Lockspire.AccessToken (lockspire v1.6.1)

Encapsulates the state of an access token throughout the validation plug pipeline.

Summary

Types

t()

Functions

audiences(token)

Returns validated, first-seen-deduplicated access-token audiences.

confirmation(token)

Returns allowlisted confirmation values for the token's sender binding.

expires_at(token)

Returns the access-token expiration as a UTC DateTime.

scopes(token)

Returns normalized, first-seen-deduplicated access-token scopes.

subject(token)

Returns the normalized subject claim for an access token.

Types

t()

@type t() :: %Lockspire.AccessToken{
  authorization_scheme: String.t() | nil,
  binding_requirements:
    %{optional(:dpop_jkt) => String.t(), optional(:mtls_x5t_s256) => String.t()}
    | nil,
  binding_type: String.t() | nil,
  binding_verified: boolean(),
  claims: map() | nil,
  client_id: String.t() | nil,
  error: term(),
  token: String.t() | nil
}

Functions

audiences(token)

@spec audiences(t() | term()) :: [String.t()]

Returns validated, first-seen-deduplicated access-token audiences.

A single nonblank audience or a nonempty list of nonblank audiences is accepted. Missing and malformed claims return an empty list.

confirmation(token)

@spec confirmation(t() | term()) ::
  %{optional(:dpop_jkt) => String.t(), optional(:mtls_x5t_s256) => String.t()}
  | nil

Returns allowlisted confirmation values for the token's sender binding.

The returned map contains only nonblank cnf.jkt and cnf["x5t#S256"] values. Unknown or malformed confirmation members are not exposed.

expires_at(token)

@spec expires_at(t() | term()) :: DateTime.t() | nil

Returns the access-token expiration as a UTC DateTime.

Only integer JWT NumericDate values are accepted. Strings, floats, missing values, and values outside DateTime's supported range return nil.

scopes(token)

@spec scopes(t() | term()) :: [String.t()]

Returns normalized, first-seen-deduplicated access-token scopes.

A scope claim is a whitespace-delimited binary. Missing or malformed claims return an empty list.

subject(token)

@spec subject(t() | term()) :: String.t() | nil

Returns the normalized subject claim for an access token.

Blank, missing, and malformed subjects return nil. The original value remains available through token.claims for compatibility and extension use cases.