Get the subject of a token. Currently support RunTokens and PersonalAccessTokens, which return Lightning.Runs and Lightning.Accounts.Users respectively.

This is pure resolution and performs no authorization, so callers must go through verify/1 first.

@spec require_claims(String.t(), [String.t()]) ::
  :ok | {:error, {:missing_claims, [String.t()]} | :token_malformed}

Asserts every claim in required is present on the token.

Joken iterates the token's claims and looks each up in the config, so a validator for an absent claim never runs — a claim config cannot make a claim mandatory on its own. This runs before verification and only ever rejects, so peeking at unverified claims is safe.

@spec verify(String.t()) :: {:ok, map()} | {:error, any()}

Verify a token and return the claims if successful.

This serves as a central point to verify and validate different types of tokens. For user (personal access) tokens it also rejects unusable credentials: a deleted token row yields {:error, :token_revoked}, a blocked account yields {:error, :user_blocked}, and an account past its email-confirmation deadline yields {:error, :email_unconfirmed}.