Coverage for src/bayernwerk_client/_jwt.py: 100%

1"""Minimal, dependency-free JWT payload decoding (no signature verification). 

2 

3We never validate these tokens locally - they are bearer tokens issued by 

4Bayernwerk's IAM and simply forwarded to icon-api.eon.com. We only need the 

5payload to read `exp` (and `iss`, for discovering the refresh endpoint). 

6""" 

7 

8from __future__ import annotations 

9 

10import base64 

11import json 

12from typing import Any 

13 

14 

15def decode_jwt_payload(token: str) -> dict[str, Any]: 

16 parts = token.split(".") 

17 if len(parts) != 3: 

18 raise ValueError("Not a JWT (expected header.payload.signature)") 

19 payload_b64 = parts[1] 

20 padding = "=" * (-len(payload_b64) % 4) 

21 payload_bytes = base64.urlsafe_b64decode(payload_b64 + padding) 

22 return json.loads(payload_bytes)