Function validate

src/validation.rs:251–344

(claims: ClaimsForValidation, options: &Validation)

}

pub(crate) fn validate(claims: ClaimsForValidation, options: &Validation) -> Result<()> {
    for required_claim in &options.required_spec_claims {
        let present = match required_claim.as_str() {
            "exp" => matches!(claims.exp, TryParse::Parsed(_)),
            "sub" => matches!(claims.sub, TryParse::Parsed(_)),
            "iss" => matches!(claims.iss, TryParse::Parsed(_)),
            "aud" => matches!(claims.aud, TryParse::Parsed(_)),
            "nbf" => matches!(claims.nbf, TryParse::Parsed(_)),
            _ => continue,
        };

        if !present {
            return Err(new_error(ErrorKind::MissingRequiredClaim(required_claim.clone())));
        }
    }

    if options.validate_exp || options.validate_nbf {
        let now = get_current_timestamp();

        // Reject malformed exp/nbf claim when validation is enabled
        if options.validate_exp && matches!(claims.exp, TryParse::FailedToParse) {
            return Err(new_error(ErrorKind::InvalidClaimFormat("exp".to_string())));
        }
        if options.validate_nbf && matches!(claims.nbf, TryParse::FailedToParse) {
            return Err(new_error(ErrorKind::InvalidClaimFormat("nbf".to_string())));
        }

        if matches!(claims.exp, TryParse::Parsed(exp) if exp < options.reject_tokens_expiring_in_less_than)
        {
            return Err(new_error(ErrorKind::InvalidToken));
        }

        if matches!(claims.exp, TryParse::Parsed(exp) if options.validate_exp
            && exp - options.reject_tokens_expiring_in_less_than < now - options.leeway)
        {
            return Err(new_error(ErrorKind::ExpiredSignature));
        }

        if matches!(claims.nbf, TryParse::Parsed(nbf) if options.validate_nbf && nbf > now + options.leeway)
        {
            return Err(new_error(ErrorKind::ImmatureSignature));
        }
    }

    if let (TryParse::Parsed(sub), Some(correct_sub)) = (claims.sub, options.sub.as_deref())
        && sub != correct_sub
    {
        return Err(new_error(ErrorKind::InvalidSubject));
    }

    match (claims.iss, options.iss.as_ref()) {
        (TryParse::Parsed(Issuer::Single(iss)), Some(correct_iss))
            if !correct_iss.contains(&*iss) =>
        {
            return Err(new_error(ErrorKind::InvalidIssuer));
        }
        (TryParse::Parsed(Issuer::Multiple(iss)), Some(correct_iss))
            if !is_subset(correct_iss, &iss) =>