mirror of
https://github.com/lunchcat/sif.git
synced 2026-07-28 14:37:01 -07:00
jwt payloads are unpadded base64url, but the supabase detector decoded them with RawStdEncoding, which errors on any payload whose base64 lands on the url-safe - or _ characters and silently skips the token. mirror the jwt.go decoder: raw base64url with a padded fallback. extract the decode into parseSupabaseJwtBody so it is unit-testable off the network. Co-authored-by: vmfunc <vmfunc.lc@gmail.com>