@spec default_claims(
  Ash.Resource.t(),
  keyword()
) :: Joken.token_config()

Generate the default claims for a specified resource.

@spec generate_audience(Version.t()) :: String.t()

The generator function used to generate the "aud" claim.

It generates an Elixir-style ~> version requirement against the current major and minor version numbers of AshAuthentication.

@spec generate_issuer(Version.t()) :: String.t()

The generator function used to generate the "iss" claim.

@spec token_signer(
  Ash.Resource.t(),
  keyword()
) :: Joken.Signer.t()

The signer used to sign the token on a per-resource basis.

@spec validate_audience(String.t(), any(), any(), Version.t()) :: boolean()

The validation function used to validate the "aud" claim.

Uses Version.match?/2 to validate the provided claim against the current version. The use of ~> means that tokens generated by versions of AshAuthentication with the the same major version and at least the same minor version should be compatible.

@spec validate_issuer(String.t(), any(), any()) :: boolean()

The validation function used to validate the "iss" claim.

It simply verifies that the claim starts with "AshAuthentication"

@spec validate_jti(String.t(), any(), Ash.Resource.t() | any(), Keyword.t()) ::
  boolean()

The validation function used to the validate the "jti" claim.

This is done by checking that the token is valid with the token revocation resource. Requires that the subject's resource configuration be passed as the validation context. This is automatically done by calling Jwt.verify/2.