Token Refactor Step 2.2: introduce security context

[paullatzelsperger]

Feature Request

Step 2.2 of the token refactoring deals with the refactoring of the TokenValidationService. Different types of tokens require different verification and validation rules. Furthermore, resolving the public key with which to verify the token could depend on the calling code: some public keys are resolved from a DID, some are resolve from a PKI, others may be configured in the settings etc.

Which Areas Would Be Affected?

jwt-spi, oauth2-core

Why Is the Feature Desired?

the same type (as in: Java type) of token may need be validated and verified differently depending on the calling code.

Solution Proposal

public interface TokenValidationService {
    Result<ClaimToken> validate(TokenRepresentation representation, PublicKeyResolver resolver, TokenValidationRule... rules);
    Result<ClaimToken> validate(@NotNull String token, PublicKeyResolver resolver, TokenValidationRule... rules);
}