From baa958dbbb0b8e13d6d76963a5f19d9265bf82df Mon Sep 17 00:00:00 2001 From: whereissam Date: Thu, 5 Mar 2026 13:25:03 +0800 Subject: [PATCH] fix: use jose decodeJwt for Telegram id_token to fix UTF-8 and align with other providers --- .../core/src/social-providers/telegram.ts | 19 ++++++------------- 1 file changed, 6 insertions(+), 13 deletions(-) diff --git a/packages/core/src/social-providers/telegram.ts b/packages/core/src/social-providers/telegram.ts index 87f9d94225..57e615a099 100644 --- a/packages/core/src/social-providers/telegram.ts +++ b/packages/core/src/social-providers/telegram.ts @@ -1,3 +1,4 @@ +import { decodeJwt } from "jose"; import type { OAuthProvider, ProviderOptions } from "../oauth2"; import { createAuthorizationURL, validateAuthorizationCode } from "../oauth2"; @@ -67,19 +68,11 @@ export const telegram = (options: TelegramOptions) => { return null; } - // Decode the JWT payload (Telegram returns user info in the id_token) - const segments = idToken.split("."); - const payloadSegment = segments[1]; - if (!payloadSegment) { - return null; - } - - const base64 = payloadSegment - .replace(/-/g, "+") - .replace(/_/g, "/") - .padEnd(Math.ceil(payloadSegment.length / 4) * 4, "="); - const payloadJson = atob(base64); - const profile = JSON.parse(payloadJson) as TelegramProfile; + // Decode the JWT payload (Telegram returns user info in the id_token). + // Note: Telegram does not publish a JWKS endpoint, so full signature + // verification is not possible. This matches the pattern used by other + // providers without JWKS (Twitch, PayPal, Paybin). + const profile = decodeJwt(idToken) as TelegramProfile; if (!profile.sub) { return null;