Function: assertTokenExpected()

assertTokenExpected(token, expected): void

Defined in: packages/key-custodian/src/policy.ts:195

The allowlist: refuses a token whose reported manufacturer, model or serial differs from the one configured. Run before login, after assertTokenPermitted.

This compares strings the token reports about itself. It catches a deployment wired to the wrong module or the wrong token; it does not prove the token is hardware.

Parameters

token

TokenIdentity

expected

ExpectedToken

Returns

void

Throws

policy_refused on any mismatch. The message names the field, never the value either side holds.