Could not validate token during sync with better-auth

use std::time::SystemTime;
use biscuit::{
    jwa::SignatureAlgorithm, jwk::JWKSet, TemporalOptions, ValidationOptions, JWT
};
use chrono::TimeZone;
use serde_json;

// based on this: https://github.com/get-convex/convex-backend/blob/a6c7aec0130dc7f6f49c9fcf898d7c40030ef8ba/crates/authentication/src/lib.rs#L317

fn main() {
    let jwt: &'static str = "<JWT>";
    let string_jwks = r#"<JWKS>"#;
    let jwks: JWKSet<biscuit::Empty> = serde_json::from_str(string_jwks).unwrap();

    let since_epoch = SystemTime::now()
        .duration_since(SystemTime::UNIX_EPOCH)
        .expect("couldn't calculate unix timestamp?")
        .as_secs() as i64;
    let chrono_utc = chrono::Utc.timestamp_opt(since_epoch, 0).unwrap();
    let validation_options = ValidationOptions {
        temporal_options: TemporalOptions {
            now: Some(chrono_utc),
            ..Default::default()
        },
        ..Default::default()
    };

    let token = JWT::<biscuit::Empty, biscuit::Empty>::new_encoded(jwt);
    let decoded_token = token.decode_with_jwks(&jwks, Some(SignatureAlgorithm::ES256)).unwrap();

    let result = decoded_token.validate(validation_options);
    println!("{:?}", result);
}

use std::time::SystemTime;
use biscuit::{
    jwa::SignatureAlgorithm, jwk::JWKSet, TemporalOptions, ValidationOptions, JWT
};
use chrono::TimeZone;
use serde_json;

// based on this: https://github.com/get-convex/convex-backend/blob/a6c7aec0130dc7f6f49c9fcf898d7c40030ef8ba/crates/authentication/src/lib.rs#L317

fn main() {
    let jwt: &'static str = "<JWT>";
    let string_jwks = r#"<JWKS>"#;
    let jwks: JWKSet<biscuit::Empty> = serde_json::from_str(string_jwks).unwrap();

    let since_epoch = SystemTime::now()
        .duration_since(SystemTime::UNIX_EPOCH)
        .expect("couldn't calculate unix timestamp?")
        .as_secs() as i64;
    let chrono_utc = chrono::Utc.timestamp_opt(since_epoch, 0).unwrap();
    let validation_options = ValidationOptions {
        temporal_options: TemporalOptions {
            now: Some(chrono_utc),
            ..Default::default()
        },
        ..Default::default()
    };

    let token = JWT::<biscuit::Empty, biscuit::Empty>::new_encoded(jwt);
    let decoded_token = token.decode_with_jwks(&jwks, Some(SignatureAlgorithm::ES256)).unwrap();

    let result = decoded_token.validate(validation_options);
    println!("{:?}", result);
}

// convex/auth.config.js
export default {
  providers: [
    {
      type: 'customJwt',
      // knucklebones-rework
      applicationID: process.env.APP_NAME,
      // http://localhost:3000
      issuer: process.env.BASE_URL,
      // https://<my-jwks-url>.workers.dev/
      jwks: process.env.JWKS_URL,
      algorithm: 'ES256'
    }
  ]
}

// convex/auth.config.js
export default {
  providers: [
    {
      type: 'customJwt',
      // knucklebones-rework
      applicationID: process.env.APP_NAME,
      // http://localhost:3000
      issuer: process.env.BASE_URL,
      // https://<my-jwks-url>.workers.dev/
      jwks: process.env.JWKS_URL,
      algorithm: 'ES256'
    }
  ]
}