bugfixes and refactoring in game-server

game-server/internal/auth/jwt.go

@@ -16,6 +16,7 @@ type GameClaims struct {
 	Player1ID  int64  `json:"player1_id"`
 	Player2ID  int64  `json:"player2_id"`
 	GameServer string `json:"game_server"`
+	RawToken   string `json:"-"`
 	jwt.RegisteredClaims
 }
 
@@ -48,6 +49,28 @@ func ParseGameToken(secret []byte, tokenString string) (*GameClaims, error) {
 	if claims.MatchID == "" {
 		return nil, fmt.Errorf("invalid game token: empty match_id")
 	}
+	if claims.Player1ID <= 0 || claims.Player2ID <= 0 {
+		return nil, fmt.Errorf("invalid game token: player IDs must be positive")
+	}
+	claims.RawToken = tokenString
+	return claims, nil
+}
+
+// ParseGameTokenUnverified extracts claims from a game token without verifying
+// its signature or expiration.
+func ParseGameTokenUnverified(tokenString string) (*GameClaims, error) {
+	claims := &GameClaims{}
+	_, _, err := jwt.NewParser().ParseUnverified(tokenString, claims)
+	if err != nil {
+		return nil, fmt.Errorf("invalid game token: %w", err)
+	}
+	if claims.MatchID == "" {
+		return nil, fmt.Errorf("invalid game token: empty match_id")
+	}
+	if claims.Player1ID <= 0 || claims.Player2ID <= 0 {
+		return nil, fmt.Errorf("invalid game token: player IDs must be positive")
+	}
+	claims.RawToken = tokenString
 	return claims, nil
 }
 
@@ -62,5 +85,8 @@ func ParseUserToken(secret []byte, tokenString string) (*UserClaims, error) {
 	if err != nil {
 		return nil, fmt.Errorf("invalid user token: %w", err)
 	}
+	if claims.UserID <= 0 {
+		return nil, fmt.Errorf("invalid user token: user_id must be positive")
+	}
 	return claims, nil
 }