Jwt — auth/jwt

# examples/auth/jwt.yaml
#
# Reference config demonstrating the jwt auth strategy.
# Three schemes are registered under this type:
#
#   jwt_rs256  — RSA-signed JWT (RS256); secret is the PEM-encoded public key
#   jwt_hs256  — HMAC-signed JWT (HS256); secret is the shared symmetric key
#   jwt_es256  — ECDSA-signed JWT (ES256); secret is the PEM-encoded public key
#
# The alg header is pinned to the declared scheme — algorithm-confusion attacks
# (e.g. signing HS256 with the RSA public key bytes) are rejected at startup.
#
# Optional claims:
#   expected_issuer   — enforces the `iss` claim
#   expected_audience — enforces the `aud` claim
#   body_hash_claim   — required unless allow_unbound_body is true; claim name
#                       whose value must equal the hex SHA-256 of the body
#   allow_unbound_body — opt out of body binding (JWT authenticates the caller only)
#
# timestamp_tolerance is used as JWT clock leeway (exp/nbf). It is optional
# for JWT schemes (unlike HMAC timestamped schemes where it is required).

server:
  addr: ":8080"
  max_body_bytes: 1048576

destinations:
  primary:
    type: "rabbitmq"
    rabbitmq:
      url: "${RABBITMQ_URL}"
      exchange: "hookway.webhooks"
      exchange_type: "direct"
      durable: true
      publish_timeout: "5s"
      declare_queues: true

flows:
  # RS256: Bearer token signed with an RSA private key. Hookway verifies with
  # the matching PEM-encoded RSA public key.
  # Set JWT_PUBLIC_KEY to the PEM-encoded RSA public key from your identity provider.
  jwt_webhook:
    nodes:
      - {id: in, type: http_trigger, path: /webhooks/jwt, methods: [POST]}
      - {id: body, type: read_body, max_bytes: 1048576}
      - {id: auth, type: auth, scheme: jwt_rs256, secret: "${JWT_PUBLIC_KEY}", signature_header: Authorization, timestamp_tolerance: "1m", expected_issuer: "https://your-idp.example.com", expected_audience: hookway, body_hash_claim: body_sha256}
      - {id: env, type: envelope, body_format: json}
      - {id: out, type: publish, destination: primary, target: jwt-events, create: true}
    edges: [in>body, body>auth, auth>env, env>out]