From 23f2bf90807be0ae87dfe62906832caf8c5131cc Mon Sep 17 00:00:00 2001
From: Mahdiyar Arbabzi <m.arbabzi@gmail.com>
Date: Thu, 30 Oct 2025 15:50:38 +0330
Subject: [PATCH] fix: improve JWT payload type validation

Resolved type safety issue where jwt.payload was assumed to be a Map<String, dynamic>.
In Dart 3.4+, implicit downcasting is disallowed, causing compile-time errors.

- Added runtime type check for jwt.payload
- Safely cast payload before accessing fields
- Throw clear exception if payload is not a Map<String, dynamic>

Closes #201
---
 lib/src/authentication/has_api_tokens.dart | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/lib/src/authentication/has_api_tokens.dart b/lib/src/authentication/has_api_tokens.dart
index e1d89c0..cef2d5a 100644
--- a/lib/src/authentication/has_api_tokens.dart
+++ b/lib/src/authentication/has_api_tokens.dart
@@ -130,11 +130,16 @@ class HasApiTokens {
         subject: env<String?>('JWT_SUBJECT'),
       );
 
-      if (jwt.payload['type'] != expectedType) {
-        throw Unauthenticated(message: 'Invalid token');
+      final payload = jwt.payload;
+      if (payload is! Map<String, dynamic>) {
+        throw Unauthenticated(message: 'Invalid JWT payload type');
       }
 
-      return jwt.payload;
+      if (payload['type'] != expectedType) {
+        throw Unauthenticated(message: 'Invalid token type');
+      }
+
+      return payload;
     } on JWTExpiredException {
       rethrow;
     } on JWTException {