Issue: Decodes a JWT (without verifying the signature—not for production, but okay for local dev/test).

Function Review: verify_id_token

What This Function Does:

• Decodes a JWT (without verifying the signature—not for production, but okay for local dev/test).

• Logs the decoded claims.

• Checks three things:

  • Audience (aud) matches your app/client.

  • Issuer (iss) matches expected value.

  • Expiry (exp) not in the past.

• Logs errors with detail and raises a ValueError if anything’s wrong.

• Returns the decoded claims if all is good.

     def verify_id_token(token: str) -> dict:

        try:

            claims = jwt.decode(token, options={"verify_signature": False})

            logger.info(f"Decoded JWT claims: {claims}")  # Log all claims

            if claims.get("aud") != OIDC_CLIENT_ID:

                logger.error(f"Audience mismatch: got {claims.get('aud')}, expected {OIDC_CLIENT_ID}")

                raise ValueError("Invalid audience")

            if claims.get("iss") != OIDC_ISSUER:

                logger.error(f"Issuer mismatch: got {claims.get('iss')}, expected {OIDC_ISSUER}")

                raise ValueError("Invalid issuer")

            import time

            if claims.get("exp") and claims["exp"] < int(time.time()):

                logger.error("Token expired")

                raise ValueError("ID token expired")

            return claims

        except Exception as e:

            logger.error(f"JWT verification failed: {e}")

            raise ValueError(f"Invalid token: {str(e)}")