Method validate

libs/@local/graph/api/src/rest/jwt.rs:165–203

Validates a JWT token string and returns the decoded claims. # Errors - [`Validation`] if the token header cannot be decoded, signature verification fails, or claims are invalid (expired, wrong audience/issuer) - [`MissingKeyId`] if the token has no `kid` header - [`JwksFetch`] if the JWKS endpoint cannot be reached - [`UnknownKeyId`] if the `kid` does not match any key in the JWKS [`Validation

(&self, token: &str)

    /// [`JwksFetch`]: JwtError::JwksFetch
    /// [`UnknownKeyId`]: JwtError::UnknownKeyId
    pub async fn validate(&self, token: &str) -> Result<JwtClaims, Report<JwtError>> {
        let header = decode_header(token).change_context(JwtError::Validation)?;

        if !self.allowed_algorithms.contains(&header.alg) {
            return Err(Report::new(JwtError::Validation))
                .attach(format!("algorithm {:?} is not allowed", header.alg));
        }

        let kid = header.kid.ok_or(JwtError::MissingKeyId)?;

        let decoding_key = self.resolve_decoding_key(&kid).await?;

        // jsonwebtoken v10 requires all algorithms in the validation list to share the same key
        // family, so we pass only the token's algorithm (already checked above).
        let mut validation = Validation::new(header.alg);
        validation.set_audience(&[&self.audience]);
        validation.set_issuer(&[&self.issuer]);

        let raw = decode::<RawJwtClaims>(token, &decoding_key, &validation)
            .change_context(JwtError::Validation)?
            .claims;

        let issued_at = OffsetDateTime::from_unix_timestamp(
            i64::try_from(raw.iat).change_context(JwtError::Validation)?,
        )
        .change_context(JwtError::Validation)?;

        let expires_at = OffsetDateTime::from_unix_timestamp(
            i64::try_from(raw.exp).change_context(JwtError::Validation)?,
        )
        .change_context(JwtError::Validation)?;

        Ok(JwtClaims {
            sub: raw.sub,
            email: raw.email,
            issued_at,
            expires_at,
        })
    }

    /// Resolves a [`DecodingKey`] for the given key ID from the cached JWKS.
    ///