LavinMQ::Auth::JWT::TokenVerifier

OAuth 2.0 / OpenID Connect authenticator for LavinMQ.

Clients authenticate by providing a JWT token (RS256-signed) as the password field during AMQP/MQTT connection. The username field is used for logging only - authorization is based on permissions/scopes extracted from the JWT token.

Verification flow:

1. Prevalidate: Check JWT format, algorithm (RS256), and expiration
2. Verify signature: Decode JWT using OAuth provider's public keys (from JWKS)
3. Validate claims: Check issuer and optionally audience match configuration
4. Extract permissions: Parse scopes/roles and map to LavinMQ permissions

Token refresh: Clients send UpdateSecret frame with new JWT to update permissions without reconnecting. Username stays the same, only permissions/expiration are updated.

Public Key caching: Public keys are managed by a background fiber that periodically refreshes them based on TTL. Verification uses cached keys, blocking on a rate-limited on-demand fetch only until the first fetch has succeeded.

Security: Only RS256 accepted (prevents algorithm confusion), issuer/audience validation prevents accepting tokens from untrusted or unintended sources, fails closed on any error.