# 36. `example_jwtcc.py` — RFC 9118 EnhancedJWTClaimConstraints
[← Example index](index.md) · [`example_jwtcc.py` on Codeberg](https://codeberg.org/abbra/synta/src/branch/main/examples/example_jwtcc.py)
Bindings: `synta.schema.asn1_sequence`, `synta.schema.asn1_sequence_of`,
`synta.schema.asn1_field`.
Demonstrates how to implement a complete RFC-defined ASN.1 module in pure Python
using `synta.schema`, including nested `SEQUENCE OF` types encoded with
`@asn1_sequence_of`.
The ASN.1 module from RFC 9118 Appendix A (EXPLICIT TAGS):
```
EnhancedJWTClaimConstraints ::= SEQUENCE {
mustInclude [0] JWTClaimNames OPTIONAL,
permittedValues [1] JWTClaimValuesList OPTIONAL,
mustExclude [2] JWTClaimNames OPTIONAL }
JWTClaimValuesList ::= SEQUENCE SIZE (1..MAX) OF JWTClaimValues
JWTClaimValues ::= SEQUENCE {
claim JWTClaimName,
values SEQUENCE SIZE (1..MAX) OF UTF8String }
JWTClaimNames ::= SEQUENCE SIZE (1..MAX) OF JWTClaimName
JWTClaimName ::= IA5String
```
- Define `JWTClaimNames` as a naked `SEQUENCE OF IA5String` using `@asn1_sequence_of`;
verify DER round-trip.
- Define `JWTClaimValues` as a `SEQUENCE` with an `IA5String` claim name and a
`list[synta.Utf8String]` values field (encoded as `SEQUENCE OF`) using `@asn1_sequence`.
- Define `JWTClaimValuesList` as a naked `SEQUENCE OF JWTClaimValues` using
`@asn1_sequence_of`, demonstrating nesting of a `@asn1_sequence` type inside a
`@asn1_sequence_of` wrapper.
- Define `EnhancedJWTClaimConstraints` with three optional `[0]`, `[1]`, `[2]`
EXPLICIT tagged fields using `asn1_field(tag=N, explicit=True)`.
- Demonstrate `mustInclude` only: encode `JWTClaimNames(["div", "opt"])`; verify
`permittedValues` and `mustExclude` decode as `None`.
- Demonstrate `permittedValues` only: two `JWTClaimValues` entries, each with a
claim name and multiple UTF-8 values; verify claim names and values survive the
round-trip.
- Demonstrate all three fields simultaneously; verify each component.
- Print the OID constant `ID_PE_EJWT_CLAIM_CONSTRAINTS = 1.3.6.1.5.5.7.1.33` and
confirm it compares equal to the dotted-decimal string.