<?php
// Verify a CodeB JWT locally in PHP.
// Signed with RS256 against the tenant JWKS. European Digital Identity
// Wallet id_tokens are validated the same way.
// [jwt-validation-cookbook 2026-07-23]
// composer require firebase/php-jwt

require __DIR__ . '/vendor/autoload.php';

use Firebase\JWT\JWT;
use Firebase\JWT\JWK;
use Firebase\JWT\CachedKeySet;
use GuzzleHttp\Psr7\HttpFactory;
use Symfony\Component\Cache\Adapter\FilesystemAdapter;

const ISSUER   = 'https://<CODEB_TENANT_HOST>';
const AUDIENCE = '<YOUR_CLIENT_ID>';
const JWKS_URL = ISSUER . '/.well-known/jwks.json';

// CachedKeySet fetches once, caches to PSR-6, honours HTTP cache headers.
$factory = new HttpFactory();
$cache   = new FilesystemAdapter('codeb-jwks', 600, sys_get_temp_dir());
$keys    = new CachedKeySet(JWKS_URL, new \GuzzleHttp\Client(),
                            $factory, $cache, 600, true);

function verify(string $token, $keys): array {
    JWT::$leeway = 5;
    $claims = (array) JWT::decode($token, $keys);
    if (($claims['iss'] ?? '') !== ISSUER)    throw new RuntimeException('bad iss');
    if (($claims['aud'] ?? '') !== AUDIENCE)  throw new RuntimeException('bad aud');
    return $claims;
}

// Example
$claims = verify($argv[1], $keys);
printf("sub  = %s\nrole = %s\n", $claims['sub'], $claims['role'] ?? 'user');

// RFCs: 7519 (JWT), 7517 (JWK), 7518 (JWA).