#pragma once
#include <string>
#include <cstdint>

/**
 * JWTDecoder — lightweight JWT payload decoder.
 * Client-side ONLY: decodes the payload and checks exp.
 * Does NOT verify the signature — that's the server's responsibility.
 * The client NEVER has access to the JWT secret/private key.
 */
class JWTDecoder
{
public:
    struct Payload {
        int64_t sub = 0;         // user_id
        std::string username;
        std::string role;
        int64_t device_id = 0;
        int64_t iat = 0;
        int64_t exp = 0;        // expiration timestamp (unix seconds)
        bool valid = false;
    };

    /// Decode a JWT token (without signature verification).
    /// Only extracts and validates the payload.
    static Payload Decode(const std::string& token);

    /// Check if a unix timestamp has expired.
    static bool IsExpired(int64_t expUnix);

private:
    JWTDecoder() = default;

    static std::string Base64UrlDecode(const std::string& input);
    static Payload ParsePayload(const std::string& json);
};
