supabase / supabase-flutter / 28999966848

87%

push

github

refactor(gotrue): drop jwt_decode dependency in favor of dart_jsonwebtoken (#1565)

## What

Removes the `jwt_decode` dependency from `gotrue`. Its two remaining
uses were both unauthenticated payload decodes, which are now handled by
the existing `decodeJwt` helper (built on `dart_jsonwebtoken`, already a
dependency).

## Changes

- `session.dart` — `Jwt.parseJwt(accessToken)['exp']` →
`decodeJwt(accessToken).payload.exp`
- `gotrue_mfa_api.dart` — `Jwt.parseJwt(session.accessToken)` →
`decodeJwt(session.accessToken).payload.claims` (keeps `aal`/`amr`
lookups working)
- `gotrue_client.dart` — dropped the now-unused `jwt_decode` import
- `client_test.dart` — updated assertions to use
`decodeJwt(...).payload.exp`
- `pubspec.yaml` — removed `jwt_decode: ^0.3.1`

Signature verification via `dart_jsonwebtoken`'s `JWT.verify` is
untouched. Behavior is preserved: both replaced uses were plain payload
decodes without verification.

`dart pub get` resolves cleanly (no `jwt_decode` in the lock) and `dart
analyze lib test` reports no issues.

Closes SDK-475.

10 of 10 new or added lines in 3 files covered. (100.0%)

4475 of 5177 relevant lines covered (86.44%)

4.0 hits per line