Function base64URLDecode

internal/auth/codex/jwt_parser.go:81–91

base64URLDecode decodes a Base64 URL-encoded string, adding padding if necessary. JWTs use a URL-safe Base64 alphabet and omit padding, so this function ensures correct decoding by re-adding the padding before decoding.

(data string)

// JWTs use a URL-safe Base64 alphabet and omit padding, so this function ensures
// correct decoding by re-adding the padding before decoding.
func base64URLDecode(data string) ([]byte, error) {
	// Add padding if necessary
	switch len(data) % 4 {
	case 2:
		data += "=="
	case 3:
		data += "="
	}

	return base64.URLEncoding.DecodeString(data)
}

// GetUserEmail extracts the user's email address from the JWT claims.
func (c *JWTClaims) GetUserEmail() string {