# decode_jwt.py — decode without verification for debugging
import base64
import json
import sys

def decode_jwt_parts(token: str) -> dict:
    """Decode JWT header and payload without signature verification."""
    parts = token.split('.')
    if len(parts) != 3:
        return {"error": f"Expected 3 parts, got {len(parts)}"}

    def decode_part(part: str) -> dict:
        # Fix base64url padding
        padding = 4 - len(part) % 4
        if padding != 4:
            part += '=' * padding
        decoded = base64.urlsafe_b64decode(part)
        return json.loads(decoded)

    return {
        "header": decode_part(parts[0]),
        "payload": decode_part(parts[1]),
        "signature_length": len(parts[2]),
    }

if __name__ == "__main__":
    token = sys.argv[1] if len(sys.argv) > 1 else input("Paste token: ").strip()
    result = decode_jwt_parts(token)
    print(json.dumps(result, indent=2, default=str))

# jwks_debugger.py — check if kid matches any key in JWKS endpoint
import requests
import base64
import json
import sys

def debug_jwks_mismatch(token: str, jwks_uri: str) -> None:
    # Decode header
    header_b64 = token.split('.')[0]
    padding = 4 - len(header_b64) % 4
    if padding != 4:
        header_b64 += '=' * padding
    header = json.loads(base64.urlsafe_b64decode(header_b64))

    token_kid = header.get('kid')
    token_alg = header.get('alg')
    print(f"Token kid: {token_kid}, alg: {token_alg}")

    # Fetch JWKS
    resp = requests.get(jwks_uri, timeout=10)
    resp.raise_for_status()
    jwks = resp.json()

    available_kids = [key.get('kid') for key in jwks.get('keys', [])]
    print(f"Available kids in JWKS: {available_kids}")

    if token_kid in available_kids:
        print("OK: kid found in JWKS")
    else:
        print(f"MISMATCH: kid '{token_kid}' not found in JWKS endpoint")
        print("This means the token was signed with a key that has been rotated out.")
        print("Action: Re-issue the token or check if JWKS caching is stale.")

if __name__ == "__main__":
    debug_jwks_mismatch(sys.argv[1], sys.argv[2])

# check_jwt_timing.py — analyze exp/iat/nbf claims against current time
import base64
import json
import sys
import time
from datetime import datetime, timezone

def analyze_jwt_timing(token: str) -> None:
    parts = token.split('.')
    padding = 4 - len(parts[1]) % 4
    if padding != 4:
        parts[1] += '=' * padding

    payload = json.loads(base64.urlsafe_b64decode(parts[1]))
    now = time.time()

    print(f"Current server time: {datetime.fromtimestamp(now, tz=timezone.utc).isoformat()}")
    print(f"Current unix ts:     {now:.0f}")
    print()

    for claim in ['iat', 'exp', 'nbf']:
        if claim in payload:
            ts = payload[claim]
            dt = datetime.fromtimestamp(ts, tz=timezone.utc).isoformat()
            delta = ts - now
            status = ""
            if claim == 'exp':
                status = "EXPIRED" if delta < 0 else f"expires in {delta:.0f}s"
            elif claim == 'nbf':
                status = "NOT YET VALID" if delta > 0 else "valid"
            elif claim == 'iat':
                status = f"issued {abs(delta):.0f}s {'ago' if delta < 0 else 'in the future (clock skew!)'}"
            print(f"{claim}: {ts} ({dt}) — {status}")

if __name__ == "__main__":
    token = sys.argv[1] if len(sys.argv) > 1 else input("Paste token: ").strip()
    analyze_jwt_timing(token)

#!/usr/bin/env python3
# jwt_debugger.py — comprehensive JWT diagnostics

import base64
import json
import sys
import requests
from typing import Tuple, Dict, Any
import anthropic

class JWTDebugger:
    def __init__(self, token: str):
        self.token = token.strip()
        self.parts = token.split('.')

    def is_valid_format(self) -> bool:
        """Check if token has 3 parts."""
        return len(self.parts) == 3

    def decode_safely(self) -> Dict[str, Any]:
        """Decode all parts without verification."""
        if not self.is_valid_format():
            return {"error": f"Token has {len(self.parts)} parts, expected 3"}

        result = {}
        for name, part in [("header", 0), ("payload", 1)]:
            try:
                # Fix base64url padding
                padding = 4 - len(part) % 4
                if padding != 4:
                    part += '=' * padding
                decoded = base64.urlsafe_b64decode(part)
                result[name] = json.loads(decoded)
            except Exception as e:
                result[name] = {"decode_error": str(e)}

        result["signature_length"] = len(self.parts[2])
        result["signature_hex"] = self.parts[2][:32] + "..."
        return result

    def check_expiration(self) -> Dict[str, Any]:
        """Check if token is expired."""
        try:
            payload = json.loads(
                base64.urlsafe_b64decode(self.parts[1] + '==')
            )
            if 'exp' not in payload:
                return {"has_exp": False}

            from datetime import datetime
            exp_time = datetime.fromtimestamp(payload['exp'])
            now = datetime.now()
            return {
                "expires_at": exp_time.isoformat(),
                "is_expired": now > exp_time,
                "seconds_remaining": int((exp_time - now).total_seconds())
            }
        except Exception as e:
            return {"error": str(e)}

    def check_jwks(self, jwks_uri: str) -> Dict[str, Any]:
        """Verify token kid against JWKS endpoint."""
        try:
            header = json.loads(
                base64.urlsafe_b64decode(self.parts[0] + '==')
            )
            token_kid = header.get('kid')
            if not token_kid:
                return {"error": "Token has no kid in header"}

            resp = requests.get(jwks_uri, timeout=5)
            resp.raise_for_status()
            jwks = resp.json()

            available_kids = [k.get('kid') for k in jwks.get('keys', [])]
            return {
                "token_kid": token_kid,
                "available_kids": available_kids,
                "kid_found": token_kid in available_kids
            }
        except Exception as e:
            return {"error": str(e)}

    def create_analysis_prompt(self, decoded: Dict, expiration: Dict,
                              jwks_check: Dict = None) -> str:
        """Format all diagnostics into a Claude prompt."""
        analysis = f"""JWT Diagnostics Report
======================

Decoded Token:
{json.dumps(decoded, indent=2)}

Expiration Status:
{json.dumps(expiration, indent=2)}
"""
        if jwks_check and 'error' not in jwks_check:
            analysis += f"\nJWKS Key Status:\n{json.dumps(jwks_check, indent=2)}"

        return analysis + "\n\nWhat are the issues with this token and how do I fix them?"

    def diagnose(self, jwks_uri: str = None) -> str:
        """Run full diagnostics and get Claude's analysis."""
        if not self.is_valid_format():
            return f"Token format error: {len(self.parts)} parts instead of 3"

        decoded = self.decode_safely()
        expiration = self.check_expiration()
        jwks_check = self.check_jwks(jwks_uri) if jwks_uri else None

        prompt = self.create_analysis_prompt(decoded, expiration, jwks_check)

        client = anthropic.Anthropic()
        message = client.messages.create(
            model="claude-opus-4-6",
            max_tokens=1024,
            messages=[{"role": "user", "content": prompt}]
        )

        return message.content[0].text


if __name__ == "__main__":
    if len(sys.argv) < 2:
        print("Usage: jwt_debugger.py <token> [--jwks-uri <uri>]")
        sys.exit(1)

    token = sys.argv[1]
    jwks_uri = None

    if "--jwks-uri" in sys.argv:
        idx = sys.argv.index("--jwks-uri")
        jwks_uri = sys.argv[idx + 1]

    debugger = JWTDebugger(token)
    analysis = debugger.diagnose(jwks_uri)
    print(analysis)