create a websocket game server

game-server/internal/auth/jwt.go

@@ -0,0 +1,66 @@
+// Package auth implements parsing and validation of the JWT tokens used by
+// the game server. Both the game token and the user token are HS256-signed
+// with the same shared secret (the main server's secret_key_base).
+package auth
+
+import (
+	"fmt"
+
+	"github.com/golang-jwt/jwt/v5"
+)
+
+// GameClaims is the payload of the game token issued by the main server
+// when a match is created.
+type GameClaims struct {
+	MatchID    string `json:"match_id"`
+	Player1ID  int64  `json:"player1_id"`
+	Player2ID  int64  `json:"player2_id"`
+	GameServer string `json:"game_server"`
+	jwt.RegisteredClaims
+}
+
+// UserClaims is the payload of the personal token of a player.
+type UserClaims struct {
+	UserID int64 `json:"user_id"`
+	jwt.RegisteredClaims
+}
+
+func keyFunc(secret []byte) jwt.Keyfunc {
+	return func(t *jwt.Token) (any, error) {
+		if t.Method.Alg() != jwt.SigningMethodHS256.Alg() {
+			return nil, fmt.Errorf("unexpected signing method: %s", t.Method.Alg())
+		}
+		return secret, nil
+	}
+}
+
+// ParseGameToken verifies the signature and the expiration time of a game
+// token and returns its claims.
+func ParseGameToken(secret []byte, tokenString string) (*GameClaims, error) {
+	claims := &GameClaims{}
+	_, err := jwt.ParseWithClaims(tokenString, claims, keyFunc(secret),
+		jwt.WithValidMethods([]string{jwt.SigningMethodHS256.Alg()}),
+		jwt.WithExpirationRequired(),
+	)
+	if err != nil {
+		return nil, fmt.Errorf("invalid game token: %w", err)
+	}
+	if claims.MatchID == "" {
+		return nil, fmt.Errorf("invalid game token: empty match_id")
+	}
+	return claims, nil
+}
+
+// ParseUserToken verifies the signature and the expiration time of a user
+// token and returns its claims.
+func ParseUserToken(secret []byte, tokenString string) (*UserClaims, error) {
+	claims := &UserClaims{}
+	_, err := jwt.ParseWithClaims(tokenString, claims, keyFunc(secret),
+		jwt.WithValidMethods([]string{jwt.SigningMethodHS256.Alg()}),
+		jwt.WithExpirationRequired(),
+	)
+	if err != nil {
+		return nil, fmt.Errorf("invalid user token: %w", err)
+	}
+	return claims, nil
+}