pub mod authority;
pub mod authority_grpc;
mod claims;
pub mod codec;
mod error;
mod extract;
mod jwks;
mod middleware;
pub mod scope;
pub mod service;
pub mod session;
pub mod share;
mod state;

pub use claims::{AppClaims, subject};
pub use codec::{
    ALG, ID_TOKEN_TYP, ISSUER, PRIVATE_KEY_BYTES, TYP, now_secs, sign, sign_typed, signing_key,
    verify as verify_claims, verify_id_token,
};
pub use ed25519_dalek::SigningKey;
pub use error::{ErrorBody, JwtError, JwtResult};
pub use extract::AppToken;
pub use jwks::{CRV, Jwk, Jwks, KTY};
pub use middleware::{InnerJwtMiddleware, JwtMiddleware};
pub use session::{
    AccessClaims, AuthUser, IdClaims, JwtVerifier, ServiceClaims, Session, SessionError,
    SessionUser, clear_refresh_cookie, clear_session_cookie, read_cookie, refresh_cookie,
    require_uid, session_cookie, session_guard,
};
pub use state::{
    JwtState, PLATFORM_AUDIENCE, installed, require_installed, verify, verify_for_audience,
};

pub fn at_hash(access_token: &str) -> String {
    use base64::Engine as _;
    use sha2::{Digest, Sha512};
    let digest = Sha512::digest(access_token.as_bytes());
    base64::engine::general_purpose::URL_SAFE_NO_PAD.encode(&digest[..digest.len() / 2])
}