Validates that the 'at_hash' parameter included in the claims matches
    with the access_token returned alongside the id token as part of
    the authorization_code flow.

    Args:
        claims (dict): The claims dictionary to validate.
        access_token (str): The access token returned by the OpenID Provider.
        algorithm (str): The algorithm used to sign the JWT, as specified by
            the token headers.

def _validate_at_hash(claims, access_token, algorithm):
    """
    Validates that the 'at_hash' parameter included in the claims matches
    with the access_token returned alongside the id token as part of
    the authorization_code flow.

    Args:
        claims (dict): The claims dictionary to validate.
        access_token (str): The access token returned by the OpenID Provider.
        algorithm (str): The algorithm used to sign the JWT, as specified by
            the token headers.
    """
    if 'at_hash' not in claims and not access_token:
        return
    elif 'at_hash' in claims and not access_token:
        msg = 'No access_token provided to compare against at_hash claim.'
        raise JWTClaimsError(msg)
    elif access_token and 'at_hash' not in claims:
        msg = 'at_hash claim missing from token.'
        raise JWTClaimsError(msg)

    try:
        expected_hash = calculate_at_hash(access_token,
                                          ALGORITHMS.HASHES[algorithm])
    except (TypeError, ValueError):
        msg = 'Unable to calculate at_hash to verify against token claims.'
        raise JWTClaimsError(msg)
        
    if claims['at_hash'] != expected_hash:
        raise JWTClaimsError('at_hash claim does not match access_token.')