def _validate_at_hash(claims, access_token, algorithm):
if '<STR_LIT>' not in claims and not access_token:<EOL><INDENT>return<EOL><DEDENT>elif '<STR_LIT>' in claims and not access_token:<EOL><INDENT>msg = '<STR_LIT>'<EOL>raise JWTClaimsError(msg)<EOL><DEDENT>elif access_token and '<STR_LIT>' not in claims:<EOL><INDENT>msg = '<STR_LIT>'<EOL>raise JWTClaimsError(msg)<EOL><DEDENT>try:<EOL><INDENT>expected_hash = calculate_at_hash(access_token,<EOL>ALGORITHMS.HASHES[algorithm])<EOL><DEDENT>except (TypeError, ValueError):<EOL><INDENT>msg = '<STR_LIT>'<EOL>raise JWTClaimsError(msg)<EOL><DEDENT>if claims['<STR_LIT>'] != expected_hash:<EOL><INDENT>raise JWTClaimsError('<STR_LIT>')<EOL><DEDENT>
Validates that the 'at_hash' parameter included in the claims matches
with the access_token returned alongside the id token as part of
the authorization_code flow.

Args:
    claims (dict): The claims dictionary to validate.
    access_token (str): The access token returned by the OpenID Provider.
    algorithm (str): The algorithm used to sign the JWT, as specified by
        the token headers.