Crypto.Paseto.Token.Validation

PASETO token claim validation.

Errors

data ValidationError

Validation error.

Constructors

ValidationClaimNotFoundError

Expected claim does not exist.

Fields

• !ClaimKey

  Claim key which could not be found.

ValidationInvalidClaimError

Token claim is invalid.

Fields

• !ClaimKey

  Claim key.

• !Text

  Expected claim value (rendered as Text).

• !Text

  Actual claim value (rendered as Text).

ValidationExpirationError !Expiration

Token is expired.

ValidationIssuedAtError !IssuedAt

Token's IssuedAt time is in the future.

ValidationNotBeforeError !NotBefore

Token is not yet valid as its NotBefore time is in the future.

ValidationCustomError !Text

Custom validation error.

Instances

Show ValidationError

Defined in Crypto.Paseto.Token.Validation

Methods

showsPrec :: Int -> ValidationError -> ShowS

show :: ValidationError -> String

showList :: [ValidationError] -> ShowS

Eq ValidationError

Defined in Crypto.Paseto.Token.Validation

Methods

(==) :: ValidationError -> ValidationError -> Bool

(/=) :: ValidationError -> ValidationError -> Bool

renderValidationError :: ValidationError -> Text

Render a ValidationError as Text.

renderValidationErrors :: NonEmpty ValidationError -> Text

Render a non-empty list of ValidationErrors as Text.

Rules

newtype ValidationRule

Token claim validation rule.

Constructors

ValidationRule

Fields

• unValidationRule :: Claims -> Either ValidationError ()

newtype ClaimMustExist

Whether a claim must exist.

Constructors

ClaimMustExist Bool

Simple rules

forAudience :: Audience -> ValidationRule

Validate that a token is intended for a given audience.

identifiedBy :: TokenIdentifier -> ValidationRule

Validate a token's identifier.

issuedBy :: Issuer -> ValidationRule

Validate a token's issuer.

notExpired :: UTCTime -> ValidationRule

Validate that a token is not expired at the given time.

That is, if the ExpirationClaim is present, check that it isn't in the past (relative to the given time).

subject :: Subject -> ValidationRule

Validate the subject of a token.

validAt :: UTCTime -> ValidationRule

Validate that a token is valid at the given time.

This involves the following checks (relative to the given time):

• If the ExpirationClaim is present, check that it isn't in the past.
• If the IssuedAtClaim is present, check that it isn't in the future.
• If the NotBeforeClaim is present, check that it isn't in the future.

customClaimEq

Arguments

:: ClaimMustExist

Whether the custom claim must exist.

-> UnregisteredClaimKey

Custom claim key to lookup.

-> Value

Custom claim value to validate (i.e. the expected value).

-> ValidationRule

Validate that a custom claim is equal to the given value.

Recommended default rules

getDefaultValidationRules :: IO [ValidationRule]

Get a list of recommended default validation rules.

At the moment, the only default rule is checking validAt for the current system time (getCurrentTime).

Validation

validate :: [ValidationRule] -> Claims -> Either (NonEmpty ValidationError) ()

Validate a list of rules against a collection of claims.

This function will run through all of the provided validation rules and collect all of the errors encountered, if any. If there are no validation errors, Right () is returned.

validateDefault :: Claims -> IO (Either (NonEmpty ValidationError) ())

Validate a collection of claims against the default validation rules (getDefaultValidationRules).