Verify Upsolve tokens

// npm install jose
import { createRemoteJWKSet, jwtVerify } from "jose";

const ISSUER = "https://api.upsolve.ai/identity/p/<projectId>";
const upsolveKeys = createRemoteJWKSet(new URL(`${ISSUER}/jwks.json`));

export async function upsolveUser(req) {
  const raw = req.headers.authorization ?? "";
  if (!raw.startsWith("Bearer ")) return null;
  const { payload } = await jwtVerify(raw.slice(7), upsolveKeys, {
    issuer: ISSUER,
    audience: "https://api.acme.com",
    algorithms: ["ES256"],
  });
  return findUser(payload.sub, payload.org); // then authorize as that user
}

# pip install "pyjwt[crypto]"
import jwt

ISSUER = "https://api.upsolve.ai/identity/p/<projectId>"
upsolve_keys = jwt.PyJWKClient(f"{ISSUER}/jwks.json")

def upsolve_user(headers):
    raw = headers.get("Authorization", "")
    if not raw.startswith("Bearer "):
        return None
    token = raw[len("Bearer "):]
    key = upsolve_keys.get_signing_key_from_jwt(token)
    payload = jwt.decode(
        token, key.key, algorithms=["ES256"], issuer=ISSUER,
        audience="https://api.acme.com",
        options={"require": ["exp", "iat", "sub"]},
    )
    return find_user(payload["sub"], payload.get("org"))

// go get github.com/golang-jwt/jwt/v5 github.com/MicahParks/keyfunc/v3
const issuer = "https://api.upsolve.ai/identity/p/<projectId>"

var upsolveKeys, _ = keyfunc.NewDefault([]string{issuer + "/jwks.json"})

func UpsolveUser(r *http.Request) (string, error) {
	token, ok := strings.CutPrefix(r.Header.Get("Authorization"), "Bearer ")
	if !ok {
		return "", jwt.ErrTokenMalformed
	}
	parsed, err := jwt.Parse(token, upsolveKeys.Keyfunc,
		jwt.WithValidMethods([]string{"ES256"}),
		jwt.WithIssuer(issuer),
		jwt.WithAudience("https://api.acme.com"),
		jwt.WithExpirationRequired(),
	)
	if err != nil {
		return "", err
	}
	return parsed.Claims.GetSubject()
}

# gem "jwt"
ISSUER = "https://api.upsolve.ai/identity/p/<projectId>"

UPSOLVE_KEYS = lambda do |options|
  @upsolve_jwks = nil if options[:kid_not_found]
  @upsolve_jwks ||= JSON.parse(Net::HTTP.get(URI("#{ISSUER}/jwks.json")))
end

def upsolve_user(request)
  raw = request.headers["Authorization"].to_s
  return nil unless raw.start_with?("Bearer ")
  payload, _header = JWT.decode(raw.delete_prefix("Bearer "), nil, true, {
    algorithms: ["ES256"], jwks: UPSOLVE_KEYS,
    iss: ISSUER, verify_iss: true,
    aud: "https://api.acme.com", verify_aud: true,
  })
  find_user(payload["sub"], payload["org"])
end

// com.nimbusds:nimbus-jose-jwt
String issuer = "https://api.upsolve.ai/identity/p/<projectId>";
JWKSource<SecurityContext> keys = JWKSourceBuilder.create(new URL(issuer + "/jwks.json")).build();
DefaultJWTProcessor<SecurityContext> processor = new DefaultJWTProcessor<>();
processor.setJWSKeySelector(new JWSVerificationKeySelector<>(JWSAlgorithm.ES256, keys));
processor.setJWTClaimsSetVerifier(new DefaultJWTClaimsVerifier<>(
    "https://api.acme.com",
    new JWTClaimsSet.Builder().issuer(issuer).build(),
    Set.of("sub", "iat", "exp")));

// For each request, after stripping "Bearer ":
JWTClaimsSet claims = processor.process(token, null);
String userId = claims.getSubject(); // then authorize as that user