Decodes and validates LTI ID Tokens (JWTs).

Implements the Authentication Response Validation steps from the IMS Security Framework. The module verifies the JWT signature using the platform's public key (fetched via Ltix.JWT.KeySet), enforces RS256-only signing, and validates all required claims.

Critical header extensions (RFC 7515 §4.1.11) are not supported.

Examples

{:ok, claims} = Ltix.JWT.Token.verify(token_string, registration)

Validation Steps

1. Decode the JWT header to extract alg and kid
2. Reject any algorithm other than RS256
3. Fetch the platform's public key by kid via Ltix.JWT.KeySet
4. Verify the RS256 signature
5. Validate iss matches the registration's issuer
6. Validate aud is the tool's client_id, or a list containing only it
7. Validate azp matches client_id (when present)
8. Validate iat is a NumericDate that is not in the future
9. Validate nbf is not in the future (when present)
10. Validate exp is not in the past and iat is within the maximum token age
11. Validate nonce is present

Steps 8 to 10 allow for clock skew.

Options

• :clock_skew - seconds of tolerance for exp, iat, and nbf validation (defaults to 5)
• :max_token_age - seconds after iat that a token is still accepted, or :infinity to accept any age (defaults to application config, then 3600)
• :now - override current time in unix seconds (useful for testing)
• :req_options - extra options passed through to Ltix.JWT.KeySet
• :key_set - key set name passed through to Ltix.JWT.KeySet
• :local_network_access - passed through to Ltix.JWT.KeySet