Function decodeCQPDClaims

cli/internal/platform/inject.go:252–273

decodeCQPDClaims reads the unverified claims payload of a cqpd_ token. The CLI only needs routing/identity hints (api_url, team) to decide where and as whom to call; the platform still authenticates the token. Wire format is "cqpd_" + base64url(claimsJSON) + "." + base64url(sig). Returns empty strin

(token string)

// for a malformed or non-cqpd_ token. Mirrors the destination plugin's decoder
// (separate repos — keep the claim keys in sync).
func decodeCQPDClaims(token string) (apiURL, team string) {
	rest, ok := strings.CutPrefix(token, cqpdPrefix)
	if !ok {
		return "", ""
	}
	enc, _, ok := strings.Cut(rest, ".")
	if !ok {
		return "", ""
	}
	payload, err := base64.RawURLEncoding.DecodeString(enc)
	if err != nil {
		return "", ""
	}
	var claims struct {
		APIURL string `json:"u"`
		Team   string `json:"tm"`
	}
	if err := json.Unmarshal(payload, &claims); err != nil {
		return "", ""
	}
	return claims.APIURL, claims.Team
}

// MaybeInjectDestination injects a `platform` destination carrying a freshly
// minted cqpd_ token — but only when the spec opts in by listing `platform` in