Kitto.Auth.JWT

Opt-in JWT engine. Implements IKXJWTEngine and registers itself so the base TKAuthenticator can issue and validate a self-contained JWT (in an HttpOnly kx_token cookie) on top of ANY authenticator that declares a JWT: block under its Auth node.

There is no wrapper/Inner authenticator any more: an app configures a plain authenticator (Auth: DB, Auth: LDAP, a custom one, ...) and adds an optional JWT: sub-block. The base decides WHEN to issue/validate/clear a token (from the presence of that block) and delegates the crypto — and the third-party JOSE dependency, which lives in Kitto.Web.JWT — to this engine. Apps that do not use JWT never link JOSE.

Per-authenticator parsed configuration is cached as an opaque state object attached to the authenticator (TKAuthenticator.JWTState), so the engine itself stays a stateless singleton.

TKJWTEngineState class

Opaque per-authenticator state owned by the authenticator (assigned to its JWTState property, which frees it). Holds the parsed JWT configuration and the resolved app name for this authenticator.

TKJWTEngine class

Process-wide JWT engine. Registered in this unit's initialization via RegisterJWTEngine; the base TKAuthenticator retrieves it through GetJWTEngine when a JWT block is configured.

class function HasContext: Boolean;

True when AuthorizeRequest has just validated a JWT for the current thread/request and the result is cached in CurrentContext. Used by TKJWTAccessController to read the kx_acl claim without a second signature verification per ACL call.

class function CurrentContext: TKJWTContext;

The validated context cached by AuthorizeRequest for the current thread/request. Caller must check HasContext first.

class procedure ClearCurrentContext;

Clears the thread-local context cache. Called by AuthorizeRequest when validation fails so subsequent ACL checks within the same request fall back to the unauthenticated path.