Ruben FiszelandClaude Opus 4.8 e1b3a2e19f fix: validate JWKS key material at config time; refresh stale comments ...

parse_jwks_keys filtered on metadata only (kty/alg/use/key_ops), but jsonwebtoken
carries n/e/x/y as strings and defers decoding to auth time, so a JWKS whose only
key had malformed material passed save-time validation and every token failed
later. Keep a key only if DecodingKey::from_jwk decodes it. This is the single
source for both edit_guest_jwt_key and per-request verify.

Update two test comments that credited the SPKI parse alone now that the guard
also accepts a PKCS#1 RSA public key.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VF3v6LA9399gNphmZaHYG3

2026-09-04 10:43:14 +02:00

..

examples

fix: enrich OTEL log records with per-request LogContext (#8812)

2026-04-13 21:50:50 +00:00

src

fix: validate JWKS key material at config time; refresh stale comments

2026-09-04 10:43:14 +02:00

tests

fix: let a principal without a login account own a draft (#10925)

2026-09-01 23:42:08 +02:00

Cargo.toml

fix: accept any PEM wrapping for the guest key, keep the public-key check

2026-09-04 10:30:46 +02:00