Method VerifyResumeToken

tailnet/resume.go:92–105

VerifyResumeToken parses a signed tailnet resume token with the given key and returns the payload. If the token is invalid or expired, an error is returned.

(ctx context.Context, str string)

// returns the payload. If the token is invalid or expired, an error is
// returned.
func (p ResumeTokenKeyProvider) VerifyResumeToken(ctx context.Context, str string) (uuid.UUID, error) {
	var tok jwt.Claims
	err := jwtutils.Verify(ctx, p.key, str, &tok, jwtutils.WithVerifyExpected(jwt.Expected{
		Time: p.clock.Now(),
	}))
	if err != nil {
		return uuid.Nil, xerrors.Errorf("verify payload: %w", err)
	}
	parsed, err := uuid.Parse(tok.Subject)
	if err != nil {
		return uuid.Nil, xerrors.Errorf("parse peerID from token: %w", err)
	}
	return parsed, nil
}