Method validate

nodedb/src/config/auth/config.rs:200–225

Validate provider config against a [`JwksPolicy`]. Fail-closed: empty `issuer` is rejected; `jwks_url` must pass the policy.

(
        &self,
        policy: &crate::control::security::jwks::url::JwksPolicy,
    )

    /// Validate provider config against a [`JwksPolicy`]. Fail-closed:
    /// empty `issuer` is rejected; `jwks_url` must pass the policy.
    pub fn validate(
        &self,
        policy: &crate::control::security::jwks::url::JwksPolicy,
    ) -> crate::Result<()> {
        if self.name.trim().is_empty() {
            return Err(crate::Error::Config {
                detail: "auth.jwt provider must have a non-empty name".into(),
            });
        }
        if self.issuer.trim().is_empty() {
            return Err(crate::Error::Config {
                detail: format!(
                    "auth.jwt provider '{}' must set a non-empty `issuer`; \
                     empty issuer would disable issuer validation and allow \
                     cross-tenant token acceptance",
                    self.name
                ),
            });
        }
        policy
            .check_url(&self.jwks_url)
            .map_err(|e| crate::Error::Config {
                detail: format!("auth.jwt provider '{}' has unsafe jwks_url: {e}", self.name),
            })?;
        Ok(())
    }
}

impl JwtAuthConfig {