: ["HS256"],
    issuer: EMISSOR,
    audience: PUBLICO,
  });
  return payload;
}

import os
from datetime import datetime, timedelta, timezone

import jwt

SEGREDO = os.environ["JWT_SECRET"]
EMISSOR = "https://api.loja.com.br"
PUBLICO = "loja-web"


def emitir_token(usuario_id: str) -> str:
    agora = datetime.now(timezone.utc)
    payload = {
        "sub": usuario_id,
        "papel": "cliente",
        "iss": EMISSOR,
        "aud": PUBLICO,
        "iat": agora,
        "exp": agora + timedelta(minutes=15),
    }
    return jwt.encode(payload, SEGREDO, algorithm="HS256")


def validar_token(token: str) -> dict:
    return jwt.decode(
        token,
        SEGREDO,
        algorithms=["HS256"],
        issuer=EMISSOR,
        audience=PUBLICO,
    )

package auth

import (
	"os"
	"time"

	"github.com/golang-jwt/jwt/v5"
)

var segredo = []byte(os.Getenv("JWT_SECRET"))

const (
	emissor = "https://api.loja.com.br"
	publico = "loja-web"
)

func EmitirToken(usuarioID string) (string, error) {
	agora := time.Now()
	claims := jwt.MapClaims{
		"sub":   usuarioID,
		"papel": "cliente",
		"iss":   emissor,
		"aud":   publico,
		"iat":   agora.Unix(),
		"exp":   agora.Add(15 * time.Minute).Unix(),
	}
	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
	return token.SignedString(segredo)
}

func ValidarToken(bruto string) (jwt.MapClaims, error) {
	claims := jwt.MapClaims{}
	_, err := jwt.ParseWithClaims(bruto, claims,
		func(t *jwt.Token) (any, error) { return segredo, nil },
		jwt.WithValidMethods([]string{"HS256"}),
		jwt.WithIssuer(emissor),
		jwt.WithAudience(publico),
		jwt.WithExpirationRequired(),
	)
	return claims, err
}

import io.jsonwebtoken.Claims;
import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.security.Keys;
import java.nio.charset.StandardCharsets;
import java.time.Instant;
import java.time.temporal.ChronoUnit;
import java.util.Date;
import javax.crypto.SecretKey;

public class Tokens {
    private static final String EMISSOR = "https://api.loja.com.br";
    private static final String PUBLICO = "loja-web";
    private static final SecretKey CHAVE = Keys.hmacShaKeyFor(
        System.getenv("JWT_SECRET").getBytes(StandardCharsets.UTF_8));

    public static String emitir(String usuarioId) {
        Instant agora = Instant.now();
        return Jwts.builder()
            .subject(usuarioId)
            .claim("papel", "cliente")
            .issuer(EMISSOR)
            .audience().add(PUBLICO).and()
            .issuedAt(Date.from(agora))
            .expiration(Date.from(agora.plus(15, ChronoUnit.MINUTES)))
            .signWith(CHAVE)
            .compact();
    }

    public static Claims validar(String token) {
        return Jwts.parser()
            .verifyWith(CHAVE)
            .requireIssuer(EMISSOR)
            .requireAudience(PUBLICO)
            .build()
            .parseSignedClaims(token)
            .getPayload();
    }
}

using System.Security.Claims;
using System.Text;
using Microsoft.IdentityModel.JsonWebTokens;
using Microsoft.IdentityModel.Tokens;

public class Tokens
{
    private const string Emissor = "https://api.loja.com.br";
    private const string Publico = "loja-web";

    private static readonly SymmetricSecurityKey Chave = new(
        Encoding.UTF8.GetBytes(Environment.GetEnvironmentVariable("JWT_SECRET")!));

    private static readonly JsonWebTokenHandler Handler = new();

    public static string Emitir(string usuarioId) =>
        Handler.CreateToken(new SecurityTokenDescriptor
        {
            Subject = new ClaimsIdentity(
            [
                new Claim("sub", usuarioId),
                new Claim("papel", "cliente"),
            ]),
            Issuer = Emissor,
            Audience = Publico,
            Expires = DateTime.UtcNow.AddMinutes(15),
            SigningCredentials = new SigningCredentials(
                Chave, SecurityAlgorithms.HmacSha256),
        });

    public static async Task<IDictionary<string, object>> Validar(string token)
    {
        var resultado = await Handler.ValidateTokenAsync(token,
            new TokenValidationParameters
            {
                ValidIssuer = Emissor,
                ValidAudience = Publico,
                IssuerSigningKey = Chave,
                ValidAlgorithms = [SecurityAlgorithms.HmacSha256],
            });

        if (!resultado.IsValid)
        {
            throw resultado.Exception;
        }
        return resultado.Claims;
    }
}