stacklok / toolhive / 21296732547

60%

Build Type

push

github

Committed by web-flow

Commit Message

Add KeyManager for signing key lifecycle to authserver (#3407)

* Add KeyProvider interface for signing key management

Introduces a KeyProvider interface with two implementations:
FileProvider loads a PEM key from disk (for production), and
GeneratingProvider creates an ephemeral key on first access (for
development). Configuration is via TOOLHIVE_AUTH_SIGNING_KEY_FILE
env var - when set, the key is loaded from that path; when unset,
an ephemeral key is generated.

At authserver startup, the server will call ConfigFromEnv() and
NewProviderFromConfig() to obtain a KeyProvider. In Kubernetes
deployments, the signing key is mounted from a Secret and the env
var points to the mounted path. The provider's SigningKey() method
returns the key for JWT signing, while PublicKeys() provides the
JWKS endpoint data.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* Document multi-replica key rotation flow in FallbackKeyFiles comment

---------

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

Run Details

125 of 161 new or added lines in 3 files covered. (77.64%)

8 existing lines in 2 files now uncovered.

37322 of 62169 relevant lines covered (60.03%)

78.1 hits per line