Method validate

nodedb/src/control/security/jwt.rs:122–224

Validate a JWT token string and extract the authenticated identity. Performs: 1. Base64 decode header + payload + signature 2. HMAC-SHA256 signature verification (if configured) 3. Expiration check (`exp` claim) 4. Issuer/audience validation (if configured) 5. Map claims → `AuthenticatedIdentity`

(&self, token: &str)

    /// 4. Issuer/audience validation (if configured)
    /// 5. Map claims → `AuthenticatedIdentity`
    pub fn validate(&self, token: &str) -> Result<AuthenticatedIdentity, JwtError> {
        let parts: Vec<&str> = token.split('.').collect();
        if parts.len() != 3 {
            return Err(JwtError::MalformedToken);
        }

        // Decode header to determine algorithm.
        let header_bytes = base64_url_decode(parts[0]).ok_or(JwtError::DecodingError)?;
        let header: JwtHeader =
            sonic_rs::from_slice(&header_bytes).map_err(|_| JwtError::InvalidClaims)?;

        // Decode payload (middle part). We verify signature separately.
        let payload_bytes = base64_url_decode(parts[1]).ok_or(JwtError::DecodingError)?;
        let claims: JwtClaims =
            sonic_rs::from_slice(&payload_bytes).map_err(|_| JwtError::InvalidClaims)?;

        // Verify signature based on algorithm declared in header.
        let signing_input = format!("{}.{}", parts[0], parts[1]);
        let signature_bytes = base64_url_decode(parts[2]).ok_or(JwtError::DecodingError)?;

        match header.alg.as_str() {
            "HS256" => {
                if self.config.hmac_secret.is_empty() {
                    return Err(JwtError::UnsupportedAlgorithm);
                }
                if !verify_hmac_sha256(
                    &self.config.hmac_secret,
                    signing_input.as_bytes(),
                    &signature_bytes,
                ) {
                    return Err(JwtError::InvalidSignature);
                }
            }
            "RS256" => {
                if self.config.rsa_public_key_der.is_empty() {
                    return Err(JwtError::UnsupportedAlgorithm);
                }
                if !verify_rsa_sha256(
                    &self.config.rsa_public_key_der,
                    signing_input.as_bytes(),
                    &signature_bytes,
                ) {
                    return Err(JwtError::InvalidSignature);
                }
            }
            _ => return Err(JwtError::UnsupportedAlgorithm),
        }

        // Check expiration.
        let now = SystemTime::now()
            .duration_since(UNIX_EPOCH)
            .unwrap_or_default()
            .as_secs();

        if claims.exp > 0 && now > claims.exp + self.config.clock_skew_seconds {
            return Err(JwtError::Expired);
        }
        if claims.nbf > 0 && now + self.config.clock_skew_seconds < claims.nbf {