The Token Gatekeeper

Story

The IMBEGNAL gateway has already verified the signature of an access token and decoded its payload (the claims). What is left is the part that causes most real-world outages: the time checks. A server whose clock is a few seconds slow rejects fresh tokens, and one that forgets exp accepts a stolen token forever. You write the function that makes the final decision.

Your task

Implement token_status(claims, now, leeway) in Python or tokenStatus(claims, now, leeway) in JavaScript and return exactly one of these strings:

• claims is a dictionary / object of the decoded payload, now is the current Unix time in whole seconds, leeway is the allowed clock skew in seconds (an integer, 0 or more).
• Apply the rules in this order; the first one that fires decides:

1. malformed: exp is missing or is not an integer, or nbf is present but is not an integer. Strings, booleans, null, lists, objects and numbers with a fractional part are not integers.
2. wrong_issuer: iss is not exactly the string "imbegnal" (missing, another case, another type: all wrong).
3. wrong_audience: aud is neither the string "api" nor a list that contains the string "api" (missing, "api-v2", [], a number: all wrong).
4. not_yet_valid: nbf is present and now + leeway < nbf.
5. expired: now >= exp + leeway (at the exact expiry second the token is already expired).
6. valid: none of the above. Any other claim (sub, iat, scope…) is ignored.

How it is run

A test driver calls your function once per case and prints the returned strings, one per line. Write only the function (and helpers); do not read input or print anything yourself.

Example

token_status({"iss": "imbegnal", "aud": "api", "exp": 1000}, 999, 0)
  -> "valid"
token_status({"iss": "imbegnal", "aud": "api", "exp": 1000}, 1000, 0)
  -> "expired"
token_status({"iss": "imbegnal", "aud": ["web", "api"], "nbf": 500, "exp": 1000}, 495, 4)
  -> "not_yet_valid"

[{"claims":{"iss":"imbegnal","aud":"api","exp":1000},"now":999,"leeway":0},{"claims":{"iss":"imbegnal","aud":"api","exp":1000},"now":1000,"leeway":0},{"claims":{"iss":"imbegnal","aud":["web","api"],"nbf":500,"exp":1000},"now":495,"leeway":4}]