stacklok / toolhive / 41077887559

73%

Build Type

push

github

Committed by web-flow

Commit Message

Derive the delegate client signing algorithm (#7006)

A private_key_jwt delegate client without token_endpoint_auth_signing_alg
was checked and stored as RS256, so an EC key failed at startup with a
signing algorithm mismatch. The algorithm now comes from the keys when
the field is not set: each key's alg, or ES256, ES384 or ES512 from an
EC key's curve. RSA keys without alg keep RS256, since RS and PS are
both possible. Keys that disagree are rejected with the algorithms
found and the field to set.

The validator and the stored client use the same helper, so they agree
whichever path built the configuration. With no keys loaded yet, as at
operator reconcile, the default stays RS256.

Co-authored-by: Mecatl <noreply@mecatl.dev>

Coverage Stats

64 of 64 new or added lines in 2 files covered. (100.0%)

179 existing lines in 7 files now uncovered.

91313 of 126501 relevant lines covered (72.18%)

131.12 hits per line