import 'dart:convert';

/// Lightweight JWT payload decoder (no signature verification on client).
class JwtUtils {
  JwtUtils._();

  static Map<String, dynamic> decodePayload(String token) {
    final parts = token.split('.');
    if (parts.length != 3) {
      throw const FormatException('Invalid JWT format');
    }

    final normalized = base64Url.normalize(parts[1]);
    final decoded = utf8.decode(base64Url.decode(normalized));
    final payload = jsonDecode(decoded);
    if (payload is! Map<String, dynamic>) {
      throw const FormatException('Invalid JWT payload');
    }
    return payload;
  }

  static String? subject(String token) {
    final sub = decodePayload(token)['sub'];
    return sub?.toString();
  }

  static String? roleId(String token) {
    final roleId = decodePayload(token)['role_id'];
    return roleId?.toString();
  }
}