[P1] Audit: JWT Decoder claim utilities are incomplete

[baixiangcpp]

Imported from the byteflow.tools deep audit on 2026-06-22.

Problem: JWT Decoder correctly warns that decoding is not verification, but the claim utility area can be improved. Users need better support for exp, nbf, iat, aud, iss, sub, algorithm risk, local/UTC time display, and direct copy actions.

Affected URL:

• https://byteflow.tools/en/jwt-decoder

Reproduction steps:

1. Open JWT Decoder.
2. Click Try Example.
3. Review decoded header, payload, and claims/time semantics.
4. Check whether each claim can be copied or inspected.
5. Test an expired token, future nbf token, missing exp token, and alg none token.

Expected behavior: claim utilities should provide actionable, copyable, and clearly separated claim information while keeping signature verification warnings visible.

Actual behavior: claim warnings exist, but utilities are limited and not all fields are easy to copy or compare.

Impact: authentication debugging takes longer and users may misinterpret decoded claims.

Proposed fix:

• Add a claim summary table for exp, nbf, iat, iss, aud, sub, alg, kid.
• Add copy buttons for each decoded section and each claim row.
• Add UTC/local toggle with timezone shown explicitly.
• Flag expired, not-yet-valid, missing exp, alg none, and unexpected algorithm.
• Keep “signature not verified” warning sticky near outputs.

Acceptance criteria:

• Expired and future tokens show clear warnings.
• UTC/local times are accurate and labeled.
• Header, payload, and claim rows are copyable.
• The verification warning remains visible in the decode workflow.
• Tests cover common claim edge cases.

[baixiangcpp]

Closed as completed by the canonical BF audit backlog work. This older non-BF audit issue duplicates work now merged through PRs #209-#219, with the BF issues closed and guard/test coverage in place. The remaining non-duplicate follow-up is #7, which stays open because the upstream Next/PostCSS advisory is not fixed yet.