// Sign-in tokens with PASETO: an encrypted session token, and a signed one other services check.
//
//   quillo run paseto.qwe      then open http://localhost:8080/session

use "paseto.qwer"

let LOCAL_KEY = env("PASETO_KEY") ?? paseto_local_key()?
let SIGNING = paseto_keypair()?

route GET /session {
    let token = paseto_encrypt({ sub: "user-7", role: "admin", cart: [12, 31] }, LOCAL_KEY, 3600)?
    let claims = paseto_decrypt(token, LOCAL_KEY)?
    { token, user: claims.sub, role: claims.role, cart: claims.cart, other_key: is_err(paseto_decrypt(token, paseto_local_key()?)) }
}

route GET /public {
    let token = paseto_sign({ sub: "service-billing", aud: "orders-api", scope: "orders:read" }, SIGNING.secret, 300)?
    let claims = paseto_verify(token, SIGNING.public)?
    { prefix: slice(token, 0, 10), service: claims.sub, scope: claims.scope, expires: claims.exp, forged: is_err(paseto_verify(token, paseto_keypair()?.public)) }
}