shared/jwt library

Reading the access and refresh tokens the API issues.

Top-level functions rather than methods on a singleton. These were on a Utils class alongside a sleep wrapper with no callers and a random-string generator used by one test - a grab bag, and one that had to be instantiated (Utils().decodeToken(...)) to reach two pure functions.

Nothing here verifies a signature. That is the API's job, and a client cannot do it: it has no key. These read claims the SDK needs in order to decide whether a token is worth sending, which is a question about expiry, not authenticity.

Constants

tokenExpiryLeeway → const Duration
How far ahead of its expiry the SDK stops trusting a token.

Functions

decodeToken(String token) → Map<String, dynamic>
The claims in token's payload.
isTokenExpired(String token, [num offsetSeconds = 0]) → bool
Whether token has expired, treating anything within offsetSeconds of its expiry as already gone.