docs: def _validate_at_hash(claims, access_token, algorithm):
      """
      Validates that the 'at_hash' parameter included in the claims matches
      with the access_token returned alongside the id token as part of
      the authorization_code flow.
  
      Args:
          claims (dict): The claims dictionary to validate.
          access_token (str): The access token returned by the OpenID Provider.
          algorithm (str): The algorithm used to sign the JWT, as specified by
              the token headers.
      """
      if 'at_hash' not in claims and not access_token:
          return
      elif 'at_hash' in claims and not access_token:
          msg = 'No access_token provided to compare against at_hash claim.'
          raise JWTClaimsError(msg)
      elif access_token and 'at_hash' not in claims:
          msg = 'at_hash claim missing from token.'
          raise JWTClaimsError(msg)
  
      try:
          expected_hash = calculate_at_hash(access_token,
                                            ALGORITHMS.HASHES[algorithm])
      except (TypeError, ValueError):
          msg = 'Unable to calculate at_hash to verify against token claims.'
          raise JWTClaimsError(msg)
          
      if claims['at_hash'] != expected_hash:
          raise JWTClaimsError('at_hash claim does not match access_token.')