✅ cnf_missing_jkt_should_fail
✅ empty_cnf_value_should_fail
✅ mismatched_jkt_should_fail
✅ missing_cnf_should_fail
✅ non_json_object_cnf_should_fail(cnf: "[]")
✅ non_json_object_cnf_should_fail(cnf: "[\"asdf\"]")
✅ non_json_object_cnf_should_fail(cnf: "[123]")
✅ non_json_object_cnf_should_fail(cnf: "0")
✅ non_json_object_cnf_should_fail(cnf: "1")
✅ non_json_object_cnf_should_fail(cnf: "3.14159")
✅ non_json_object_cnf_should_fail(cnf: "false")
✅ non_json_object_cnf_should_fail(cnf: "not-a-json-object")
✅ non_json_object_cnf_should_fail(cnf: "null")
✅ non_json_object_cnf_should_fail(cnf: "true")

✅ can_retrieve_issued_at_unix_time_from_nonce
✅ expiration_check_is_correct_at_boundaries(issuedAt: 1704088800, validFor: 100, clockSkew: 0, now: 1704088799, expected: True)
✅ expiration_check_is_correct_at_boundaries(issuedAt: 1704088800, validFor: 100, clockSkew: 0, now: 1704088800, expected: False)
✅ expiration_check_is_correct_at_boundaries(issuedAt: 1704088800, validFor: 100, clockSkew: 0, now: 1704088801, expected: False)
✅ expiration_check_is_correct_at_boundaries(issuedAt: 1704088800, validFor: 100, clockSkew: 0, now: 1704088899, expected: False)
✅ expiration_check_is_correct_at_boundaries(issuedAt: 1704088800, validFor: 100, clockSkew: 0, now: 1704088900, expected: False)
✅ expiration_check_is_correct_at_boundaries(issuedAt: 1704088800, validFor: 100, clockSkew: 0, now: 1704088901, expected: True)
✅ expiration_check_is_correct_at_boundaries(issuedAt: 1704088800, validFor: 100, clockSkew: 10, now: 1704088789, expected: True)
✅ expiration_check_is_correct_at_boundaries(issuedAt: 1704088800, validFor: 100, clockSkew: 10, now: 1704088790, expected: False)
✅ expiration_check_is_correct_at_boundaries(issuedAt: 1704088800, validFor: 100, clockSkew: 10, now: 1704088791, expected: False)
✅ expiration_check_is_correct_at_boundaries(issuedAt: 1704088800, validFor: 100, clockSkew: 10, now: 1704088799, expected: False)
✅ expiration_check_is_correct_at_boundaries(issuedAt: 1704088800, validFor: 100, clockSkew: 10, now: 1704088800, expected: False)
✅ expiration_check_is_correct_at_boundaries(issuedAt: 1704088800, validFor: 100, clockSkew: 10, now: 1704088801, expected: False)
✅ expiration_check_is_correct_at_boundaries(issuedAt: 1704088800, validFor: 100, clockSkew: 10, now: 1704088899, expected: False)
✅ expiration_check_is_correct_at_boundaries(issuedAt: 1704088800, validFor: 100, clockSkew: 10, now: 1704088900, expected: False)
✅ expiration_check_is_correct_at_boundaries(issuedAt: 1704088800, validFor: 100, clockSkew: 10, now: 1704088901, expected: False)
✅ expiration_check_is_correct_at_boundaries(issuedAt: 1704088800, validFor: 100, clockSkew: 10, now: 1704088909, expected: False)
✅ expiration_check_is_correct_at_boundaries(issuedAt: 1704088800, validFor: 100, clockSkew: 10, now: 1704088910, expected: False)
✅ expiration_check_is_correct_at_boundaries(issuedAt: 1704088800, validFor: 100, clockSkew: 10, now: 1704088911, expected: True)
✅ expired_nonce_returns_use_dpop_nonce_with_server_issued_nonce
✅ expired_proofs_set_errors
✅ invalid_nonce_is_treated_as_zero
✅ invalid_nonce_returns_use_dpop_nonce_with_server_issued_nonce(nonce: "garbage")
✅ invalid_nonce_returns_use_dpop_nonce_with_server_issued_nonce(nonce: "null")
✅ missing_nonce_returns_use_dpop_nonce_with_server_issued_nonce(nonce: " ")
✅ missing_nonce_returns_use_dpop_nonce_with_server_issued_nonce(nonce: "")
✅ missing_nonce_returns_use_dpop_nonce_with_server_issued_nonce(nonce: null)
✅ nonce_contains_data_protected_issued_at_unix_time
✅ unexpired_proofs_do_not_set_errors
✅ use_client_or_server_clock_skew_depending_on_validation_mode(clientClockSkew: 0, serverClockSkew: 10, mode: Nonce)
✅ use_client_or_server_clock_skew_depending_on_validation_mode(clientClockSkew: 10, serverClockSkew: 0, mode: IssuedAt)
✅ validate_iat_when_option_is_set(mode: Both)
✅ validate_iat_when_option_is_set(mode: IssuedAt)
✅ validate_nonce_when_option_is_set(mode: Both)
✅ validate_nonce_when_option_is_set(mode: Nonce)

✅ disallowed_algorithms_fail(alg: "HS256")
✅ disallowed_algorithms_fail(alg: "HS384")
✅ disallowed_algorithms_fail(alg: "HS512")
✅ disallowed_algorithms_fail(alg: "none")
✅ malformed_proof_tokens_fail
✅ proof_tokens_with_incorrect_typ_header_fail
✅ valid_algorithms_succeed(alg: "ES256")
✅ valid_algorithms_succeed(alg: "ES384")
✅ valid_algorithms_succeed(alg: "ES512")
✅ valid_algorithms_succeed(alg: "PS256")
✅ valid_algorithms_succeed(alg: "PS384")
✅ valid_algorithms_succeed(alg: "PS512")
✅ valid_algorithms_succeed(alg: "RS256")
✅ valid_algorithms_succeed(alg: "RS384")
✅ valid_algorithms_succeed(alg: "RS512")

✅ expired_payload_fails
✅ mismatched_ath_fails
✅ missing_ath_fails
✅ missing_htm_fails
✅ missing_htu_fails
✅ missing_iat_fails
✅ missing_jti_fails
✅ missing_payload_fails
✅ valid_payload_succeeds

✅ new_proof_tokens_are_added_to_replay_cache(validateIat: False, validateNonce: True, clientClockSkew: 0, serverClockSkew: 10)
✅ new_proof_tokens_are_added_to_replay_cache(validateIat: True, validateNonce: False, clientClockSkew: 10, serverClockSkew: 0)
✅ new_proof_tokens_are_added_to_replay_cache(validateIat: True, validateNonce: True, clientClockSkew: 10, serverClockSkew: 20)
✅ new_proof_tokens_are_added_to_replay_cache(validateIat: True, validateNonce: True, clientClockSkew: 20, serverClockSkew: 10)
✅ new_proof_tokens_are_added_to_replay_cache(validateIat: True, validateNonce: True, clientClockSkew: 20, serverClockSkew: 20)
✅ replays_detected_in_ValidatePayload_fail
✅ replays_detected_in_ValidateReplay_fail

✅ excessively_large_proof_fails
✅ incorrect_token_type_fails
✅ missing_token_fails
✅ valid_token_and_proof_succeeds