{
  "context": "Evaluates how well the solution leverages python-jose to issue HMAC-signed JWTs. Checks reliance on the library's built-in claim validation for issuer, audience, and temporal checks while returning decoded claims on success.",
  "type": "weighted_checklist",
  "checklist": [
    {
      "name": "Uses jwt.encode",
      "description": "Creates tokens with python-jose's jwt.encode (or equivalent) using the shared secret and HS256, producing a compact string.",
      "max_score": 25
    },
    {
      "name": "Sets reserved claims",
      "description": "Populates sub, iss, aud, iat, exp, and optional nbf claims with numeric timestamps derived from current time and the provided durations before encoding.",
      "max_score": 20
    },
    {
      "name": "Uses jwt.decode",
      "description": "Decodes tokens with python-jose's jwt.decode using the same secret and allowed algorithms to verify the signature and return claims.",
      "max_score": 25
    },
    {
      "name": "Claim validation",
      "description": "Supplies issuer, audience, and leeway parameters to jwt.decode so python-jose enforces iss/aud/exp/nbf/iat checks and rejects mismatches or expiry.",
      "max_score": 20
    },
    {
      "name": "Error signaling",
      "description": "Propagates or surfaces python-jose verification exceptions (e.g., ExpiredSignatureError, JWTError) for invalid tokens instead of silently accepting them.",
      "max_score": 10
    }
  ]
}