at-container-registry/pkg/auth/token/claims.go

package token

import (
	"time"

	"atcr.io/pkg/auth"
	"github.com/golang-jwt/jwt/v5"
)

// Claims represents the JWT claims for registry authentication
// This follows the Docker Registry token specification
type Claims struct {
	jwt.RegisteredClaims
	Access []auth.AccessEntry `json:"access,omitempty"`
}

// NewClaims creates a new Claims structure with standard fields
func NewClaims(subject, issuer, audience string, expiration time.Duration, access []auth.AccessEntry) *Claims {
	now := time.Now()
	return &Claims{
		RegisteredClaims: jwt.RegisteredClaims{
			Subject:   subject,                    // User's DID
			Issuer:    issuer,                     // "atcr.io"
			Audience:  jwt.ClaimStrings{audience}, // Service name
			IssuedAt:  jwt.NewNumericDate(now),
			NotBefore: jwt.NewNumericDate(now),
			ExpiresAt: jwt.NewNumericDate(now.Add(expiration)),
		},
		Access: access,
	}
}