import com.google.api.client.json.webtoken.JsonWebSignature; //导入依赖的package包/类
static FirebaseToken parse(JsonFactory jsonFactory, String tokenString) throws IOException {
  try {
    JsonWebSignature jws =
        JsonWebSignature.parser(jsonFactory)
            .setPayloadClass(FirebaseTokenImpl.Payload.class)
            .parse(tokenString);
    return new FirebaseToken(
        new FirebaseTokenImpl(
            jws.getHeader(),
            (FirebaseTokenImpl.Payload) jws.getPayload(),
            jws.getSignatureBytes(),
            jws.getSignedContentBytes()));
  } catch (IOException e) {
    throw new IOException(
        "Decoding Firebase ID token failed. Make sure you passed the entire string JWT "
            + "which represents an ID token. See https://firebase.google.com/docs/auth/admin/"
            + "verify-id-tokens for details on how to retrieve an ID token.",
        e);
  }
}
 

import com.google.api.client.json.webtoken.JsonWebSignature; //导入依赖的package包/类
public String createSignedCustomAuthTokenForUser(
    String uid, Map<String, Object> developerClaims, String issuer, PrivateKey privateKey)
    throws GeneralSecurityException, IOException {
  Preconditions.checkState(uid != null, "Uid must be provided.");
  Preconditions.checkState(issuer != null && !"".equals(issuer), "Must provide an issuer.");
  Preconditions.checkState(uid.length() <= 128, "Uid must be shorter than 128 characters.");

  JsonWebSignature.Header header = new JsonWebSignature.Header().setAlgorithm("RS256");

  long issuedAt = clock.currentTimeMillis() / 1000;
  FirebaseCustomAuthToken.Payload payload =
      new FirebaseCustomAuthToken.Payload()
          .setUid(uid)
          .setIssuer(issuer)
          .setSubject(issuer)
          .setAudience(FirebaseCustomAuthToken.FIREBASE_AUDIENCE)
          .setIssuedAtTimeSeconds(issuedAt)
          .setExpirationTimeSeconds(issuedAt + FirebaseCustomAuthToken.TOKEN_DURATION_SECONDS);

  if (developerClaims != null) {
    Collection<String> reservedNames = payload.getClassInfo().getNames();
    for (String key : developerClaims.keySet()) {
      if (reservedNames.contains(key)) {
        throw new IllegalArgumentException(
            String.format("developer_claims can not contain a reserved key: %s", key));
      }
    }
    GenericJson jsonObject = new GenericJson();
    jsonObject.putAll(developerClaims);
    payload.setDeveloperClaims(jsonObject);
  }

  return JsonWebSignature.signUsingRsaSha256(privateKey, factory, header, payload);
}
 

import com.google.api.client.json.webtoken.JsonWebSignature; //导入依赖的package包/类
/** Parses a JWT token string and extracts its headers and payload fields. */
public static FirebaseCustomAuthToken parse(JsonFactory jsonFactory, String tokenString)
    throws IOException {
  JsonWebSignature jws =
      JsonWebSignature.parser(jsonFactory).setPayloadClass(Payload.class).parse(tokenString);
  return new FirebaseCustomAuthToken(
      jws.getHeader(),
      (Payload) jws.getPayload(),
      jws.getSignatureBytes(),
      jws.getSignedContentBytes());
}
 

import com.google.api.client.json.webtoken.JsonWebSignature; //导入依赖的package包/类
private JsonWebSignature.Header createHeader() throws Exception {
  JsonWebSignature.Header header = new JsonWebSignature.Header();
  header.setAlgorithm(ALGORITHM);
  header.setType("JWT");
  header.setKeyId(PRIVATE_KEY_ID);
  return header;
}
 

import com.google.api.client.json.webtoken.JsonWebSignature; //导入依赖的package包/类
public static boolean verifySignature(JsonWebSignature token, List<PublicKey> keys)
    throws Exception {
  for (PublicKey key : keys) {
    if (token.verifySignature(key)) {
      return true;
    }
  }
  return false;
}
 

import com.google.api.client.json.webtoken.JsonWebSignature; //导入依赖的package包/类
private String getServiceAccountToken(GoogleCredential credential, String targetAudience)
    throws IOException, GeneralSecurityException {
  final TokenRequest request = new TokenRequest(
      this.httpTransport, JSON_FACTORY,
      new GenericUrl(credential.getTokenServerEncodedUrl()),
      "urn:ietf:params:oauth:grant-type:jwt-bearer");
  final Header header = jwtHeader();
  final Payload payload = jwtPayload(
      targetAudience, credential.getServiceAccountId(), credential.getTokenServerEncodedUrl());
  request.put("assertion", JsonWebSignature.signUsingRsaSha256(
      credential.getServiceAccountPrivateKey(), JSON_FACTORY, header, payload));
  final TokenResponse response = request.execute();
  return (String) response.get("id_token");
}
 

import com.google.api.client.json.webtoken.JsonWebSignature; //导入依赖的package包/类
public JSONWebToken(String emailAddress, Collection<String> scopes, PrivateKey privateKey)
        throws GeneralSecurityException, IOException {
    Payload payload = new Payload();
    // Get current time in second.
    long currentTime = TimeUnit.SECONDS.convert(Utils.getNowMicrosUtc(), TimeUnit.MICROSECONDS);
    payload.setIssuer(emailAddress);
    payload.setAudience(TOKEN_REQUEST_URI);
    payload.setIssuedAtTimeSeconds(currentTime);
    // Access token will expire in one hour.
    payload.setExpirationTimeSeconds(currentTime + ONE_HOUR_IN_SECOND);
    payload.put(SCOPE, Joiner.on(' ').join(scopes));
    this.assertion = JsonWebSignature.signUsingRsaSha256(privateKey, JSON_FACTORY, HEADER, payload);
}
 

import com.google.api.client.json.webtoken.JsonWebSignature; //导入依赖的package包/类
@Override
protected TokenResponse executeRefreshToken() throws IOException {
  if (getServiceAccountPrivateKey() == null) {
    return super.executeRefreshToken();
  }
  // service accounts: no refresh token; instead use private key to request new access token
  JsonWebSignature.Header header = new JsonWebSignature.Header();
  header.setAlgorithm("RS256");
  header.setType("JWT");
  header.setKeyId(getServiceAccountPrivateKeyId());
  JsonWebToken.Payload payload = new JsonWebToken.Payload();
  long currentTime = getClock().currentTimeMillis();
  payload.setIssuer(getServiceAccountId());
  payload.setAudience(getTokenServerEncodedUrl());
  payload.setIssuedAtTimeSeconds(currentTime / 1000);
  payload.setExpirationTimeSeconds(currentTime / 1000 + DEFAULT_TOKEN_EXPIRATION_SECONDS);
  payload.setSubject(getServiceAccountUser());
  payload.put("scope", Joiner.on(' ').join(getServiceAccountScopes()));
  try {
    String assertion = JsonWebSignature.signUsingRsaSha256(
        getServiceAccountPrivateKey(), getJsonFactory(), header, payload);
    TokenRequest request = new TokenRequest(
        getTransport(), getJsonFactory(), new GenericUrl(getTokenServerEncodedUrl()),
        "urn:ietf:params:oauth:grant-type:jwt-bearer");
    request.put("assertion", assertion);
    request.setRequestInitializer(getRequestInitializer());
    return request.execute();
  } catch (GeneralSecurityException exception) {
    IOException e = new IOException();
    e.initCause(exception);
    throw e;
  }
}
 

import com.google.api.client.json.webtoken.JsonWebSignature; //导入依赖的package包/类
private String createToken(JsonWebSignature.Header header, JsonWebToken.Payload payload)
    throws GeneralSecurityException, IOException {
  return JsonWebSignature.signUsingRsaSha256(privateKey, FACTORY, header, payload);
}