pub async fn verify(
token: &str,
expected: TokenType,
) -> Result<Option<TokenDetails>, DBError>Expand description
Verifies a token of the EXPECTED type against its owner’s public key.
Reads the sub claim unverified as a routing hint ONLY, fetches that user’s
authoritative public key from the directory, re-verifies the signature, and
requires the claimed token_type to match expected — so an access token
can never be replayed where a refresh token is required (or vice-versa).
Returns Ok(None) for any credential failure — unknown user, missing key,
bad signature, wrong type, disabled account, or a superseded session
generation — so callers cannot distinguish failure modes (existence
masking). Err is reserved for the directory being unreadable, which is
not the user’s fault and must not read as an expired session. Always hits the DB for
the current key, status and generation, so a rotated key, a switched-off
account or a password change takes effect immediately.