Authly::FormToken
A signed, expiring, purpose-bound token for the forms Authly renders (consent, device approval).
The claims travel in the form and cannot be changed by the browser; the HMAC key is derived from
Authly.config.secret_key and the purpose, so a token for one form is useless for another.
Handlers put the authenticated subject in the claims and compare it with the subject of the
POST: a token handed to one user cannot be replayed by (or against) another.
Class methods
issue(purpose : String, claims : Hash(String, String), ttl : Time::Span) : String
Sourceverify(purpose : String, token : String) : Hash(String, String) | Nil
The claims when the token is genuine, unexpired and issued for purpose; nil otherwise.