tdfs4ds.utils.tokens¶
Read what a bearer token says about itself (v0.3.1.202).
A platform-issued JWT carries its own expiry, and that one fact explains a whole family of failures that name something else entirely. When the token behind a Vector Store or MCP configuration runs out, the services that log on to Teradata with it report the database's own refusal:
[SQLState 28000] The UserId, Password or Account is invalid.
[Error 8017] The UserId, Password or Account is invalid.
Neither says expired. Both read as a wrong password, sending the reader to check a credential that was never wrong — while the LLM keeps working, because an API key does not expire, which makes the configuration look half-broken in a way that suggests anything but the clock.
The expiry is free to read: it is a claim inside the token, no network and no service involved. So a check can say "expired 37 minutes ago" before spending it, instead of leaving a 28000 to be interpreted.
The signature is deliberately not verified. This is not authentication — it is a caller reading a token it already holds, to report on it. The issuer validates it for real at the other end; guessing at signatures here would add a dependency and prove nothing the services do not already prove.
Both functions are total: anything unreadable is reported as unknown, never raised and never treated as expired. A malformed token is a different fault, and saying "expired" about it would be a confident lie.
Return a JWT's payload claims, or {} for anything unreadable.
The signature is not verified — see the module docstring.
Report on token's exp claim.
Returns (state, detail) where state is one of:
'expired' — the moment has passed. Whatever it authenticates is
already failing, whatever the error says.
'expiring' — valid, with less than warn_seconds left.
'valid' — valid, with time to spare.
'unknown' — not a readable JWT, or it carries no exp. Not a
verdict: an opaque token can be perfectly good.
detail is always a short human sentence, and never contains any part of the token.
Pull the bearer out of a resolved header mapping, or None.
Accepts the shape build_mcp_headers returns. Any scheme other than
Bearer, or no Authorization at all, gives None — there is then no token
of ours to report on.