( accessToken: string, )
| 92 | * server is the only thing that verifies the token's signature. |
| 93 | */ |
| 94 | export const decodeAccessTokenClaims = ( |
| 95 | accessToken: string, |
| 96 | ): Record<string, unknown> | undefined => { |
| 97 | const segments = accessToken.split("."); |
| 98 | if (segments.length !== 3) return undefined; |
| 99 | const payloadSegment = segments[1]; |
| 100 | if (!payloadSegment) return undefined; |
| 101 | try { |
| 102 | const json = Buffer.from(payloadSegment, "base64url").toString("utf8"); |
| 103 | const claims = JSON.parse(json) as unknown; |
| 104 | return claims && typeof claims === "object" ? (claims as Record<string, unknown>) : undefined; |
| 105 | } catch { |
| 106 | return undefined; |
| 107 | } |
| 108 | }; |
| 109 | |
| 110 | /** Read `exp` (epoch seconds) out of a JWT access token without verifying it. */ |
| 111 | export const accessTokenExpiry = (accessToken: string): number | undefined => |
no test coverage detected