mana-swift-event-sync/Sources/ManaEventSync/Core/JWTSubject.swift

import Foundation

/// Liest den `sub`-Claim aus einem JWT (Base64URL-Decode des Payloads).
///
/// Bewusst hier statt in `ManaCore` dupliziert, solange `JWT.sub(of:)`
/// dort nicht öffentlich ist — vermeidet eine Cross-Repo-Änderung.
public enum JWTSubject {
    public static func subject(of token: String) -> String? {
        let parts = token.split(separator: ".")
        guard parts.count == 3 else { return nil }
        guard let payloadData = base64URLDecode(String(parts[1])) else { return nil }
        guard
            let dict = try? JSONSerialization.jsonObject(with: payloadData) as? [String: Any],
            let sub = dict["sub"] as? String
        else { return nil }
        return sub
    }

    private static func base64URLDecode(_ value: String) -> Data? {
        var base64 = value
            .replacingOccurrences(of: "-", with: "+")
            .replacingOccurrences(of: "_", with: "/")
        let padding = (4 - base64.count % 4) % 4
        base64.append(String(repeating: "=", count: padding))
        return Data(base64Encoded: base64)
    }
}