fix(auth): complete jsonwebtoken 10 migration

Author: freshtonic

Cargo.lock

@@ -62,6 +62,7 @@ default-features = false
 
 [dependencies.jsonwebtoken]
 version = "10.3.0"
+features = ["aws_lc_rs"]
 
 [dependencies.miette]
 version = "7.5.0"

vendor/stack-auth/Cargo.lock

@@ -144,22 +144,12 @@ impl ServiceToken {
     /// NOTE: This does not verify the token signature or validate any claims,
     /// it only decodes the claims if the token is a well-formed JWT.
     fn try_decode(secret: &SecretToken) -> Result<DecodedClaims, String> {
-        use jsonwebtoken::{decode, decode_header, DecodingKey, Validation};
-        use std::collections::HashSet;
+        use jsonwebtoken::{dangerous::insecure_decode, decode_header};
 
         let token_str = secret.as_str();
-        let header =
-            decode_header(token_str).map_err(|e| format!("failed to decode JWT header: {e}"))?;
-
-        let dummy_key = DecodingKey::from_secret(&[]);
-        let mut validation = Validation::new(header.alg);
-        validation.validate_exp = false;
-        validation.validate_aud = false;
-        validation.required_spec_claims = HashSet::new();
-        validation.insecure_disable_signature_validation();
-
+        decode_header(token_str).map_err(|e| format!("failed to decode JWT header: {e}"))?;
         let data: jsonwebtoken::TokenData<cts_common::claims::Claims> =
-            decode(token_str, &dummy_key, &validation)
+            insecure_decode(token_str)
                 .map_err(|e| format!("failed to decode JWT claims: {e}"))?;
 
         let issuer: Url = data

vendor/stack-auth/Cargo.toml

@@ -169,21 +169,12 @@ impl Token {
     /// This is safe because we already possess the token — we just need to read
     /// the claims it contains.
     fn decode_claims(&self) -> Result<Claims, AuthError> {
-        use jsonwebtoken::{decode, decode_header, DecodingKey, Validation};
-        use std::collections::HashSet;
+        use jsonwebtoken::{dangerous::insecure_decode, decode_header};
 
         let token_str = self.access_token.as_str();
-        let header = decode_header(token_str)
+        decode_header(token_str)
             .map_err(|e| AuthError::InvalidToken(format!("invalid JWT header: {e}")))?;
-
-        let dummy_key = DecodingKey::from_secret(&[]);
-        let mut validation = Validation::new(header.alg);
-        validation.validate_exp = false;
-        validation.validate_aud = false;
-        validation.required_spec_claims = HashSet::new();
-        validation.insecure_disable_signature_validation();
-
-        decode(token_str, &dummy_key, &validation)
+        insecure_decode(token_str)
             .map(|data| data.claims)
             .map_err(|e| AuthError::InvalidToken(format!("failed to decode JWT claims: {e}")))
     }