From da56350879dbd62f8a5823b224c2f256ec238be4 Mon Sep 17 00:00:00 2001
From: Lars Lehtonen <lars.lehtonen@gmail.com>
Date: Tue, 17 Feb 2026 16:45:10 -0800
Subject: [PATCH] atproto/auth: pick up dropped errors

---
 atproto/auth/jwt.go | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/atproto/auth/jwt.go b/atproto/auth/jwt.go
index c2c99e94..8ca75c99 100644
--- a/atproto/auth/jwt.go
+++ b/atproto/auth/jwt.go
@@ -54,6 +54,9 @@ func (s *ServiceAuthValidator) Validate(ctx context.Context, tokenString string,
 		// do an unvalidated extraction of 'iss' from JWT
 		insecure := jwt.NewParser(jwt.WithoutClaimsValidation())
 		t, _, err := insecure.ParseUnverified(tokenString, &jwt.MapClaims{})
+		if err != nil {
+			return "", fmt.Errorf("parse unverified %q: %w", tokenString, err)
+		}
 		claims, ok := t.Claims.(*jwt.MapClaims)
 		if !ok {
 			return "", jwt.ErrTokenInvalidClaims
@@ -73,6 +76,9 @@ func (s *ServiceAuthValidator) Validate(ctx context.Context, tokenString string,
 			slog.Error("purging identity directory", "did", did, "err", err)
 		}
 		token, err = jwt.ParseWithClaims(tokenString, &serviceAuthClaims{}, s.fetchIssuerKeyFunc(ctx), opts...)
+		if err != nil {
+			return "", fmt.Errorf("parse with claims %q: %w", tokenString, err)
+		}
 	}
 	if err != nil {
 		return "", err
-- 
2.51.2