paseto-token-parse-public-payload.go

var tokenEncoder = base64.RawURLEncoding

// parsePublicTokenPayload parses the public (unencrypted) token payload
// works even with expired tokens (that do not pass verification)
func parsePublicTokenPayload(token string) (*JSONToken, error) {
	tokenPieces := strings.Split(token, ".")
	if len(tokenPieces) < 3 {
		// version.purpose.payload or version.purpose.payload.footer
		// see: https://tools.ietf.org/id/draft-paragon-paseto-rfc-00.html#rfc.section.2
		return nil, errors.New("malformed token: expected at least 3 pieces")
	}
	encodedPayload := []byte(tokenPieces[2])
	payload := make([]byte, tokenEncoder.DecodedLen(len(encodedPayload)))
	if _, err := tokenEncoder.Decode(payload, encodedPayload); err != nil {
		return nil, fmt.Errorf("error decoding token payload: %v", err)
	}
	if len(payload) < ed25519.SignatureSize {
		return nil, errors.New("malformed token: incorrect token size")
	}
	payloadBytes := payload[:len(payload)-ed25519.SignatureSize]
	var jsonToken paseto.JSONToken
	if err := json.Unmarshal(payloadBytes, &jsonToken); err != nil {
		return nil, fmt.Errorf("error unmarshalling token payload json: %v", err)
	}
	var permissions byte = PermissionR
	if p := jsonToken.Get("permissions"); p != "" {
		pint, err := strconv.ParseUint(p, 10, 8)
		if err == nil {
			permissions = byte(pint)
		}
	}
	return &JSONToken{
		Username:    jsonToken.Subject,
		Permissions: permissions,
		Expiration:  jsonToken.Expiration,
	}, nil
}