mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-09-07 00:01:49 +00:00
jsonwebtoken 8.3 models a JWK's `alg` as its signing `Algorithm` enum, so a set carrying an encryption key (`alg: "RSA-OAEP"`, absent from that enum) alongside a signing key failed whole-set deserialization and the whole JWKS was rejected, which real issuers publish. Parse each key on its own and skip one that does not model as a JWT key, keeping the usable signing keys. Unit-tested with a mixed set. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VF3v6LA9399gNphmZaHYG3