Check the proof

import { createRemoteJWKSet, jwtVerify } from 'jose';
import { isDeepStrictEqual } from 'node:util';

const jwks = createRemoteJWKSet(new URL('https://id.trustaige.com/.well-known/jwks.json'));
const strength = { same_device_passkey: 1, phone_approval: 2 };

export async function checkProof(proof, change) {
  const { payload } = await jwtVerify(proof, jwks, {
    issuer: 'https://id.trustaige.com',
    audience: '<your-client-id>',
    typ: 'verification+jwt',
  });
  if (payload.txn_hash !== change.txnHash) throw new Error('the proof is for a different action');
  if (!isDeepStrictEqual(payload.authorization_details, change.details)) throw new Error('the proof is for a different action');
  if (payload.jti !== change.authReqId) throw new Error('the proof answers a different request');
  if (!(await usedProofs.add(payload.jti))) throw new Error('the proof was already used');
  if (payload.sub !== change.sub) throw new Error('the proof was made by someone else');
  if ((strength[payload.confirmation.method] ?? 0) < (strength[change.required] ?? 1)) {
    throw new Error(`this change needs ${change.required}`);
  }
}

type proofClaims struct {
	AuthorizationDetails json.RawMessage `json:"authorization_details"`
	TxnHash              string          `json:"txn_hash"`
	Confirmation         struct {
		Method string `json:"method"`
	} `json:"confirmation"`
	jwt.RegisteredClaims
}

var strength = map[string]int{"same_device_passkey": 1, "phone_approval": 2}

func checkProof(ctx context.Context, jwks keyfunc.Keyfunc, proof string, change Change) error {
	claims := &proofClaims{}
	tok, err := jwt.ParseWithClaims(proof, claims, jwks.Keyfunc,
		jwt.WithIssuer("https://id.trustaige.com"),
		jwt.WithAudience("<your-client-id>"),
		jwt.WithExpirationRequired(),
		jwt.WithValidMethods([]string{"EdDSA", "ES256", "RS256", "PS256"}))
	if err != nil {
		return fmt.Errorf("the proof is not valid: %w", err)
	}
	var got, want any
	_ = json.Unmarshal(claims.AuthorizationDetails, &got)
	_ = json.Unmarshal(change.Details, &want)
	switch {
	case tok.Header["typ"] != "verification+jwt":
		return errors.New("not a Countersign proof")
	case claims.TxnHash != change.TxnHash || !reflect.DeepEqual(got, want):
		return errors.New("the proof is for a different action")
	case claims.ID != change.AuthReqID:
		return errors.New("the proof answers a different request")
	case !usedProofs.Add(ctx, claims.ID):
		return errors.New("the proof was already used")
	case claims.Subject != change.Sub:
		return errors.New("the proof was made by someone else")
	case strength[claims.Confirmation.Method] < strength[change.Required]:
		return fmt.Errorf("this change needs %s", change.Required)
	}
	return nil
}

import jwt

jwks = jwt.PyJWKClient("https://id.trustaige.com/.well-known/jwks.json")
STRENGTH = {"same_device_passkey": 1, "phone_approval": 2}

def check_proof(proof: str, change) -> None:
    if jwt.get_unverified_header(proof).get("typ") != "verification+jwt":
        raise ValueError("not a Countersign proof")
    key = jwks.get_signing_key_from_jwt(proof)
    claims = jwt.decode(
        proof, key.key,
        algorithms=["EdDSA", "ES256", "RS256", "PS256"],
        audience="<your-client-id>",
        issuer="https://id.trustaige.com",
        options={"require": ["exp", "jti", "sub"]},
    )
    if claims["txn_hash"] != change.txn_hash or claims["authorization_details"] != change.details:
        raise ValueError("the proof is for a different action")
    if claims["jti"] != change.auth_req_id:
        raise ValueError("the proof answers a different request")
    if not used_proofs.add(claims["jti"]):
        raise ValueError("the proof was already used")
    if claims["sub"] != change.sub:
        raise ValueError("the proof was made by someone else")
    if STRENGTH.get(claims["confirmation"]["method"], 0) < STRENGTH.get(change.required, 1):
        raise ValueError(f"this change needs {change.required}")