Add check for 'ath' claim

Updated JWT DPoP validation to check for 'ath' claim and throw an exception if missing.

Author: Potherca

src/Utils/DPop.php

@@ -166,17 +166,18 @@ public function makeJwkThumbprint($jwk) {
 	public function validateJwtDpop($jwt, $dpop, $request) {
 		$this->validateDpop($dpop, $request);
 		$jwtConfig = Configuration::forUnsecuredSigner();
-		$jwtConfig->parser()->parse($dpop);
-
-		/**
-		 * @FIXME: ATH claim is not yet supported/required by the Solid OIDC specification.
-		 *         Once the Solid spec catches up to the DPOP spec, not having an ATH is incorrect.
-		 *         At that point, instead of returning "true", throw an exception:
-		 *
-		 * @see https://github.com/pdsinterop/php-solid-auth/issues/34
-		 */
-		// throw new InvalidTokenException('DPoP "ath" claim is missing');
-		return true;
+		$dpopJWT = $jwtConfig->parser()->parse($dpop);
+		
+		$ath = $dpopJWT->claims()->get('ath');
+
+		if ($ath === null) {
+			throw new InvalidTokenException('DPoP "ath" claim is missing');
+		}
+		
+		$hash    = hash('sha256', $jwt);
+		$encoded = Base64Url::encode($hash);
+	
+		return ($ath === $encoded);
 	}
 
 	/**