The 0.4.0 release enables support for claims signing and private key resolution.
Signed-off-by: Snorre Magnus Davøen <snorre.davoen@nsd.no>

[skip-ci]
Signed-off-by: Snorre Magnus Davøen <snorre.davoen@nsd.no>

Signed-off-by: Snorre Magnus Davøen <snorre.davoen@nsd.no>

Signed-off-by: Snorre Magnus Davøen <snorre.davoen@nsd.no>

The library now adds wrappers around the buddy library's sign function. This is
made possible by extracting any private keys from the json web key list.

Specs are added for the new private key functionality.

The resolve-key function is now private, and new functions resolve-public-key
and resolve-private-key has taken its place.
Signed-off-by: Snorre Magnus Davøen <snorre.davoen@nsd.no>

nil kid is explicitly allowed by specs

Signed-off-by: Snorre Magnus Davøen <snorre.davoen@nsd.no>

Signed-off-by: Snorre Magnus Davøen <snorre.davoen@nsd.no>

Signed-off-by: Snorre Magnus Davøen <snorre.davoen@nsd.no>

The resolve-key function now logs first resolve attempt as a debug
statement. For usual INFO-level logging this will effectively turn off
logging of the first key resolve attempt which covers most resolve
calls.

If the key is not found the clj-jwt library will log the error with
error level before throwing the exception. This might help with
debugging when encountering problems with token validation.
Signed-off-by: Snorre Magnus Davøen <snorre.davoen@nsd.no>

Signed-off-by: Snorre Magnus Davøen <snorre.davoen@nsd.no>

Signed-off-by: Snorre Magnus Davøen <snorre.davoen@nsd.no>

Signed-off-by: Snorre Magnus Davøen <snorre.davoen@nsd.no>

Claims spec should never allow claims to be a nil value. The value will
at worst be an empty map.
Signed-off-by: Snorre Magnus Davøen <snorre.davoen@nsd.no>

In test and exercises (property test) timbre is now used as a dependency
to help surpress logging. It will only log fatal log outputs.

Timbre is not a dependency when packaging the final library jar so as
not to specify any logging for consumers of the library.
Signed-off-by: Snorre Magnus Davøen <snorre.davoen@nsd.no>

Added generator for ::jwt

See merge request !1

Signed-off-by: Snorre Magnus Davøen <snorre.davoen@nsd.no>

Signed-off-by: Snorre Magnus Davøen <snorre.davoen@nsd.no>

Signed-off-by: Snorre Magnus Davøen <snorre.davoen@nsd.no>

It seems packaging the project as a jar for library use is difficult
using tools deps. There is only one tool that does this, meyvn, which
insists on collecting data about usage to be able to sell enterprise
licenses to heavy users. Not a very attractive feature. It also depends
on maven for secrets handling which means using maven's security setup
with encrypted passwords in the maven config file and a master password
rather than a gpg-encrypted edn file like leiningen and boot.

In sum I think using leiningen to package the library is preferable. We
can use the tools deps plugin for leiningen to fetch dependencies listed
in the deps.edn file. Publishing the library to nexus.nsd.no should be
done locally from developer machines (to sign package with gpg), so
having both leiningen and tools deps installed should be no problem.
Signed-off-by: Snorre Magnus Davøen <snorre.davoen@nsd.no>

To make library consumeable by tools deps based projects the
dependencies are now specified using a deps.edn file. This file is then
consumed by leiningen via the lein tools deps plugin.

Test dependencies are specified directly in the leiningen project.clj
file.
Signed-off-by: Snorre Magnus Davøen <snorre.davoen@nsd.no>

Features:
- JWKS support
- Cache handling of jwks
- Some Buddy api compatibility

Done:

- Some specced functions
- Tests
- Spec exercise tests

Todo:

- Spec all functions
- More tests?
- Documentation
Signed-off-by: Snorre Magnus Davøen <snorre.davoen@nsd.no>