@startsimpli/auth 0.4.9 → 0.4.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@startsimpli/auth",
-  "version": "0.4.9",
+  "version": "0.4.11",
   "description": "Shared authentication package for StartSimpli Next.js apps",
   "main": "./src/index.ts",
   "types": "./src/index.ts",

package/src/utils/token.ts

@@ -4,6 +4,18 @@
 
 import type { TokenPayload, DecodedToken } from '../types';
 
+// JWT payloads are base64url-encoded. Browser atob() only accepts standard
+// base64, so we have to translate `-`/`_` → `+`/`/` and restore padding before
+// decoding. Without this, any token whose payload contains a url-safe char
+// (common once claims grow beyond a few short ASCII fields) throws in atob
+// and decodeToken silently returns null — which causes login to reject a
+// valid server-issued token with "Invalid token received" and never stores it.
+function _base64UrlDecode(input: string): string {
+  const base64 = input.replace(/-/g, '+').replace(/_/g, '/');
+  const padded = base64 + '='.repeat((4 - (base64.length % 4)) % 4);
+  return atob(padded);
+}
+
 /**
  * Decode JWT token payload (does NOT verify signature)
  */
@@ -15,7 +27,7 @@ export function decodeToken(token: string): TokenPayload | null {
     }
 
     const payload = parts[1];
-    const decoded = JSON.parse(atob(payload));
+    const decoded = JSON.parse(_base64UrlDecode(payload));
     return decoded as TokenPayload;
   } catch (error) {
     console.error('Failed to decode token:', error);
@@ -60,7 +72,7 @@ export function getTokenPayload(token: string): DecodedToken | null {
     }
 
     const payload = parts[1];
-    const decoded = JSON.parse(atob(payload));
+    const decoded = JSON.parse(_base64UrlDecode(payload));
 
     if (typeof decoded !== 'object' || decoded === null) {
       return null;