docs

jwt-authorizer/docs/README.md

@@ -33,4 +33,31 @@ Example:
     axum::Server::bind(&"0.0.0.0:3000".parse().unwrap())
         .serve(app.into_make_service()).await.expect("server failed");
     # };
-```
+```
+
+## ClaimsChecker
+
+A check function (mapping deserialized claims to boolean) can be added to the authorizer. 
+
+A check failure results in a 403 (WWW-Authenticate: Bearer error="insufficient_scope") error.
+
+Example:
+
+```rust
+
+    use jwt_authorizer::{JwtAuthorizer};
+    use serde::Deserialize;
+
+    // Authorized entity, struct deserializable from JWT claims
+    #[derive(Debug, Deserialize, Clone)]
+    struct User {
+        sub: String,
+    }
+
+    let authorizer = JwtAuthorizer::new()
+                    .from_rsa_pem("../config/jwtRS256.key.pub")
+                    .with_check(
+                        |claims: &User| claims.sub.contains('@') // must be an email
+                    );
+```
+