Function checked_proof 

fn checked_proof(
    state: &AppState,
    headers: &HeaderMap,
    path: &str,
) -> Result<VerifiedProof, OAuthError>

The DPoP proof a request to this authorization server carries, checked against the absolute URL of path on this deployment.

A client answers a nonce challenge by sending the same body again with a new proof, so this runs before anything the body names is fetched or spent: the client’s document, its assertion, a code, a refresh token. The reference provider checks in the same order. The proof’s jti is read here and not spent; see crate::oauth::dpop.