import { decodeJwt, decodeProtectedHeader } from 'jose';

/**
 * Whether a JWT is a delegated token: EdDSA-signed with a DID `kid`, and
 * `delegate: true`. Decodes only; the signature is not verified. Anything
 * unparseable is not delegated.
 * @internal
 */
export function isDelegatedToken(token: string): boolean {
  try {
    const { alg, kid } = decodeProtectedHeader(token);
    return (
      alg === 'EdDSA' &&
      typeof kid === 'string' &&
      kid.startsWith('did:') &&
      decodeJwt(token).delegate === true
    );
  } catch {
    return false;
  }
}