stacklok / toolhive / 34612681842

71%

push

github

Publish fallback keys in the authserver JWKS endpoint (#6638)

* Publish fallback keys in the authserver JWKS endpoint

The documented signing-key rotation procedure relies on an overlap
window where both the old and new keys are published, but
KeyProvider.PublicKeys(ctx) was never called outside tests. The JWKS
endpoint only ever served the single active signing key, so promoting
a fallback key to primary invalidated every outstanding token instead
of opening the intended overlap window.

Wire PublicKeys(ctx) through newServer into
NewAuthorizationServerConfig so SigningJWKS includes the primary
signing key plus every configured fallback key, primary first.

Fixes #6451

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* Fix struct literal alignment for gci/gofmt compliance

CI's golangci-lint (v2.13.2, bundled gofmt fork) splits a struct
literal's field-alignment into groups differently than the locally
installed older golangci-lint, so the previous manual field alignment
in these two struct literals passed locally but failed CI's gci check.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

14 of 16 new or added lines in 2 files covered. (87.5%)

81146 of 114997 relevant lines covered (70.56%)

96.95 hits per line