h$~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~                                                                                                                                                                    Safe-Inferred< % libjwt-typedRepresents a string consisting of only ASCII characters. JWT encoding and decoding can safely skip conversion to/from UTF-8 for these values Safe-Inferred<  libjwt-typedRaised when the JWT object uses a different algorithm in the header then the one we are trying to decode it with  libjwt-typed=Raised when a required claim is not present in the JWT object  libjwt-typedThrown when the token does not represent a decodable JWT object i.e. invalid UTF-8malformed JSON its signature cannot be verifiedBasically, this token cannot be accepted for further processing because either we cannot determine its authenticity or it is garbage.  libjwt-typedThe root of the decoding exceptions hierarchy. You can use it to catch all possible exceptions that may occur while decoding a token.   None<  Safe-Inferred< i None< libjwt-typedLow-level representation of JSON tokenization. Tokens are an exact representation of the underlying JSON, ie no conversions or unescaping has been performed.The only exception is JsStr which is already unquoted (JsStr value is the string between the first and last quotation marks of the corresponding JSON string).JSON objects are not parsed at all, but presented as one byte string (JsBlob). libjwt-typedWrapped pointer to jwt_t with managed lifetime libjwt-typedIO restricted to calling libjwt and jsmn( !"#$%&'()*+,-./0123456789:;<=( !"/#%)'+,-02648:;$&*(.13759<=None /9<>?QC libjwt-typedTypes that can be used as flags . That is, they support conversion to/from ASCII values, for example, simple sum types are good candidates that can even be generically derived data Scope = Login | Extended | UserRead | UserWrite | AccountRead | AccountWrite deriving stock (Show, Eq, Generic) instance AFlag Scope getFlagValue UserWriteASCII {getASCII = "userWrite"}/setFlagValue (ASCII "userWrite") :: Maybe ScopeJust UserWriteF libjwt-typed%Value that is encoded and decoded as CFlags provide a way to automatically encode and decode simple sum types. data Scope = Login | Extended | UserRead | UserWrite | AccountRead | AccountWrite deriving stock (Show, Eq, Generic) instance AFlag Scope mkPayload = jwtPayload (withIssuer "myApp" <> withRecipient " https://myApp.com" <> setTtl 300) ( #user_name ->> "John Doe" , #is_root ->> False , #user_id ->> (12345 :: Int) , #scope ->> Flag Login ) CDEFGHFGHCDE Safe-Inferred< P libjwt-typed5Represents a string which is already in JSON format. /Can be used for cases such as integration with aeson data Account = MkAccount { account_name :: Text, account_id :: UUID } deriving stock (Show, Eq, Generic) instance FromJSON Account instance ToJSON Account instance  P Account where rep = Json . encode unRep = decode . toJson PQRSTUPQRSTU Safe-Inferred<-X libjwt-typed*Class of keys that can be used for signingZ libjwt-typed2Class of keys that can be used (only) for decoding\ libjwt-typedElliptic curve public key ( PEM-encoded ) used in ECDSA algorithms for decoding ecPub = let public = C8.pack $ unlines [ "-----BEGIN PUBLIC KEY-----" , "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEKZL0X84AvdnGZdsIdAS60OnvF3FN" , "lsrCnaXRoJUVdOYZldzb4po2uDXF5W58DS8C31fV+z+0lTG5RvuAqfkdbA==" , "-----END PUBLIC KEY-----" ] in FromEcPub { ecPublicKey = public }_ libjwt-typed#Elliptic curves parameters used in ECDSA algorithms6According to RFC, the following curves are to be used:"alg" Param ValueDigital Signature AlgorithmES256ECDSA using P-256 and SHA-256ES384ECDSA using P-384 and SHA-384ES512ECDSA using P-521 and SHA-5123It is up to the user to use the appropriate curves.)The following names are used in OpenSSL:  prime256v1,  secp384r1 and  secp521r1Curve parametrs should be  PEM-encoded strings ecP256KeyPair = let private = C8.pack $ unlines [ "-----BEGIN EC PRIVATE KEY-----" , "MHcCAQEEINQ0e0KOa3EZSB5RTd2xBuO3O7NNFietDIWl+B+R38LuoAoGCCqGSM49" , "AwEHoUQDQgAEKZL0X84AvdnGZdsIdAS60OnvF3FNlsrCnaXRoJUVdOYZldzb4po2" , "uDXF5W58DS8C31fV+z+0lTG5RvuAqfkdbA==" , "-----END EC PRIVATE KEY-----" ] public = C8.pack $ unlines [ "-----BEGIN PUBLIC KEY-----" , "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEKZL0X84AvdnGZdsIdAS60OnvF3FN" , "lsrCnaXRoJUVdOYZldzb4po2uDXF5W58DS8C31fV+z+0lTG5RvuAqfkdbA==" , "-----END PUBLIC KEY-----" ] in FromEcPem { ecPrivKey = private, ecPubKey = public }c libjwt-typedRSA public-key ( PEM-encoded ) used in RSA algorithms for decoding  rsaPub = let public = C8.pack $ unlines [ "-----BEGIN PUBLIC KEY-----" , "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwCXp2P+qboao0tjUyU+D" , "3YI+sgBn8dkGaxOvPFLBFQMNkhbL0HEoRKNnQCubZNc0jXnMK5hCeGRnDS7lYclR" , "OXocRWUn5s2W3jP5xn7lM4otIpuE3FStthMCrPSEQiBCXE4cyKiHaZqmbqXlHAHV" , "EuGMM7oddiB6s3zjwf2h1v0SEiHf5ZFzTVarStablqh6wVDAiYyM+8aUM0x9p3Jc" , "aWW+eDk/UU3jCfCke7R3t2rbD1ZCj1cO08Uir3Lhf65TfU+iIrgLU3umV4B3gRcp" , "d8iz0ZTLaG8Qnm0GsPQjR3PTZYECxEnFaRgXcQLHYYMAW9YaX6T3rlTGZAaP5Ybo" , "xQIDAQAB" , "-----END PUBLIC KEY-----" ] in FromRsaPub { rsaPublicKey = public }f libjwt-typedRSA key-pair used in RSA algorithmsAccording to RFC: A key of size 2048 bits or larger MUST be used with these algorithms.0 - the user must ensure this property holds.3Both fields are assumed to be strings representing  PEM-encoded keys  rsa2048KeyPair = let private = C8.pack $ unlines [ "-----BEGIN RSA PRIVATE KEY-----" , "MIIEpgIBAAKCAQEAwCXp2P+qboao0tjUyU+D3YI+sgBn8dkGaxOvPFLBFQMNkhbL" , "0HEoRKNnQCubZNc0jXnMK5hCeGRnDS7lYclROXocRWUn5s2W3jP5xn7lM4otIpuE" , "3FStthMCrPSEQiBCXE4cyKiHaZqmbqXlHAHVEuGMM7oddiB6s3zjwf2h1v0SEiHf" , "5ZFzTVarStablqh6wVDAiYyM+8aUM0x9p3JcaWW+eDk/UU3jCfCke7R3t2rbD1ZC" , "j1cO08Uir3Lhf65TfU+iIrgLU3umV4B3gRcpd8iz0ZTLaG8Qnm0GsPQjR3PTZYEC" , "xEnFaRgXcQLHYYMAW9YaX6T3rlTGZAaP5YboxQIDAQABAoIBAQCg/OMBsauc8Ovv" , "xEX76MglxeM7hgWQ5vFus05lrzwgm686EClxme1QHMv8QszuXzSjuEFs4SQH9K82" , "p2z+UgrgqkOXjNoykVvvDgMe4OCuHv4T+dMGO1hTrXfXawKI2Lhg1/1bzX+u5ii9" , "mfbsUUixihHKoQvgFfRX/7JfrV50XZ3diwzd8DoEaIgeAIdyhLhVuh2W7wXbOF+l" , "aZW7gqCVzTBhC04E/D6eqFqvnkQyHzZPgaaDi4oL7gP8nGpcswlqKSLO5eVkkEHY" , "C88nAwU4Q/+qcAf09ijmTLlo07xLrLC0cOf2yQTwLj6ZffzTJ7NSMaPrTdEXThsW" , "wAeB/GcBAoGBAOzLST9/zakFGBTkwiLqgNVgEBUoYjB0Z+Fpx4qBLzKZNQP1yNup" , "LhC/4pIVQM+ZjOS0Wx7Sh0FTLHFb018quPiAPsKMEC2CW5v7vKwC4zW72/v5UrIw" , "pcBzl67nsc53r5Lblol9PU4oCjDzuFMjMbg+EzD3kVp/gxC9bRMwK3zBAoGBAM+7" , "nOV80uteB1ZXazccj6g0ANd2AyJY6gHfxD1CopvRReYm36wmG00HQ3jHZPUcsLQp" , "dWvWplRFprZlce0jl7HcB/8g5wUkErMop3KK5cA886HxsATNSl6rYghZGALqxm/a" , "+v2AKoZThns8QRYL5bsBD4kTQLEIwp7j6sNbBrkFAoGBAL6fL8o0gkUsWqSHO1mM" , "WkZrXMcLiW/kZbPqyb3QHUSoXStg818RpInLTwO2pEP7IpcCMdBwPn3yDPb8qv4T" , "kHBMHTnUMznPlRvO3aXDdVFOd9sybMYRr31sEJG250aExwx8RYVNEssWJI4fxST4" , "UhA1uJFU2uh1efdB5srpnjiBAoGBALTDCPAZAmCVXcUgJMe8LrWrKuBSbL/Cpz4i" , "PV0hUuZL4Is5YIEoV7FblLbQq2UvJgRf3zGLgwjp4vvsooo74pB+auby9pReo3cK" , "9UqS2wHBCC/vY7+J9CEU+SVSgbZoHWzQHH/iux5QKEGsWOaaS7nCXoZlHnHusYwZ" , "v/tmhh8RAoGBAIi3Lbup0AVwougANLXwMLCfT8HxI8Hozdr+Pe0ibTnjfY+BPuy1" , "vSgozXao68TwW3u58PcdvfBnfg/7XCK6TXtij48JDu6qw0IiSRxOZ5Ed/GW2P031" , "7TfwnjBohjM2O6NRne8qe6Qv5xLagoVKQfa1WhQEFU2bTNLYA/2kv266" , "-----END RSA PRIVATE KEY-----" ] public = C8.pack $ unlines [ "-----BEGIN PUBLIC KEY-----" , "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwCXp2P+qboao0tjUyU+D" , "3YI+sgBn8dkGaxOvPFLBFQMNkhbL0HEoRKNnQCubZNc0jXnMK5hCeGRnDS7lYclR" , "OXocRWUn5s2W3jP5xn7lM4otIpuE3FStthMCrPSEQiBCXE4cyKiHaZqmbqXlHAHV" , "EuGMM7oddiB6s3zjwf2h1v0SEiHf5ZFzTVarStablqh6wVDAiYyM+8aUM0x9p3Jc" , "aWW+eDk/UU3jCfCke7R3t2rbD1ZCj1cO08Uir3Lhf65TfU+iIrgLU3umV4B3gRcp" , "d8iz0ZTLaG8Qnm0GsPQjR3PTZYECxEnFaRgXcQLHYYMAW9YaX6T3rlTGZAaP5Ybo" , "xQIDAQAB" , "-----END PUBLIC KEY-----" ] in FromRsaPem { privKey = private, pubKey = public }j libjwt-typedSecret used in HMAC algorithms.According to RFC: A key of the same size as the hash output (for instance, 256 bits for HS256) or larger MUST be used (...)0 - the user must ensure this property holds.'A secret is just an octet sequence e.g. hs512 = HS512 "MjZkMDY2OWFiZmRjYTk5YjczZWFiZjYzMmRjMzU5NDYyMjMxODBjMTg3ZmY5OTZjM2NhM2NhN2Mx\ \YzFiNDNlYjc4NTE1MjQxZGI0OWM1ZWI2ZDUyZmMzZDlhMmFiNjc5OWJlZTUxNjE2ZDRlYTNkYjU5\ \Y2IwMDZhYWY1MjY1OTQgIC0K" XYZ[\]^_`abcdefghijkljklfghicde_`ab\]^XYZ[ Safe-Inferred</ libjwt-typed9Represents the number of seconds elapsed since 1970-01-01#Used in accordance with the RFC in ,  and  claims libjwt-typedConvert ( to a number of seconds since 1970-01-01 libjwt-typedAdd some seconds to the date libjwt-typed#Subtract some seconds from the date libjwt-typed'The number of seconds between two dates  None 9>4 libjwt-typed4Types that can be converted from JSON representation0This typeclass will be used to decode a list of a6 values (or a list of tuples whose element is of type a) libjwt-typedDecode from JSON token. libjwt-typed:Types that can be converted to a valid JSON representation0This typeclass will be used to encode a list of t6 values (or a list of tuples whose element is of type t) libjwt-typedEncode as JSON.Must generate a valid JSON value: take care of quoting, escaping, UTF-8 encoding etc. libjwt-typedConversion between a and b 3If an instance of this typeclass exists for a type b, then JWT encoder and decoder can be derived for that type. This derived encoderdecoder will use the encoder decoder of a4 and perform the convertions through this typeclass. libjwt-typedConvert b to a libjwt-typedTry to convert a to b , returning Nothing if unable None />6 libjwt-typedDefinition of claims encoding.The only use for the user is probably to write a function that is polymorphic in the payload type. libjwt-typedPerform the encoding as impure action libjwt-typed,Low-level definition of JWT claims encoding. libjwt-typedGiven a pointer to jwt_t, mutate the structure it points to to encode the value as a named claim It relies on the functions exported from Libjwt.FFI.Jwt to perform an impure effect of encoding libjwt-typedDo not perform any action. It is used to encode things like empty lists or Nothing None/<=>9 libjwt-typedDefinition of claims decoding.The only use for the user is probably to write a function that is polymorphic in the payload type libjwt-typed3Construct an action that decodes the value of type c, given a pointer to jwt_t. The action may fail. libjwt-typed(Low-level definition of claims decoding. libjwt-typedGiven a pointer to jwt_t", try to decode the value of type t libjwt-typedLift pure value libjwt-typedAction that returns  if decoding has failed libjwt-typed through proxy libjwt-typedAction that throws   if decoding has failed   None <: libjwt-typedJWT header representation libjwt-typed"typ" header parameter libjwt-typed"alg" header parameter None '(/2<?5  libjwt-typed.Cryptographic algorithm used to secure the JWT libjwt-typed!HMAC SHA-256 (secret key must be at least 256 bits in size) libjwt-typed!HMAC SHA-384 (secret key must be at least 384 bits in size) libjwt-typed!HMAC SHA-512 (secret key must be at least 512 bits in size) libjwt-typed)RSASSA-PKCS1-v1_5 SHA-256 (a key of size 2048 bits or larger" must be used with this algorithm) libjwt-typed)RSASSA-PKCS1-v1_5 SHA-384 (a key of size 2048 bits or larger# must be used with this algorithm)  libjwt-typed)RSASSA-PKCS1-v1_5 SHA-512 (a key of size 2048 bits or larger" must be used with this algorithm) libjwt-typed"ECDSA with P-256 curve and SHA-256 libjwt-typed"ECDSA with P-384 curve and SHA-384 libjwt-typed"ECDSA with P-521 curve and SHA-512 libjwt-typedNone libjwt-typed1Get the header parameter "alg" from the algorithm Algorithmalg  None&./9>?R libjwt-typed,Class of types that can be constructed from  PrivateClaims libjwt-typedConvert from claims libjwt-typed(Class of types that can be converted to  libjwt-typedConvert to claims libjwt-typed"Looks up the type associated with name in the '[n1  a, n2  b, ...] pairs list. Gets stuck if name is not in ts<:kind! LookupClaimType "n1" '["n1" ->> Int, "n2" ->> String]:LookupClaimType "n1" '["n1" ->> Int, "n2" ->> String] :: *= Int libjwt-typed)Constraint specifying when a claim named n( can be looked up in the list of claims nsSatisfied iff ns contains a claim named n and n is a type-level literal3:kind! CanGet "n1" '["n1" ->> Int, "n2" ->> String]:CanGet "n1" '["n1" ->> Int, "n2" ->> String] :: Constraint3= (GHC.TypeLits.KnownSymbol "n1", () :: Constraint)2:kind! CanGet "n" '["n1" ->> Int, "n2" ->> String]9CanGet "n" '["n1" ->> Int, "n2" ->> String] :: Constraint1= (GHC.TypeLits.KnownSymbol "n", (TypeError ...)) libjwt-typed)Constraint specifying when a claim named n$ can be added to the list of claims nsSatisfied iff:n is a type-level literal,in the names of ns claims there is no n (uniqueness),n) is not one of the restricted names (see )5:kind! CanAdd "name" '["n1" ->> Int, "n2" ->> String]> Int, "n2" ->> String] :: Constraint5= (GHC.TypeLits.KnownSymbol "name", () :: Constraint, () :: Constraint)3:kind! CanAdd "n1" '["n1" ->> Int, "n2" ->> String]:CanAdd "n1" '["n1" ->> Int, "n2" ->> String] :: Constraint3= (GHC.TypeLits.KnownSymbol "n1", () :: Constraint, (TypeError ...)) libjwt-typedContainer of named claims ts(, possibly prefixed with some namespace ns For example PrivateClaims '["string"  String, "int"  Int] ' denotes a structure containing a String under the "string" key plus an int under the "int" key. There is no namespace, so the keys will not be prefixed by any prefix when serializing the structure libjwt-typedKeeps the value of type a6 and the name (type-level) with which it is associated libjwt-typed+Type-level literal representing a namespaceCan be used with -XOverloadedLabels (the limited label syntax makes this rarely possibble though, a more common use is to write  Ns @"https: example.com") libjwt-typed,Type-level literal representing a claim nameCan be used with -XOverloadedLabels libjwt-typed Class of  with known compile-time value libjwt-typed&Convert namespace to a string (if any) libjwt-typedKind of namespaces-These types represent a URL-like claim prefix libjwt-typed'A convenient alias. Let's you write 0'["claimName" ->> Int, "anotherName" ->> String]% to indicate a list of types of kind , instead of 4'[Grant "claimName" Int, Grant "anotherName" String], libjwt-typedKind of claimsA claim is made up of a type-level literal and a type (this is essentialy a type-level tuple  (Symbol, *)) libjwt-typedExtract values from the container in the order in which they appear in the claim list libjwt-typed$Retrieve the string associated with  libjwt-typed Associate name with a valueWith -XOverloadedLabels:t #someName ->> True2#someName ->> True :: ClaimWitness "someName" Bool libjwt-typed Empty claims libjwt-typedInsert the claim."The claim can be safely added iff:there is no claim of the same name in the container,3its name is not the name of any public claim (like iss or sub)*Otherwise it is a compile-time error (see  constraint)With -XOverloadedLabels,addClaim #string "Value of claim" nullClaims(#string ->> "Value of claim")With -XTypeApplications and  -XDataKinds:addClaim (ClaimName @"string") "Value of claim" nullClaims(#string ->> "Value of claim") libjwt-typed Alias for  (binds to the right)With -XOverloadedLabels*#string ->> "Value of claim" .: nullClaims(#string ->> "Value of claim") libjwt-typed(Look up the claim value associated with name.Value can be retrieved if proven to exists in the container. Otherwise it is a compile-time error (see  constraint)With -XOverloadedLabelsgetClaim #bool $ #string ->> "Value of claim" .: #bool ->> False .: nullClaimsFalse libjwt-typed Alias for  (container goes first)With -XOverloadedLabels(#string ->> "Value of claim" .: #bool ->> False .: nullClaims) .! #boolFalse libjwt-typed-Convert to private claims with some namespace libjwt-typed Set namespace libjwt-typedUnset namespace%%6565None<T libjwt-typedjti (JWT ID) claim libjwt-typediat (Issued At) claim libjwt-typednbf (Not Before) claim libjwt-typedexp (Expiration Time) claim libjwt-typedaud (Audience) claim libjwt-typedsub (Subject) claim libjwt-typediss (Issuer) claimNone %/2<>?_ libjwt-typedJWT payload representation libjwt-typediss (Issuer) claim libjwt-typedsub (Subject) claim libjwt-typedaud (Audience) claim libjwt-typedexp (Expiration Time) claim libjwt-typednbf (Not Before) claim libjwt-typediat (Issued At) claim libjwt-typedjti (JWT ID) claim libjwt-typedprivate claims libjwt-typedCreate a payload from the builder and the value representing private claims For example: jwtPayload ( "myApp" <>  " https://myApp.com" <>  300) ( #userName  "John Doe" , #isRoot  False , #userId  (12345 :: Int) ) 0The resulting payload will be the equivalent of: { "aud": [ "https://myApp.com" ], "exp": 1599499073, "iat": 1599498773, "isRoot": false, "iss": "myApp", "userId": 12345, "userName": "JohnDoe" }An identical payload can be constructed from the following record type: data MyClaims = MyClaims { userName :: String , isRoot :: Bool , userId :: Int } deriving stock (Eq, Show, Generic) instance  UserClaims jwtPayload ( "myApp" <>  " https://myApp.com" <>  300) MyClaims { userName = "John Doe" , isRoot = False , userId = 12345 } If you want to assign a  namespace$ to your private claims, you can do: 5jwtPayload (withIssuer "myApp" <> withRecipient " https://myApp.com" <> setTtl 300) $  ( @" https://myApp.com") MyClaims { userId = 12345 , userName = JohnDoe' , isRoot = False } 0The resulting payload will be the equivalent of: { "aud": [ "https://myApp.com" ], "exp": 1599499073, "iat": 1599498773, "https://myApp.com/isRoot": false, "iss": "myApp", "https://myApp.com/userId": 12345, "https://myApp.com/userName": "JohnDoe" } libjwt-typedSet iss claim libjwt-typedSet iss claim libjwt-typedSet sub claim libjwt-typedSet sub claim libjwt-typedAppend one item to aud claim libjwt-typedAppend one item to aud claim libjwt-typedSet aud claim libjwt-typedSet exp claim libjwt-typedSet nbf claim libjwt-typedSet nbf claim to  libjwt-typedSet nbf claim to  plus the argument libjwt-typedSet iat claim to  libjwt-typedSet iat claim to  and exp claim to  plus the argument libjwt-typedSet jti claimNone%<l9 libjwt-typed!Reasons for rejecting a JWT token libjwt-typedUser check failed  libjwt-typedexp check failed: the current time was after or equal to the expiration time (plus possible ) libjwt-typednbf check failed: the current time was before the not-before time (minus possible ) libjwt-typedaud check failed: the application processing this claim did not identify itself () with a value in the aud claim libjwt-typediat check failed: the current time minus the time the JWT was issued (plus possible ) was greater than expected libjwt-typed(User-defined parameters of an validation libjwt-typed%extends the token validity period to [ - leeway,  + leeway) (also works for  checks such as ) libjwt-typed used for  checks: if : claim is present, it must contain the value of this param libjwt-typed with  set to 0 and  set to Nothing libjwt-typed"Construct validation from function libjwt-typedValidation that is always valid libjwt-typed)Validation that always fails and signals reason libjwt-typedRun checks against the payload.The exact set of checks is:  defaultValidationRules <> v , where v is passed to this function and defaultValidationRules is:check exp0 claim against the current time (minus possible ),check nbf/ claim against the current time (plus possible ),check aud claim against See the docs of  for a list of possible errors. libjwt-typedCheck the property prop! of a payload with the predicate pIf p is False, then signal  claim libjwt-typed Check that iss is present and equal to issuer. If not, then signal  "iss" libjwt-typed Check that sub is present and equal to subject. If not, then signal  "sub" libjwt-typed Check that iat" (if present) is not further than maxAge from  (minus possible ). Otherwise signal . libjwt-typed Check that iat (if present) is after time. If false, signal  "iat". libjwt-typed Check that jti is present and equal to jwtId. If not, then signal  "jti" libjwt-typed Check that  p a == True, where a is a value of private claim n. If not, signal  nExample:  not #is_root  libjwt-typedreason libjwt-typedleeway and appName libjwt-typedv libjwt-typedpayload libjwt-typedclaim libjwt-typedp libjwt-typedprop libjwt-typedissuer libjwt-typedsubject  libjwt-typedmaxAge  libjwt-typedtime libjwt-typedjwtId libjwt-typedp libjwt-typednNone 2Once the token has been successfully decoded, it is validated.In addition to the default rules mandated by the RFC, the application can add its own rules.The default rules are:check  claim to see if the current time is before the expiration time,check  claim to see if the current time is after or equal the not-before time,check  claim if the application identifies itself with a value in the  list (if present)You may allow a little ! when checking time-based claims. claim is checked against . libjwt-typed algorithm libjwt-typed JWT payload libjwt-typedtyp libjwt-typed algorithm libjwt-typed JWT payload libjwt-typed&algorithm used to verify the signature libjwt-typedtoken libjwt-typed and  libjwt-typedadditional validation rules libjwt-typed decoded token libjwt-typed and  libjwt-typedadditional validation rules  libjwt-typed&algorithm used to verify the signature libjwt-typed*base64url-encoded representation (a token)(c) 2020 Marcin RzenickiMPL-2.0-Marcin Rzenicki None| CDEFGHXYZ[\]^_`abcdefghijklCDEFGHNone  #$/8<~ !!"##$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]]^_`abcdefghijklmnopqrstuvwxyz{|}~                                                                                                                                                                   libjwt-typed-0.2-inplace Libjwt.ASCIILibjwt.ExceptionsLibjwt.FFI.Jwt Libjwt.FlagLibjwt.JsonByteString Libjwt.KeysLibjwt.NumericDateLibjwt.ClassesLibjwt.EncodingLibjwt.Decoding Libjwt.HeaderLibjwt.AlgorithmsLibjwt.PrivateClaimsLibjwt.RegisteredClaimsLibjwt.PayloadLibjwt.JwtValidation Libjwt.JwtLibjwt.FFI.JsmnLibjwt.FFI.LibjwtJwtRepExpNbfIat MissingClaim Web.LibjwtWeb.Libjwt.TutorialASCIIgetASCII $fEqASCII $fOrdASCII $fReadASCII $fShowASCIIAlgorithmMismatchMissingDecodeExceptionSomeDecodeException$fExceptionSomeDecodeException$fShowSomeDecodeException$fExceptionDecodeException$fExceptionMissingClaim$fExceptionAlgorithmMismatch$fShowAlgorithmMismatch$fShowMissingClaim$fShowDecodeException JsonTokenJsStrJsNumJsTrueJsFalseJsNullJsArrayJsBlobJwtTJwtIOunsafePerformJwtIOmkJwtT jwtDecodeaddGrantunsafeAddGrant addGrantBoolunsafeAddGrantBool addGrantInt64unsafeAddGrantInt64 addGrantIntunsafeAddGrantIntaddGrantsFromJson jwtSetAlg addHeaderunsafeAddHeader jwtEncodegetGrantunsafeGetGrant getGrantBoolunsafeGetGrantBool getGrantInt64unsafeGetGrantInt64 getGrantIntunsafeGetGrantIntgetGrantAsJsonunsafeGetGrantAsJson jwtGetAlg getHeaderunsafeGetHeaderunsafeMapTokenizedJsonArray$fFunctorJwtIO$fApplicativeJwtIO $fMonadJwtIO$fMonadThrowJwtIO$fMonadCatchJwtIOAFlag getFlagValue setFlagValueFlaggetFlag $fGFlagM1 $fGFlagM10 $fGFlag:+: $fGFlagM11 $fAFlagFlag $fShowFlag$fEqFlagJsonByteStringJsontoJsonjsonFromStrict toJsonStrict toJsonBuilder$fShowJsonByteString$fEqJsonByteString SigningKey getSigningKey DecodingKeygetDecodingKeyEcPubKey FromEcPub ecPublicKey EcKeyPair FromEcPem ecPrivKeyecPubKey RsaPubKey FromRsaPub rsaPublicKey RsaKeyPair FromRsaPemprivKeypubKeySecretMkSecretreveal$fIsStringSecret$fDecodingKey()$fDecodingKeyEcPubKey$fDecodingKeyEcKeyPair$fDecodingKeyRsaPubKey$fDecodingKeyRsaKeyPair$fDecodingKeySecret$fSigningKey()$fSigningKeyEcKeyPair$fSigningKeyRsaKeyPair$fSigningKeySecret$fShowEcPubKey $fEqEcPubKey$fShowEcKeyPair $fEqEcKeyPair$fShowRsaPubKey $fEqRsaPubKey$fShowRsaKeyPair$fEqRsaKeyPair $fShowSecret $fEqSecret NumericDatesecondsSinceEpoch fromPOSIXfromUTCtoPOSIXnow plusSeconds minusSeconds diffSeconds$fShowNumericDate$fEqNumericDate$fOrdNumericDate$fBoundedNumericDate JsonParser jsonParser JsonBuilder jsonBuilderrepunRep$fJwtRepASCIIFlag$fJwtRep[]NonEmpty$fJwtRepByteStringText$fJwtRepASCIIDay$fJwtRepASCIILocalTime$fJwtRepASCIIZonedTime$fJwtRepASCIIUTCTime$fJwtRepByteStringUUID$fJwtRepByteStringASCII$fJwtRepByteString[]$fJsonBuilder(,)$fJsonBuilderMaybe$fJsonBuilder[]$fJsonBuilderJsonByteString$fJsonBuilderFlag$fJsonBuilderDay$fJsonBuilderZonedTime$fJsonBuilderLocalTime$fJsonBuilderUTCTime$fJsonBuilderUUID$fJsonBuilderText$fJsonBuilderASCII$fJsonBuilder[]0$fJsonBuilderNumericDate$fJsonBuilderInt$fJsonBuilderBool$fJsonBuilderByteString$fJsonParser(,)$fJsonParserMaybe$fJsonParser[]$fJsonParserJsonByteString$fJsonParserFlag$fJsonParserDay$fJsonParserZonedTime$fJsonParserLocalTime$fJsonParserUTCTime$fJsonParserUUID$fJsonParserNumericDate$fJsonParserText$fJsonParserASCII$fJsonParser[]0$fJsonParserInt$fJsonParserBool$fJsonParserByteStringEncodeencode ClaimEncoder encodeClaim EncodeResult nullEncode$fClaimEncoder'Deriveda#$fClaimEncoder'NativeJsonByteString $fClaimEncoder'NativeNumericDate$fClaimEncoder'NativeInt$fClaimEncoder'NativeBool$fClaimEncoder'NativeByteString$fClaimEncoder'Spec[]$fClaimEncoder'SpecMaybe$fClaimEncoderaDecodedecode Decodable ClaimDecoder decodeClaim DecodeResultResult getOptional hoistResult getOrEmptydecodeClaimProxieddecodeClaimOrThrow$fClaimDecoder'Deriveda$fClaimDecoder'Native[]#$fClaimDecoder'NativeJsonByteString $fClaimDecoder'NativeNumericDate$fClaimDecoder'NativeInt$fClaimDecoder'NativeBool$fClaimDecoder'NativeByteString$fClaimDecodera$fFunctorDecodeResult$fApplicativeDecodeResult$fMonadDecodeResult$fAlternativeDecodeResultHeaderalgtypTypJWTAlgNoneHS256HS384HS512RS256RS384RS512ES256ES384ES512 $fDecodeAlg $fDecodeTyp $fEncodeTyp$fDecodeHeader $fShowHeader $fEqHeader $fShowTyp$fEqTyp $fShowAlg$fEqAlgEcKeyRsaKey AlgorithmHMAC256HMAC384HMAC512RSA256RSA384RSA512ECDSA256ECDSA384ECDSA512AlgNone jwtAlgWithKey toHeaderAlg$fShowAlgorithmFromPrivateClaimsfromPrivateClaimsToPrivateClaimsClaimsOutNstoPrivateClaimsLookupClaimTypeCanGetRestrictedNameCanAddEmpty PrivateClaims ClaimWitnesstestifyNs ClaimNameKnownNamespacenamespaceValue NamespaceNoNsSomeNs->>ClaimGrant:< claimNameVal nullClaimsaddClaim.:getClaim.!withNssomeNsnoNs$fKnownNamespaceSomeNs$fKnownNamespaceNoNs$fIsLabelnameClaimName$fIsLabelnameNs$fEqPrivateClaims$fEncodePrivateClaims$fEqPrivateClaims0$fShowPrivateClaims$fDecodePrivateClaims$fEncodePrivateClaims0$fDefaultPrivateClaims$fDecodeAuxMononsnameb$fDecodeAuxReqnsnamea$fDecodeAuxOptnsnameb$fDecodePrivateClaims0$fShowLPrivateClaims$fShowLPrivateClaims0$fShowPrivateClaims0$fRecordToPrivateClaimsk:+:$fRecordToPrivateClaimskM1$fRecordToPrivateClaimskM10$fToPrivateClaimsPrivateClaims$fToPrivateClaims(,,,,,,)$fToPrivateClaims(,,,,,)$fToPrivateClaims(,,,,)$fToPrivateClaims(,,,)$fToPrivateClaims(,,)$fToPrivateClaims(,)$fToPrivateClaimsClaimWitness$fToPrivateClaims()$fRecordFromPrivateClaimsk:+:$fRecordFromPrivateClaimsk:*:$fRecordFromPrivateClaimskM1$fRecordFromPrivateClaimskM10$fFromPrivateClaims(,,,,,,)$fFromPrivateClaims(,,,,,)$fFromPrivateClaims(,,,,)$fFromPrivateClaims(,,,)$fFromPrivateClaims(,,)$fFromPrivateClaims(,)$fRecordToPrivateClaimsk:*:$fRecordFromPrivateClaimskM11$fRecordToPrivateClaimskM11JtiAudSubIss $fDefaultIss $fDecodeIss $fEncodeIss $fDefaultSub $fDecodeSub $fEncodeSub $fDecodeAud $fEncodeAud $fDefaultExp $fDecodeExp $fEncodeExp$fOrdExp $fDefaultNbf $fDecodeNbf $fEncodeNbf $fDefaultIat $fDecodeIat $fEncodeIat $fDefaultJti $fDecodeJti $fEncodeJti $fShowJti$fEqJti $fShowIat$fEqIat$fOrdIat $fShowNbf$fEqNbf$fOrdNbf $fShowExp$fEqExp $fShowAud$fEqAud$fSemigroupAud $fMonoidAud $fShowSub$fEqSub $fShowIss$fEqIss JwtBuilderPayload ClaimsSetisssubaudexpnbfiatjti privateClaims jwtPayload withIssuerissuedBy withSubjectissuedTo withRecipient intendedFor withAudience expiresAt notBefore notBeforeNownotUntil issuedNowsetTtl withJwtId$fDecodePayload$fEncodePayload$fDefaultPayload$fSemigroupJwtBuilder$fMonoidJwtBuilder $fEqPayload $fShowPayload JwtValidationCheckValidValidationFailure InvalidClaim TokenExpired TokenNotReadyWrongRecipient TokenTooOldValidationSettingsSettingsleewayappName ValidationNELdefaultValidationSettings validationvalidinvalid runValidationcheck checkIssuer checkSubjectcheckAgecheckIssuedAfter checkJwtId checkClaim$fSemigroupValid$fMonoidJwtValidation$fSemigroupJwtValidation $fShowValid$fShowValidationFailure$fEqValidationFailure$fShowValidationSettings ValidatedgetValidDecoded getDecodedEncodedgetTokenJwtheaderpayloadsignsign' decodeStringdecodeByteString validateJwt jwtFromStringjwtFromByteString$fShowValidated $fEqValidated $fShowDecoded $fEqDecoded $fShowEncoded $fEqEncoded$fEqJwt $fShowJwt JsmnTypeTJsmnTypeJsmnTokTTokenparentstartjsmnTypeendsizepeekType peekParent jsmnUndefined jsmnObject jsmnArray jsmnString jsmnPrimitiveJwtAlgTJwtAlg jwtAlgNone jwtAlgHs256 jwtAlgHs384 jwtAlgHs512 jwtAlgRs256 jwtAlgRs384 jwtAlgRs512 jwtAlgEs256 jwtAlgEs384 jwtAlgEs512 jwtAlgTermmonad-time-0.3.1.0-447158323cb4ffe24f076108fb68bc9a7faaa02c7929323ebacb3d5b9c7189b2Control.Monad.Time currentTimebaseGHC.Basemempty