fix: decode JWT segments as Base64url (RFC 7515)

[willyp713]

Fixes #977

What

JWT::JWT() decoded token segments with QByteArray::fromBase64(part), which uses the standard Base64 alphabet. JWT segments are Base64url (RFC 7515 section 2). Qt's default IgnoreBase64DecodingErrors mode silently skips - and _ as invalid characters and corrupts every byte after them. The payload then fails JSON parsing, IdToken::aud() returns an empty string, and OIDC login fails with a misleading "The audience of the id_token did not contain …" error. See #977 for the full analysis, including why the failure depends on token content and looked IdP-specific.

Changes

Commit 1:

• jwt.cpp: decode segments with Base64UrlEncoding | AbortOnBase64DecodingErrors via fromBase64Encoding. A header or payload segment that is not valid base64url now yields an empty object, and so an invalid JWT, instead of silently corrupted claims. serialize() already used Base64UrlEncoding; only parsing was wrong.
• test/testjwt.cpp (new): regression tests. They cover a payload whose base64url encoding contains both - and _, a serialize/parse round-trip, structurally malformed tokens, and strict rejection of an invalid character inside an otherwise valid segment (the permissive decode wrongly accepted that case). Against the unpatched code, three of the four fail; with this change all pass.

Commit 2:

• oauth.cpp: an unparseable id_token previously fell through to the audience check and produced the misleading audience error. The token exchange handler now retains the parsed JWT and reports "The id_token could not be parsed" before checking the audience.
• test/testoauth/testoauth.cpp: new testUnparseableIdToken corrupts the header and payload segments in turn, and expects the parse error rather than a login or the audience message.

Notes

• Strict Base64url decoding rejects tokens from IdPs that emit standard-alphabet + or / in JWT segments. RFC 7515 forbids those characters, but this is a behavior change for such non-compliant IdPs.
• Tested on Linux with Qt 6.8.2. I compiled the testjwt target standalone and ran it against both the patched and unpatched decoder; I did not run the full suite build in my environment.

[dragotin]

Thank you for the patch, looks like an interesting finding.

However, I needed pr_978.patch to make it compile over here, please double check and update the PR accordingly.

[willyp713]

Thanks for the patch; applied in full and force-pushed. The export macro and Q_SLOTS fixes are squashed into the first commit, the enum name fix into the second, and the two cleanups (duplicated word in the log message, redundant QtTest include) are a separate third commit.

The misses came from verifying only testjwt locally, on a Linux build with default symbol visibility and without QT_NO_KEYWORDS. I re-ran testjwt with QT_NO_KEYWORDS defined: 6/6 pass.

[dragotin]

Looks now good to me, lets see what @TheOneRing thinks.

[TheOneRing]

Please add a log line including the QByteArray::Base64DecodingStatus

[willyp713]

Added a qCWarning under a new sync.credentials.jwt category logging the Base64DecodingStatus on decode failure. Status only (no segment bytes) to keep token contents out of the logs. testjwt still 6/6.

[TheOneRing]

The crash in the unit test is unrelated.
Thank you for your contribution.