server.internal.auth

fn decode_jwt(token string) !Jwt

fn parse_login_chain(auth_info_json string, require_xbox bool) !Identity

parse_login_chain verifies the JWT signature chain and returns the client identity. Trust boundary: when the chain is self-signed (offline mode) the signatures are valid but prove nothing about who the player is - xbox_authenticated is only true when the chain roots in Mojang's public key. Callers must treat display_name/xuid as unverified unless xbox_authenticated.

fn verify_jwt(token string, public_key_b64 string) !bool

struct Identity {
pub:
	xuid               string
	uuid               string
	display_name       string
	xbox_authenticated bool
	client_public_key  string
}

struct Jwt {
pub:
	header  map[string]json2.Any
	payload map[string]json2.Any
}