Expose the constants in pkg/controller/bootstrap and add a validate token method

pkg/controller/bootstrap/jws.go

@@ -34,17 +34,17 @@ func computeDetachedSig(content, tokenID, tokenSecret string) (string, error) {
 
 	signer, err := jose.NewSigner(jose.HS256, jwk)
 	if err != nil {
-		return "", nil
+		return "", fmt.Errorf("can't make a HS256 signer from the given token: %v", err)
 	}
 
 	jws, err := signer.Sign([]byte(content))
 	if err != nil {
-		return "", nil
+		return "", fmt.Errorf("can't HS256-sign the given token: %v", err)
 	}
 
 	fullSig, err := jws.CompactSerialize()
 	if err != nil {
-		return "", nil
+		return "", fmt.Errorf("can't serialize the given token: %v", err)
 	}
 	return stripContent(fullSig)
 }
@@ -57,8 +57,17 @@ func computeDetachedSig(content, tokenID, tokenSecret string) (string, error) {
 func stripContent(fullSig string) (string, error) {
 	parts := strings.Split(fullSig, ".")
 	if len(parts) != 3 {
-		return "", fmt.Errorf("Compact JWS format must have three parts")
+		return "", fmt.Errorf("compact JWS format must have three parts")
 	}
 
 	return parts[0] + ".." + parts[2], nil
 }
+
+// DetachedTokenIsValid checks whether a given detached JWS-encoded token matches JWS output of the given content and token
+func DetachedTokenIsValid(detachedToken, content, tokenID, tokenSecret string) bool {
+	newToken, err := computeDetachedSig(content, tokenID, tokenSecret)
+	if err != nil {
+		return false
+	}
+	return detachedToken == newToken
+}