func (s signatureHeader) validateSignatureHeader(b64 bool) error {
	dumpJSON(s)

	if s.Type != "" { // Optional must be "JOSE" if present
		if s.Type != "JOSE" {
			return errInvalidSignatureClaim("typ", s.Type, "must equal 'JOSE' if present")
		}
	}

	if s.Alg != "PS256" { // Mandatory must be "PS256"
		return errInvalidSignatureClaim("alg", s.Alg, "PS256")
	}

	if s.Kid == "" { // Mandatory - must be present
		return fmt.Errorf("%w: kid claim MUST be present", ErrInvalidSignatureHeader)
	}

	if s.Ctype != "" { // Optional - if present must be json or application/json
		if s.Ctype != "json" && s.Ctype != "application/json" {
			return errInvalidSignatureClaim("cty", s.Ctype, "'json' or 'application/json'")
		}
	}

	if b64 { // version 3.1.4 and newer
		if s.B64 != nil {
			return fmt.Errorf("%w: b64 claim is set - must not be present for v3.1.4 and newer APIs", ErrInvalidSignatureHeader)
		}
		if len(s.Critical) != 3 {
			return errInvalidSignatureClaim("crit", s.Critical, "must contain 3 elements for v3.1.4 and newer APIs")
		}

		requiredElements := []string{"http://openbanking.org.uk/iss", "http://openbanking.org.uk/iat", "http://openbanking.org.uk/tan"}
		if !containsAllElements(s.Critical, requiredElements) {
			return errInvalidSignatureClaim("crit", s.Critical, requiredElements)
		}

	} else { // version 3.1.3 and older
		if s.B64 == nil {
			return fmt.Errorf("%w: b64 claim is not set - must be present for v3.1.3 and older APIs", ErrInvalidSignatureHeader)
		}
		if *s.B64 == true {
			return errInvalidSignatureClaim("b64", *s.B64, "value must be false for v3.1.3 and older APIs")
		}
		if len(s.Critical) != 4 {
			return errInvalidSignatureClaim("crit", s.Critical, "must contain 4 elements for v3.1.3 and older APIs")
		}

		requiredElements := []string{"http://openbanking.org.uk/iss", "http://openbanking.org.uk/iat", "http://openbanking.org.uk/tan", "b64"}
		if !containsAllElements(s.Critical, requiredElements) {
			return errInvalidSignatureClaim("crit", s.Critical, requiredElements)
		}
	}

	if s.IssuedAt == decimal.Zero {
		return errInvalidSignatureClaim("http://openbanking.org.uk/iat", s.IssuedAt.String(), "a JSON number representing time")
	}
	if s.TrustAnchor != "openbanking.org.uk" && !isHSBCTrustAnchor(s.TrustAnchor) { // allow trust anchors from OBIE HSBC
		return errInvalidSignatureClaim("http://openbanking.org.uk/tan", s.TrustAnchor, "openbanking.org.uk or ASPSP specific value")
	}

	if len(s.Issuer) == 0 {
		return errInvalidSignatureClaim("http://openbanking.org.uk/iss", s.Issuer, "non empty value")
	}

	if s.TrustAnchor == "openbanking.org.uk" { // only check when trust anchor is OBIE
		if !checkSignatureIssuerASPSP(s.Issuer) {
			return errInvalidSignatureClaim("http://openbanking.org.uk/iss", s.Issuer, "only the ORG-ID")
		}
	}
	return nil
}
// validate a signatureHeader structure
// according to b64=false v3.1.3 and older or
// b64=true v3.1.4 and newer
validate a signatureHeader structure
according to b64=false v3.1.3 and older or
b64=true v3.1.4 and newer
// validate a signatureHeader structure // according to b64 = false v3 . 1 . 3 and older or // b64 = true v3 . 1 . 4 and newer
func (s signatureHeader) validateSignatureHeader(b64 bool) error {
	dumpJSON(s)
	if s.Type != "" { 
		if s.Type != "JOSE" {
			return errInvalidSignatureClaim("typ", s.Type, "must equal 'JOSE' if present")
		}
	}
	if s.Alg != "PS256" { 
		return errInvalidSignatureClaim("alg", s.Alg, "PS256")
	}
	if s.Kid == "" { 
		return fmt.Errorf("%w: kid claim MUST be present", ErrInvalidSignatureHeader)
	}
	if s.Ctype != "" { 
		if s.Ctype != "json" && s.Ctype != "application/json" {
			return errInvalidSignatureClaim("cty", s.Ctype, "'json' or 'application/json'")
		}
	}
	if b64 { 
		if s.B64 != nil {
			return fmt.Errorf("%w: b64 claim is set - must not be present for v3.1.4 and newer APIs", ErrInvalidSignatureHeader)
		}
		if len(s.Critical) != 3 {
			return errInvalidSignatureClaim("crit", s.Critical, "must contain 3 elements for v3.1.4 and newer APIs")
		}
		requiredElements := []string{"http://openbanking.org.uk/iss", "http://openbanking.org.uk/iat", "http://openbanking.org.uk/tan"}
		if !containsAllElements(s.Critical, requiredElements) {
			return errInvalidSignatureClaim("crit", s.Critical, requiredElements)
		}
	} else { 
		if s.B64 == nil {
			return fmt.Errorf("%w: b64 claim is not set - must be present for v3.1.3 and older APIs", ErrInvalidSignatureHeader)
		}
		if *s.B64 == true {
			return errInvalidSignatureClaim("b64", *s.B64, "value must be false for v3.1.3 and older APIs")
		}
		if len(s.Critical) != 4 {
			return errInvalidSignatureClaim("crit", s.Critical, "must contain 4 elements for v3.1.3 and older APIs")
		}
		requiredElements := []string{"http://openbanking.org.uk/iss", "http://openbanking.org.uk/iat", "http://openbanking.org.uk/tan", "b64"}
		if !containsAllElements(s.Critical, requiredElements) {
			return errInvalidSignatureClaim("crit", s.Critical, requiredElements)
		}
	}
	if s.IssuedAt == decimal.Zero {
		return errInvalidSignatureClaim("http://openbanking.org.uk/iat", s.IssuedAt.String(), "a JSON number representing time")
	}
	if s.TrustAnchor != "openbanking.org.uk" && !isHSBCTrustAnchor(s.TrustAnchor) { 
		return errInvalidSignatureClaim("http://openbanking.org.uk/tan", s.TrustAnchor, "openbanking.org.uk or ASPSP specific value")
	}
	if len(s.Issuer) == 0 {
		return errInvalidSignatureClaim("http://openbanking.org.uk/iss", s.Issuer, "non empty value")
	}
	if s.TrustAnchor == "openbanking.org.uk" { 
		if !checkSignatureIssuerASPSP(s.Issuer) {
			return errInvalidSignatureClaim("http://openbanking.org.uk/iss", s.Issuer, "only the ORG-ID")
		}
	}
	return nil
}
func ( s signatureHeader ) validateSignatureHeader ( b64 bool ) error { dumpJSON ( s ) if s . Type != " " { if s . Type != " " { return errInvalidSignatureClaim ( " " , s . Type , " " ) } } if s . Alg != " " { return errInvalidSignatureClaim ( " " , s . Alg , " " ) } if s . Kid == " " { return fmt . Errorf ( " " , ErrInvalidSignatureHeader ) } if s . Ctype != " " { if s . Ctype != " " && s . Ctype != " " { return errInvalidSignatureClaim ( " " , s . Ctype , " " ) } } if b64 { if s . B64 != nil { return fmt . Errorf ( " " , ErrInvalidSignatureHeader ) } if len ( s . Critical ) != 3 { return errInvalidSignatureClaim ( " " , s . Critical , " " ) } requiredElements := [ ] string { " " , " " , " " } if ! containsAllElements ( s . Critical , requiredElements ) { return errInvalidSignatureClaim ( " " , s . Critical , requiredElements ) } } else { if s . B64 == nil { return fmt . Errorf ( " " , ErrInvalidSignatureHeader ) } if * s . B64 == true { return errInvalidSignatureClaim ( " " , * s . B64 , " " ) } if len ( s . Critical ) != 4 { return errInvalidSignatureClaim ( " " , s . Critical , " " ) } requiredElements := [ ] string { " " , " " , " " , " " } if ! containsAllElements ( s . Critical , requiredElements ) { return errInvalidSignatureClaim ( " " , s . Critical , requiredElements ) } } if s . IssuedAt == decimal . Zero { return errInvalidSignatureClaim ( " " , s . IssuedAt . String ( ) , " " ) } if s . TrustAnchor != " " && ! isHSBCTrustAnchor ( s . TrustAnchor ) { return errInvalidSignatureClaim ( " " , s . TrustAnchor , " " ) } if len ( s . Issuer ) == 0 { return errInvalidSignatureClaim ( " " , s . Issuer , " " ) } if s . TrustAnchor == " " { if ! checkSignatureIssuerASPSP ( s . Issuer ) { return errInvalidSignatureClaim ( " " , s . Issuer , " " ) } } return nil }
validate a signatureHeader structure
according to b64=false v3.1.3 and older or
b64=true v3.1.4 and newer
validate a signatureHeader structure according to b64 = false v3 . 1 . 3 and older or b64 = true v3 . 1 . 4 and newer
// Optional must be "JOSE" if present // Mandatory must be "PS256" // Mandatory - must be present // Optional - if present must be json or application/json // version 3.1.4 and newer // version 3.1.3 and older // allow trust anchors from OBIE HSBC // only check when trust anchor is OBIE