From 8b3f35f7f1ddd0b082a292bb9c79e4ac58d69e8a Mon Sep 17 00:00:00 2001
From: Alexander Petric <alex@windmill.dev>
Date: Wed, 16 Sep 2026 17:29:17 -0400
Subject: [PATCH] refactor(jwt): route JWK algorithm lookup through one helper

Add `windmill_common::jwt::jwk_algorithm` as the single place that reads a
JWK's `alg`, and make `guest_jwt::jwk_algorithms` use it. EE code will call
the same helper, so the upcoming jsonwebtoken bump (which renames the field
to `key_algorithm: Option<KeyAlgorithm>`) only has to touch the helper's body.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 backend/windmill-common/src/guest_jwt.rs |  2 +-
 backend/windmill-common/src/jwt.rs       | 24 ++++++++++++++++++++++++
 2 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/backend/windmill-common/src/guest_jwt.rs b/backend/windmill-common/src/guest_jwt.rs
index 9f3e47d708..5d6f0ebf47 100644
--- a/backend/windmill-common/src/guest_jwt.rs
+++ b/backend/windmill-common/src/guest_jwt.rs
@@ -167,7 +167,7 @@ pub fn jwk_algorithms(jwk: &Jwk) -> Option<Vec<Algorithm>> {
     {
         return None;
     }
-    match (&jwk.algorithm, jwk.common.algorithm) {
+    match (&jwk.algorithm, crate::jwt::jwk_algorithm(jwk)) {
         (AlgorithmParameters::RSA(_), Some(alg)) if RSA_ALGORITHMS.contains(&alg) => {
             Some(vec![alg])
         }
diff --git a/backend/windmill-common/src/jwt.rs b/backend/windmill-common/src/jwt.rs
index cc2f1102bf..71c53b9ea3 100644
--- a/backend/windmill-common/src/jwt.rs
+++ b/backend/windmill-common/src/jwt.rs
@@ -74,3 +74,27 @@ pub async fn generate_signature(header_and_payload: &str) -> anyhow::Result<Stri
     let result = mac.finalize().into_bytes();
     Ok(URL_SAFE_NO_PAD.encode(result))
 }
+
+/// The signing algorithm a JWK names in its `alg`, or `None` when it names none (or one
+/// that is not a signing algorithm). The only place that reads the field, so callers,
+/// including EE ones, stay agnostic of how `jsonwebtoken` models it.
+pub fn jwk_algorithm(jwk: &jsonwebtoken::jwk::Jwk) -> Option<jsonwebtoken::Algorithm> {
+    jwk.common.algorithm
+}
+
+#[cfg(test)]
+mod tests {
+    use super::jwk_algorithm;
+    use jsonwebtoken::{jwk::Jwk, Algorithm};
+
+    #[test]
+    fn jwk_algorithm_reads_alg_when_present() {
+        let with: Jwk =
+            serde_json::from_value(serde_json::json!({"kty":"RSA","alg":"RS256","n":"aa","e":"AQAB"}))
+                .unwrap();
+        assert_eq!(jwk_algorithm(&with), Some(Algorithm::RS256));
+        let without: Jwk =
+            serde_json::from_value(serde_json::json!({"kty":"RSA","n":"aa","e":"AQAB"})).unwrap();
+        assert_eq!(jwk_algorithm(&without), None);
+    }
+}