feat(react): move from jsonwebtoken to jose

This removes the reliance on node built in modules as they don't work in
a browser context without polyfilling.

.changeset/stale-cougars-carry.md

@@ -0,0 +1,5 @@
+---
+"@labdigital/federated-token-react": minor
+---
+
+Replace jsonwebtoken with jose as jsonwebtoken relies on built-in node modules.

packages/react/package.json

@@ -13,7 +13,11 @@
 			"types": "./dist/index.d.ts"
 		}
 	},
-	"keywords": ["graphql", "authentication", "react"],
+	"keywords": [
+		"graphql",
+		"authentication",
+		"react"
+	],
 	"author": "Lab Digital <[email protected]>",
 	"license": "MIT",
 	"repository": {
@@ -29,15 +33,17 @@
 		"test:ci": "vitest run --coverage",
 		"tsc": "tsc --noEmit"
 	},
-	"files": ["dist", "src"],
+	"files": [
+		"dist",
+		"src"
+	],
 	"dependencies": {
-		"js-cookie": "3.0.5",
-		"jsonwebtoken": "9.0.2"
+		"jose": "5.4.0",
+		"js-cookie": "3.0.5"
 	},
 	"devDependencies": {
 		"@types/express": "^4.17.21",
 		"@types/js-cookie": "3.0.6",
-		"@types/jsonwebtoken": "9.0.6",
 		"@types/react": "18.3.3",
 		"@vitest/coverage-v8": "1.6.0",
 		"node-mocks-http": "^1.16.1",

packages/react/src/provider.tsx

@@ -1,7 +1,7 @@
 // Auth context for the site
 "use client";
+import { decodeJwt } from "jose";
 import Cookie from "js-cookie";
-import { decode as jwtDecode } from "jsonwebtoken";
 import {
 	createContext,
 	useCallback,
@@ -240,7 +240,7 @@ export function AuthProvider({
 				(acc, key) =>
 					// biome-ignore lint/performance/noAccumulatingSpread: fixme
 					skipKeys.includes(key) ? acc : { ...acc, [key]: tokenPayload[key] },
-				{},
+				{}
 			);
 		};
 		if (userToken) {
@@ -403,7 +403,7 @@ export function useAuth() {
 }
 
 export const decodeToken = (token: string): TokenPayload | undefined => {
-	const decodedToken = jwtDecode(token, { complete: true });
+	const decodedToken = decodeJwt(token);
 	if (
 		!decodedToken ||
 		!decodedToken.payload ||