cabal-version:   3.0
name:            shomei-jwt
version:         0.1.0.0
synopsis:        JWT access-token signing/verification and JWKS publishing
description:
  Interprets Shōmei's signing-key effects with jose. Signs and verifies ES256
  (or, configurably, RS256) access tokens and OpenID Connect ID tokens,
  publishes the JWKS document that relying services fetch to verify those
  tokens offline, and implements key rotation with an overlap window so a
  retired key keeps verifying outstanding tokens until they expire. Depends
  only on shomei-core, so it can be used without Shōmei's HTTP or PostgreSQL
  layers.

homepage:        https://github.com/shinzui/shomei
bug-reports:     https://github.com/shinzui/shomei/issues
license:         MIT
license-file:    LICENSE
author:          Nadeem Bitar
maintainer:      nadeem@gmail.com
copyright:       2026 Nadeem Bitar
category:        Web, Security
tested-with:     GHC ==9.12.4
extra-doc-files: CHANGELOG.md

source-repository head
  type:     git
  location: https://github.com/shinzui/shomei.git

common warnings
  ghc-options:
    -Wall -Wcompat -Widentities -Wincomplete-record-updates
    -Wincomplete-uni-patterns -Wpartial-fields -Wredundant-constraints

common shared
  default-language:   GHC2024
  default-extensions:
    BlockArguments
    DeriveAnyClass
    DuplicateRecordFields
    MultilineStrings
    OverloadedLabels
    OverloadedRecordDot
    OverloadedStrings
    QualifiedDo
    TemplateHaskell

library
  import:          warnings, shared
  hs-source-dirs:  src
  exposed-modules:
    Shomei.SigningKey.Jwks.Jwt
    Shomei.SigningKey.Key.Jwt
    Shomei.SigningKey.Protection.Jwt
    Shomei.SigningKey.Rotation.Jwt
    Shomei.SigningKey.Sign.Jwt
    Shomei.SigningKey.Verify.Jwt

  build-depends:
    , aeson              >=2.1      && <2.3
    , base               >=4.18     && <5
    , base64-bytestring  >=1.2      && <1.3
    , bytestring         >=0.11     && <0.13
    , containers         >=0.6      && <0.9
    , crypton            >=1.1.0    && <1.2
    , effectful          >=2.5      && <2.8
    , effectful-core     >=2.5      && <2.8
    , jose               >=0.13     && <0.14
    , lens               >=5.2      && <5.4
    , monad-time         >=0.4      && <0.5
    , mtl                >=2.3      && <2.4
    , ram                >=0.22     && <0.23
    , shomei-core        ^>=0.1.0.0
    , text               >=2.0      && <2.2
    , time               >=1.12     && <1.15

test-suite shomei-jwt-test
  import:         warnings, shared
  type:           exitcode-stdio-1.0
  hs-source-dirs: test
  main-is:        Main.hs
  other-modules:
    Shomei.SigningKey.Interpreter.JwtSpec
    Shomei.SigningKey.Jwks.JwtSpec
    Shomei.SigningKey.Key.JwtSpec
    Shomei.SigningKey.Protection.JwtSpec
    Shomei.SigningKey.Rotation.JwtSpec
    Shomei.SigningKey.Sign.IdTokenSpec
    Shomei.SigningKey.Sign.JwtSpec
    Shomei.SigningKey.Sign.RsaCustomClaimSpec
    Shomei.SigningKey.TestSupport

  build-depends:
    , aeson        >=2.1      && <2.3
    , base         >=4.18     && <5
    , bytestring   >=0.11     && <0.13
    , containers   >=0.6      && <0.9
    , effectful    >=2.5      && <2.8
    , jose         >=0.13     && <0.14
    , lens         >=5.2      && <5.4
    , ram          >=0.22     && <0.23
    , shomei-core  ^>=0.1.0.0
    , shomei-jwt   ^>=0.1.0.0
    , tasty        >=1.4      && <1.6
    , tasty-hunit  >=0.10     && <0.11
    , text         >=2.0      && <2.2
    , time         >=1.12     && <1.15