// build.gradle.kts
kotlin {
    sourceSets {
        commonMain.dependencies {
            implementation("io.github.kotlinmania:jwt-kmp:0.3.1")
        }
    }
}

commonMain.dependencies {
    implementation(libs.jwt.kmp)
}

import io.github.kotlinmania.jwt.JWT
import io.github.kotlinmania.jwt.algorithms.Algorithm
import kotlin.time.Clock
import kotlin.time.Duration.Companion.hours

val algorithm = Algorithm.hmac256("super-secret")
val now = Clock.System.now()

val token: String =
    JWT.create()
        .withIssuer("auth.example.com")
        .withSubject("user-42")
        .withAudience("api.example.com")
        .withIssuedAt(now)
        .withExpiresAt(now + 1.hours)
        .withClaim("role", "admin")
        .sign(algorithm)

import io.github.kotlinmania.jwt.exceptions.JWTVerificationException
import io.github.kotlinmania.jwt.exceptions.TokenExpiredException

val verifier =
    JWT.require(algorithm)
        .withIssuer("auth.example.com")
        .withAudience("api.example.com")
        .withClaim("role", "admin")
        .acceptLeeway(5) // seconds of clock skew allowed for exp, nbf and iat
        .build()

try {
    val decoded = verifier.verify(token)
    println("subject = ${decoded.subject}")
} catch (e: TokenExpiredException) {
    // the token is past its exp claim
} catch (e: JWTVerificationException) {
    // bad signature, wrong issuer or audience, missing claim, ...
}

JWT.require(algorithm)
    .withClaim("role") { claim, _ -> claim.asString() in setOf("admin", "owner") }
    .build()

import io.github.kotlinmania.jwt.exceptions.JWTDecodeException

try {
    val decoded = JWT.decode(token)
    println(decoded.algorithm) // "HS256"
    println(decoded.getClaim("role").asString()) // "admin"
} catch (e: JWTDecodeException) {
    // not a well-formed JWT
}