pub fn validate_claims(&self, claims: &Claims) -> Result<(), Error> {
        if self.validate_currently_valid {
            match (claims.list_of.get("iat"), claims.list_of.get("nbf")) {
                (Some(iat), Some(nbf)) => match (iat.as_str(), nbf.as_str()) {
                    (Some(iat), Some(nbf)) => {
                        let iat = OffsetDateTime::parse(iat, &Rfc3339)
                            .map_err(|_| Error::ClaimValidation)?;
                        let nbf = OffsetDateTime::parse(nbf, &Rfc3339)
                            .map_err(|_| Error::ClaimValidation)?;
                        let current_time = OffsetDateTime::now_utc();

                        if current_time < nbf || current_time < iat {
                            return Err(Error::ClaimValidation);
                        }
                    }
                    _ => return Err(Error::ClaimValidation),
                },
                _ => return Err(Error::ClaimValidation),
            }
        }

        if let Some(exp) = claims.list_of.get("exp") {
            if let Some(exp) = exp.as_str() {
                let exp =
                    OffsetDateTime::parse(exp, &Rfc3339).map_err(|_| Error::ClaimValidation)?;
                let current_time = OffsetDateTime::now_utc();

                if current_time > exp {
                    return Err(Error::ClaimValidation);
                }
            } else {
                return Err(Error::ClaimValidation);
            }
        } else if !self.allow_non_expiring {
            // We didn't explicitly allow non-expiring tokens so we expect `exp` claim.
            return Err(Error::ClaimValidation);
        }

        if let Some(expected_issuer) = &self.validate_issuer {
            if let Some(actual_issuer) = claims.list_of.get("iss") {
                if expected_issuer != actual_issuer {
                    return Err(Error::ClaimValidation);
                }
            } else {
                return Err(Error::ClaimValidation);
            }
        }

        if let Some(expected_subject) = &self.validate_subject {
            if let Some(actual_subject) = claims.list_of.get("sub") {
                if expected_subject != actual_subject {
                    return Err(Error::ClaimValidation);
                }
            } else {
                return Err(Error::ClaimValidation);
            }
        }

        if let Some(expected_audience) = &self.validate_audience {
            if let Some(actual_audience) = claims.list_of.get("aud") {
                if expected_audience != actual_audience {
                    return Err(Error::ClaimValidation);
                }
            } else {
                return Err(Error::ClaimValidation);
            }
        }

        if let Some(expected_token_identifier) = &self.validate_token_identifier {
            if let Some(actual_token_identifier) = claims.list_of.get("jti") {
                if expected_token_identifier != actual_token_identifier {
                    return Err(Error::ClaimValidation);
                }
            } else {
                return Err(Error::ClaimValidation);
            }
        }

        Ok(())
    }
/// Validate the set of registered `claims` against the currently defined validation rules.
///
/// If `claims` has defined the `exp` claim, this is validated regardless of whether the rules
/// have allowed for non-expiring. Non-expiring means that there should be no `exp` in `claims`.
///
/// Errors:
/// - Token is expired
/// - Token is not yet valid
/// - Token was issued in the future
/// - Token has no `exp` claim but the validation rules do not allow non-expiring tokens
/// - The claims values cannot be converted to `str`
/// - `iat`, `nbf` and `exp` fail `str -> DateTime` conversion
/// - Claim `iss`, `sub`, `aud`, `jti` does not match the expected
/// - `claims` has no `nbf` or `iat`
/// - a claim was registered for validation in the rules but is missing from the actual `claims`
///
/// NOTE: This __does not__ validate any non-registered claims (see [`Claims::REGISTERED_CLAIMS`]). They must be validated
/// separately.
Validate the set of registered `claims` against the currently defined validation rules.
If `claims` has defined the `exp` claim, this is validated regardless of whether the rules
have allowed for non-expiring. Non-expiring means that there should be no `exp` in `claims`.



This __does not__ validate any non-registered claims . They must be validated
separately.
Validate the set of registered ` claims ` against the currently defined validation rules . If ` claims ` has defined the ` exp ` claim this is validated regardless of whether the rules have allowed for non - expiring . Non - expiring means that there should be no ` exp ` in ` claims ` . This __does not__ validate any non - registered claims . They must be validated separately .
pub fn validate_claims(&self, claims: &Claims) -> Result<(), Error> {
        if self.validate_currently_valid {
            match (claims.list_of.get("iat"), claims.list_of.get("nbf")) {
                (Some(iat), Some(nbf)) => match (iat.as_str(), nbf.as_str()) {
                    (Some(iat), Some(nbf)) => {
                        let iat = OffsetDateTime::parse(iat, &Rfc3339)
                            .map_err(|_| Error::ClaimValidation)?;
                        let nbf = OffsetDateTime::parse(nbf, &Rfc3339)
                            .map_err(|_| Error::ClaimValidation)?;
                        let current_time = OffsetDateTime::now_utc();
                        if current_time < nbf || current_time < iat {
                            return Err(Error::ClaimValidation);
                        }
                    }
                    _ => return Err(Error::ClaimValidation),
                },
                _ => return Err(Error::ClaimValidation),
            }
        }
        if let Some(exp) = claims.list_of.get("exp") {
            if let Some(exp) = exp.as_str() {
                let exp =
                    OffsetDateTime::parse(exp, &Rfc3339).map_err(|_| Error::ClaimValidation)?;
                let current_time = OffsetDateTime::now_utc();
                if current_time > exp {
                    return Err(Error::ClaimValidation);
                }
            } else {
                return Err(Error::ClaimValidation);
            }
        } else if !self.allow_non_expiring {
            // We didn't explicitly allow non-expiring tokens so we expect `exp` claim.
            return Err(Error::ClaimValidation);
        }
        if let Some(expected_issuer) = &self.validate_issuer {
            if let Some(actual_issuer) = claims.list_of.get("iss") {
                if expected_issuer != actual_issuer {
                    return Err(Error::ClaimValidation);
                }
            } else {
                return Err(Error::ClaimValidation);
            }
        }
        if let Some(expected_subject) = &self.validate_subject {
            if let Some(actual_subject) = claims.list_of.get("sub") {
                if expected_subject != actual_subject {
                    return Err(Error::ClaimValidation);
                }
            } else {
                return Err(Error::ClaimValidation);
            }
        }
        if let Some(expected_audience) = &self.validate_audience {
            if let Some(actual_audience) = claims.list_of.get("aud") {
                if expected_audience != actual_audience {
                    return Err(Error::ClaimValidation);
                }
            } else {
                return Err(Error::ClaimValidation);
            }
        }
        if let Some(expected_token_identifier) = &self.validate_token_identifier {
            if let Some(actual_token_identifier) = claims.list_of.get("jti") {
                if expected_token_identifier != actual_token_identifier {
                    return Err(Error::ClaimValidation);
                }
            } else {
                return Err(Error::ClaimValidation);
            }
        }
        Ok(())
    }
pub fn validate_claims ( & self , claims : & Claims ) -> Result < ( ) , Error > { if self . validate_currently_valid { match ( claims . list_of . get ( " " ) , claims . list_of . get ( " " ) ) { ( Some ( iat ) , Some ( nbf ) ) => match ( iat . as_str ( ) , nbf . as_str ( ) ) { ( Some ( iat ) , Some ( nbf ) ) => { let iat = OffsetDateTime :: parse ( iat , & Rfc3339 ) . map_err ( | _ | Error :: ClaimValidation ) ? ; let nbf = OffsetDateTime :: parse ( nbf , & Rfc3339 ) . map_err ( | _ | Error :: ClaimValidation ) ? ; let current_time = OffsetDateTime :: now_utc ( ) ; if current_time < nbf || current_time < iat { return Err ( Error :: ClaimValidation ) ; } } _ => return Err ( Error :: ClaimValidation ) , } , _ => return Err ( Error :: ClaimValidation ) , } } if let Some ( exp ) = claims . list_of . get ( " " ) { if let Some ( exp ) = exp . as_str ( ) { let exp = OffsetDateTime :: parse ( exp , & Rfc3339 ) . map_err ( | _ | Error :: ClaimValidation ) ? ; let current_time = OffsetDateTime :: now_utc ( ) ; if current_time > exp { return Err ( Error :: ClaimValidation ) ; } } else { return Err ( Error :: ClaimValidation ) ; } } else if ! self . allow_non_expiring { // We didn't explicitly allow non-expiring tokens so we expect `exp` claim. return Err ( Error :: ClaimValidation ) ; } if let Some ( expected_issuer ) = & self . validate_issuer { if let Some ( actual_issuer ) = claims . list_of . get ( " " ) { if expected_issuer != actual_issuer { return Err ( Error :: ClaimValidation ) ; } } else { return Err ( Error :: ClaimValidation ) ; } } if let Some ( expected_subject ) = & self . validate_subject { if let Some ( actual_subject ) = claims . list_of . get ( " " ) { if expected_subject != actual_subject { return Err ( Error :: ClaimValidation ) ; } } else { return Err ( Error :: ClaimValidation ) ; } } if let Some ( expected_audience ) = & self . validate_audience { if let Some ( actual_audience ) = claims . list_of . get ( " " ) { if expected_audience != actual_audience { return Err ( Error :: ClaimValidation ) ; } } else { return Err ( Error :: ClaimValidation ) ; } } if let Some ( expected_token_identifier ) = & self . validate_token_identifier { if let Some ( actual_token_identifier ) = claims . list_of . get ( " " ) { if expected_token_identifier != actual_token_identifier { return Err ( Error :: ClaimValidation ) ; } } else { return Err ( Error :: ClaimValidation ) ; } } Ok ( ( ) ) }
Validate the set of registered `claims` against the currently defined validation rules.
Validate the set of registered ` claims ` against the currently defined validation rules .
&self
claims
&Claims