text: var JsonWebTokenError = require('./lib/JsonWebTokenError');
  var NotBeforeError    = require('./lib/NotBeforeError');
  var TokenExpiredError = require('./lib/TokenExpiredError');
  var decode            = require('./decode');
  var jws               = require('jws');
  var ms                = require('ms');
  var xtend             = require('xtend');
  
  module.exports = function (jwtString, secretOrPublicKey, options, callback) {
    if ((typeof options === 'function') && !callback) {
      callback = options;
      options = {};
    }
  
    if (!options) {
      options = {};
    }
  
    //clone this object since we are going to mutate it.
    options = xtend(options);
    var done;
  
    if (callback) {
      done = function() {
        var args = Array.prototype.slice.call(arguments, 0);
        return process.nextTick(function() {
          callback.apply(null, args);
        });
      };
    } else {
      done = function(err, data) {
        if (err) throw err;
        return data;
      };
    }
  
    if (options.clockTimestamp && typeof options.clockTimestamp !== 'number') {
      return done(new JsonWebTokenError('clockTimestamp must be a number'));
    }
  
    var clockTimestamp = options.clockTimestamp || Math.floor(Date.now() / 1000);
  
    if (!jwtString){
      return done(new JsonWebTokenError('jwt must be provided'));
    }
  
    if (typeof jwtString !== 'string') {
      return done(new JsonWebTokenError('jwt must be a string'));
    }
  
    var parts = jwtString.split('.');
  
    if (parts.length !== 3){
      return done(new JsonWebTokenError('jwt malformed'));
    }
  
    var hasSignature = parts[2].trim() !== '';
  
    if (!hasSignature && secretOrPublicKey){
      return done(new JsonWebTokenError('jwt signature is required'));
    }
  
    if (hasSignature && !secretOrPublicKey) {
      return done(new JsonWebTokenError('secret or public key must be provided'));
    }
  
    if (!hasSignature && !options.algorithms) {
      options.algorithms = ['none'];
    }
  
    if (!options.algorithms) {
      options.algorithms = ~secretOrPublicKey.toString().indexOf('BEGIN CERTIFICATE') ||
                           ~secretOrPublicKey.toString().indexOf('BEGIN PUBLIC KEY') ?
                            [ 'RS256','RS384','RS512','ES256','ES384','ES512' ] :
                           ~secretOrPublicKey.toString().indexOf('BEGIN RSA PUBLIC KEY') ?
                            [ 'RS256','RS384','RS512' ] :
                            [ 'HS256','HS384','HS512' ];
  
    }
  
    var decodedToken;
    try {
      decodedToken = jws.decode(jwtString);
    } catch(err) {
      return done(err);
    }
  
    if (!decodedToken) {
      return done(new JsonWebTokenError('invalid token'));
    }
  
    var header = decodedToken.header;
  
    if (!~options.algorithms.indexOf(header.alg)) {
      return done(new JsonWebTokenError('invalid algorithm'));
    }
  
    var valid;
  
    try {
      valid = jws.verify(jwtString, header.alg, secretOrPublicKey);
    } catch (e) {
      return done(e);
    }
  
    if (!valid)
      return done(new JsonWebTokenError('invalid signature'));
  
    var payload;
  
    try {
      payload = decode(jwtString);
    } catch(err) {
      return done(err);
    }
  
    if (typeof payload.nbf !== 'undefined' && !options.ignoreNotBefore) {
      if (typeof payload.nbf !== 'number') {
        return done(new JsonWebTokenError('invalid nbf value'));
      }
      if (payload.nbf > clockTimestamp + (options.clockTolerance || 0)) {
        return done(new NotBeforeError('jwt not active', new Date(payload.nbf * 1000)));
      }
    }
  
    if (typeof payload.exp !== 'undefined' && !options.ignoreExpiration) {
      if (typeof payload.exp !== 'number') {
        return done(new JsonWebTokenError('invalid exp value'));
      }
      if (clockTimestamp >= payload.exp + (options.clockTolerance || 0)) {
        return done(new TokenExpiredError('jwt expired', new Date(payload.exp * 1000)));
      }
    }
  
    if (options.audience) {
      var audiences = Array.isArray(options.audience)? options.audience : [options.audience];
      var target = Array.isArray(payload.aud) ? payload.aud : [payload.aud];
  
      var match = target.some(function(aud) { return audiences.indexOf(aud) != -1; });
  
      if (!match)
        return done(new JsonWebTokenError('jwt audience invalid. expected: ' + audiences.join(' or ')));
    }
  
    if (options.issuer) {
      var invalid_issuer =
          (typeof options.issuer === 'string' && payload.iss !== options.issuer) ||
          (Array.isArray(options.issuer) && options.issuer.indexOf(payload.iss) === -1);
  
      if (invalid_issuer) {
        return done(new JsonWebTokenError('jwt issuer invalid. expected: ' + options.issuer));
      }
    }
  
    if (options.subject) {
      if (payload.sub !== options.subject) {
        return done(new JsonWebTokenError('jwt subject invalid. expected: ' + options.subject));
      }
    }
  
    if (options.jwtid) {
      if (payload.jti !== options.jwtid) {
        return done(new JsonWebTokenError('jwt jwtid invalid. expected: ' + options.jwtid));
      }
    }
  
    if (options.maxAge) {
      var maxAge = ms(options.maxAge);
      if (typeof payload.iat !== 'number') {
        return done(new JsonWebTokenError('iat required when maxAge is specified'));
      }
      // We have to compare against either options.clockTimestamp or the currentDate _with_ millis
      // to not change behaviour (version 7.2.1). Should be resolve somehow for next major.
      var nowOrClockTimestamp = ((options.clockTimestamp || 0) * 1000) || Date.now();
      if (nowOrClockTimestamp - (payload.iat * 1000) > maxAge + (options.clockTolerance || 0) * 1000) {
        return done(new TokenExpiredError('maxAge exceeded', new Date(payload.iat * 1000 + maxAge)));
      }
    }
  
    return done(null, payload);
  };
  