Migrate jwt_verify_lib from github.com/google/jwt_verify_lib to Envoy internal

bazel/repositories.bzl

@@ -153,7 +153,6 @@ def envoy_dependencies(skip_targets = []):
     _com_github_fmtlib_fmt()
     _com_github_gabime_spdlog()
     _com_github_google_benchmark()
-    _com_github_google_jwt_verify()
     _com_github_google_libprotobuf_mutator()
     _com_github_google_libsxg()
     _com_github_google_tcmalloc()
@@ -800,13 +799,6 @@ def _emsdk():
         patches = ["@envoy//bazel:emsdk.patch"],
     )
 
-def _com_github_google_jwt_verify():
-    external_http_archive(
-        "com_github_google_jwt_verify",
-        patches = ["@envoy//bazel:jwt_verify_lib.patch"],
-        patch_args = ["-p1"],
-    )
-
 def _com_github_luajit_luajit():
     external_http_archive(
         name = "com_github_luajit_luajit",

bazel/repository_locations.bzl

@@ -891,21 +891,6 @@ REPOSITORY_LOCATIONS_SPEC = dict(
         license = "Boost",
         license_url = "https://github.com/msgpack/msgpack-c/blob/cpp-{version}/LICENSE_1_0.txt",
     ),
-    com_github_google_jwt_verify = dict(
-        project_name = "jwt_verify_lib",
-        project_desc = "JWT verification library for C++",
-        project_url = "https://github.com/google/jwt_verify_lib",
-        version = "b59e8075d4a4f975ba6f109e1916d6e60aeb5613",
-        sha256 = "637e4983506c4f26bbe2808ae4e1944e46cbb2277d34ff0b8a3b72bdac3c4b91",
-        strip_prefix = "jwt_verify_lib-{version}",
-        urls = ["https://github.com/google/jwt_verify_lib/archive/{version}.tar.gz"],
-        use_category = ["dataplane_ext"],
-        extensions = ["envoy.filters.http.jwt_authn", "envoy.filters.http.gcp_authn", "envoy.filters.http.oauth2"],
-        release_date = "2023-05-17",
-        cpe = "N/A",
-        license = "Apache-2.0",
-        license_url = "https://github.com/google/jwt_verify_lib/blob/{version}/LICENSE",
-    ),
     com_github_alibaba_hessian2_codec = dict(
         project_name = "hessian2-codec",
         project_desc = "hessian2-codec is a C++ library for hessian2 codec",

docs/NAMESPACE_MIGRATION_DIFF.md

@@ -0,0 +1,148 @@
+# JWT Verify Library Migration - Namespace Changes
+
+This document describes the namespace changes made when migrating the code from `github.com/google/jwt_verify_lib` to the Envoy internal implementation.
+
+## Summary
+
+The JWT verification library was migrated from an external dependency to internal Envoy code. The main change is the namespace update:
+
+| Original Namespace | New Envoy Namespace |
+|-------------------|---------------------|
+| `google::jwt_verify` | `Envoy::Extensions::HttpFilters::Common::JwtVerify` |
+| `google::simple_lru_cache` | `Envoy::Extensions::HttpFilters::Common::JwtVerify::SimpleLruCache` |
+
+## Include Path Changes
+
+| Original Include | New Include |
+|-----------------|-------------|
+| `jwt_verify_lib/status.h` | `source/extensions/filters/http/common/jwt/status.h` |
+| `jwt_verify_lib/jwt.h` | `source/extensions/filters/http/common/jwt/jwt.h` |
+| `jwt_verify_lib/jwks.h` | `source/extensions/filters/http/common/jwt/jwks.h` |
+| `jwt_verify_lib/verify.h` | `source/extensions/filters/http/common/jwt/verify.h` |
+| `jwt_verify_lib/check_audience.h` | `source/extensions/filters/http/common/jwt/check_audience.h` |
+| `jwt_verify_lib/struct_utils.h` | `source/extensions/filters/http/common/jwt/struct_utils.h` |
+| `simple_lru_cache/simple_lru_cache.h` | `source/extensions/filters/http/common/jwt/simple_lru_cache.h` |
+| `simple_lru_cache/simple_lru_cache_inl.h` | `source/extensions/filters/http/common/jwt/simple_lru_cache_inl.h` |
+
+## Namespace Declaration Changes
+
+### Original (google/jwt_verify_lib)
+
+```cpp
+namespace google {
+namespace jwt_verify {
+// ... code ...
+}  // namespace jwt_verify
+}  // namespace google
+```
+
+### New (Envoy internal)
+
+```cpp
+namespace Envoy {
+namespace Extensions {
+namespace HttpFilters {
+namespace Common {
+namespace JwtVerify {
+// ... code ...
+} // namespace JwtVerify
+} // namespace Common
+} // namespace HttpFilters
+} // namespace Extensions
+} // namespace Envoy
+```
+
+### SimpleLruCache Namespace Change
+
+#### Original
+
+```cpp
+namespace google {
+namespace simple_lru_cache {
+// ... code ...
+}  // namespace simple_lru_cache
+}  // namespace google
+```
+
+#### New
+
+```cpp
+namespace Envoy {
+namespace Extensions {
+namespace HttpFilters {
+namespace Common {
+namespace JwtVerify {
+namespace SimpleLruCache {
+// ... code ...
+} // namespace SimpleLruCache
+} // namespace JwtVerify
+} // namespace Common
+} // namespace HttpFilters
+} // namespace Extensions
+} // namespace Envoy
+```
+
+## Usage in Consumer Code
+
+Consumers can use namespace aliases for backward compatibility:
+
+```cpp
+// In consumer headers/source files:
+namespace JwtVerify = Envoy::Extensions::HttpFilters::Common::JwtVerify;
+
+// Then use:
+JwtVerify::Status status;
+JwtVerify::Jwt jwt;
+JwtVerify::Jwks jwks;
+JwtVerify::SimpleLruCache::SimpleLRUCache<Key, Value> cache;
+```
+
+## Files Migrated
+
+The following files were migrated from `github.com/google/jwt_verify_lib`:
+
+### Source Files
+- `src/status.cc` -> `source/extensions/filters/http/common/jwt/status.cc`
+- `src/jwt.cc` -> `source/extensions/filters/http/common/jwt/jwt.cc`
+- `src/jwks.cc` -> `source/extensions/filters/http/common/jwt/jwks.cc`
+- `src/verify.cc` -> `source/extensions/filters/http/common/jwt/verify.cc`
+- `src/check_audience.cc` -> `source/extensions/filters/http/common/jwt/check_audience.cc`
+- `src/struct_utils.cc` -> `source/extensions/filters/http/common/jwt/struct_utils.cc`
+
+### Header Files
+- `jwt_verify_lib/status.h` -> `source/extensions/filters/http/common/jwt/status.h`
+- `jwt_verify_lib/jwt.h` -> `source/extensions/filters/http/common/jwt/jwt.h`
+- `jwt_verify_lib/jwks.h` -> `source/extensions/filters/http/common/jwt/jwks.h`
+- `jwt_verify_lib/verify.h` -> `source/extensions/filters/http/common/jwt/verify.h`
+- `jwt_verify_lib/check_audience.h` -> `source/extensions/filters/http/common/jwt/check_audience.h`
+- `jwt_verify_lib/struct_utils.h` -> `source/extensions/filters/http/common/jwt/struct_utils.h`
+- `simple_lru_cache/simple_lru_cache.h` -> `source/extensions/filters/http/common/jwt/simple_lru_cache.h`
+- `simple_lru_cache/simple_lru_cache_inl.h` -> `source/extensions/filters/http/common/jwt/simple_lru_cache_inl.h`
+
+## Bazel Dependency Changes
+
+### Removed from `bazel/repository_locations.bzl`:
+- `com_github_google_jwt_verify` entry
+
+### Removed from `bazel/repositories.bzl`:
+- `_com_github_google_jwt_verify()` function and its call
+
+### Removed Patch File:
+- `bazel/jwt_verify_lib.patch`
+
+### New Bazel Targets:
+- `//source/extensions/filters/http/common/jwt:jwt_verify_lib`
+- `//source/extensions/filters/http/common/jwt:simple_lru_cache_lib`
+
+### Consumer BUILD file changes:
+Replace:
+```bazel
+"@com_github_google_jwt_verify//:jwt_verify_lib",
+"@com_github_google_jwt_verify//:simple_lru_cache_lib",
+```
+
+With:
+```bazel
+"//source/extensions/filters/http/common/jwt:jwt_verify_lib",
+"//source/extensions/filters/http/common/jwt:simple_lru_cache_lib",
+```

source/extensions/filters/http/common/BUILD

@@ -34,7 +34,7 @@ envoy_cc_library(
     deps = [
         "//envoy/upstream:cluster_manager_interface",
         "//source/common/http:utility_lib",
-        "@com_github_google_jwt_verify//:jwt_verify_lib",
+        "//source/extensions/filters/http/common/jwt:jwt_verify_lib",
         "@envoy_api//envoy/config/core/v3:pkg_cc_proto",
         "@envoy_api//envoy/extensions/filters/http/jwt_authn/v3:pkg_cc_proto",
     ],