[NabiBukhsh-AI]

Summary

When verifying an access token that does not contain grant claims (e.g., video, sip, inference, or observability), TokenVerifier.verify() previously unpacked empty dictionaries into the grant classes:

video_dict = claims.get("video", dict())
video_dict = {camel_to_snake(k): v for k, v in video_dict.items()}
video = VideoGrants(**video_dict)

Because VideoGrants defines defaults of can_publish=True, can_subscribe=True, and can_publish_data=True, any token minted without video grants (such as an agent, webhook, SIP, or backend token) was incorrectly decoded by TokenVerifier as having active video permissions, rather than None.

Changes

• Use _parse_grants(claims, key, cls) for video, sip, inference, and observability grants so they evaluate to None if the corresponding claim key was omitted or None in the token.
• Matches the existing behavior of agent, agent_endpoint, and agent_thread grants.
• Added unit tests in tests/api/test_access_token.py to verify that omitted grants evaluate to None and explicitly provided grants are parsed correctly.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.