From d0abd224f45b5e1ce13eeafa3ad785d9b76a2bcf Mon Sep 17 00:00:00 2001
From: Leo Vasanko <leo@git>
Date: Tue, 17 Feb 2026 00:17:47 +0000
Subject: [PATCH] Issuer problem debug.

---
 paskia/fastapi/oid.py | 10 ++++++++++
 paskia/util/oidjwt.py |  3 ++-
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/paskia/fastapi/oid.py b/paskia/fastapi/oid.py
index bc95a5f..d438609 100644
--- a/paskia/fastapi/oid.py
+++ b/paskia/fastapi/oid.py
@@ -414,6 +414,16 @@ async def userinfo(
     issuer = _get_issuer(request)
     print(f"DEBUG UserInfo: Computed issuer: {issuer}")
     
+    # Try to decode without verification to see token contents
+    try:
+        import jwt
+        unverified_payload = jwt.decode(credentials.credentials, options={"verify_signature": False})
+        print(f"DEBUG UserInfo: Unverified payload: {unverified_payload}")
+        print(f"DEBUG UserInfo: Token issuer claim: {unverified_payload.get('iss')}")
+        print(f"DEBUG UserInfo: Token audience claim: {unverified_payload.get('aud')}")
+    except Exception as e:
+        print(f"DEBUG UserInfo: Failed to decode unverified: {e}")
+    
     payload = oidjwt.decode_access_token(credentials.credentials, issuer)
     print(f"DEBUG UserInfo: JWT decode result: {payload is not None}")
     
diff --git a/paskia/util/oidjwt.py b/paskia/util/oidjwt.py
index a696259..81c99a3 100644
--- a/paskia/util/oidjwt.py
+++ b/paskia/util/oidjwt.py
@@ -193,5 +193,6 @@ def decode_access_token(
             issuer=issuer,
             audience=audience,  # PyJWT handles None by skipping verification
         )
-    except jwt.PyJWTError:
+    except jwt.PyJWTError as e:
+        print(f"DEBUG JWT decode error: {e}")
         return None