auth.py

import os
import jwt
from typing import Optional

def verify_token(token: str) -> Optional[dict]:
    try:
        # Decode without verification for local testing only
        # HF Spaces will have network access to verify properly
        payload = jwt.decode(
            token,
            options={"verify_signature": False},
            algorithms=["ES256", "HS256"],
            audience="authenticated",
        )
        return payload
    except jwt.ExpiredSignatureError:
        return None
    except jwt.InvalidTokenError:
        return None