Summary:

The code changes in this pull request focus on improving the security of the JWT (JSON Web Token) validation process in the cedarling application. The changes primarily involve adding negative test cases to cover various scenarios where the JWT tokens (id_token, access_token, and userinfo_token) are invalid or expired.

The key security-related changes include:

1. Comprehensive Token Validation Tests: The new test cases cover scenarios such as invalid signatures, expired tokens, and tokens used before the nbf (Not Before) timestamp. This helps ensure that the JWT service correctly identifies and rejects these types of invalid tokens, reducing the risk of security vulnerabilities.

2. Simplified Validation Logic: The changes in the decoding_strategy.rs file simplify the validation rules by removing the validation for iss, aud, and sub claims. While this may improve performance, it also reduces the overall validation, which could potentially make the application more susceptible to certain types of attacks, such as token replay or tampering.

3. Removal of Cross-Validation: The previous version of the code performed cross-validation between the different tokens (access_token, id_token, and userinfo_token) to ensure that the iss and aud claims matched. This type of cross-validation helps prevent token substitution attacks, and its removal may introduce new security risks that should be carefully considered.

Overall, the changes in this pull request focus on strengthening the security of the JWT validation process, but they also introduce some potential trade-offs that should be reviewed and addressed to maintain the application's overall security posture.

Files Changed:

1. jans-cedarling/cedarling/src/jwt/test/with_validation/id_token.rs: Adds negative test cases for id_token validation, including invalid signature, expired tokens, and tokens used before nbf.
2. jans-cedarling/cedarling/src/jwt/test/with_validation/access_token.rs: Adds negative test cases for access_token validation, including invalid signature, expired tokens, and tokens used before nbf.
3. jans-cedarling/cedarling/src/jwt/decoding_strategy.rs: Simplifies the validation rules by removing the validation for iss, aud, and sub claims.
4. jans-cedarling/cedarling/src/jwt/mod.rs: Updates the JwtService module, removing the DecodingArgs struct and simplifying the validation logic.
5. jans-cedarling/cedarling/src/jwt/test/with_validation/userinfo_token.rs: Adds negative test cases for userinfo_token validation, including invalid signature, expired tokens, and tokens used before nbf.