Function decodeClaims

enterprise/coderd/licenses.go:369–383

decodeClaims decodes the JWT claims from the stored JWT. Note here we do not validate the JWT and just return the claims verbatim. We want to include all licenses on the GET response, even if they are expired, or signed by a key this version of Coder no longer considers valid. Also, we do not ret

(l database.License)

// Also, we do not return the whole JWT itself because a signed JWT is a bearer token and we
// want to limit the chance of it being accidentally leaked.
func decodeClaims(l database.License) (jwt.MapClaims, error) {
	parts := strings.Split(l.JWT, ".")
	if len(parts) != 3 {
		return nil, xerrors.Errorf("Unable to parse license %d as JWT", l.ID)
	}
	cb, err := base64.RawURLEncoding.DecodeString(parts[1])
	if err != nil {
		return nil, xerrors.Errorf("Unable to decode license %d claims: %w", l.ID, err)
	}
	c := make(jwt.MapClaims)
	d := json.NewDecoder(bytes.NewBuffer(cb))
	d.UseNumber()
	err = d.Decode(&c)
	return c, err
}