JWT Verify Expiry And Custom Claims

export async function verifyJWT(token,{secret,tolerance=0,audience}={}){const[header,payload,sig]=token.split('.');const enc=new TextEncoder();const keyObj=await crypto.subtle.importKey('raw',enc.encode(secret),{name:'HMAC',hash:'SHA-256'},false,['verify']);const valid=await crypto.subtle.verify('HMAC',keyObj,base64urlDecode(sig),enc.encode(header+'.'+payload));if(!valid)throw new Error('invalid signature');const claims=JSON.parse(new TextDecoder().decode(base64urlDecode(payload)));const now=Math.floor(Date.now()/1000);if(claims.exp!==undefined&&now>claims.exp+tolerance)throw new Error('token expired');if(audience&&claims.aud!==audience)throw new Error('audience mismatch');return claims;}function base64urlDecode(s){const b64=s.replace(/-/g,'+').replace(/_/g,'/')+'==='.slice(0,(4-s.length%4)%4);return Uint8Array.from(atob(b64),c=>c.charCodeAt(0));}