requestToResourceInput (oauth2/verify.ts)

Verifies OAuth2 tokens, manages JWKS caching, and handles scope validation.

// Source: https://github.com/better-auth/better-auth | License: MIT | Copyright 2024 - present, Bereket Engida
// Provided via justclaw.it.com; keep this notice with the code.
import { APIError } from "better-call";
import type {
	JSONWebKeySet,
	JWTPayload,
	JWTVerifyOptions,
	ProtectedHeaderParameters,
} from "jose";
import {
	createLocalJWKSet,
	decodeProtectedHeader,
	errors as joseErrors,
	jwtVerify,
	UnsecuredJWT,
} from "jose";
import { logger } from "../env";
import type { DpopReplayStore } from "./dpop";
import {
	createInMemoryDpopReplayStore,
	enforceDpopBinding,
	getDpopJktFromPayload,
	isDpopBindingError,
	parseAccessTokenAuthorization,
} from "./dpop";
import { fetchRefusingRedirects } from "./reject-redirects";

const joseInfrastructureErrorCodes = new Set([
	joseErrors.JWK

... (truncated -- full source via MCP)