IdP resolve (discovery + JWKS, keep-last-good) #2

New issue

Closed

opened 2026-09-13 20:39:57 +00:00 by ginjiruu · 0 comments

ginjiruu commented

2026-09-13 20:39:57 +00:00

Owner

Parent

Spec: Shared in-memory state model (Registry + Snapshot) — #1

What to build

Given a Client's issuerURL, a resolve step that fetches the IdP discovery document and derives the token endpoint and authorization endpoint, and fetches the JWKS signing keys. On any fetch failure it keeps the last-good keys, so a transient IdP outage does not blank the signing keys. Verifiable against a stubbed (httptest) IdP.

Acceptance criteria

Given an issuerURL, it fetches the discovery document and returns the resolved token endpoint and authorization endpoint.
It fetches and returns the JWKS signing keys.
When a fetch fails, it retains the last-good JWKS (never blanks the keys).
The discovery/JWKS fetch is exercised against a stubbed (httptest) IdP that can be made to fail.

Blocked by

None — can start immediately.

## Parent Spec: Shared in-memory state model (Registry + Snapshot) — https://git.animeteamspeak.moe/lab/authz-bridge/issues/1 ## What to build Given a Client's `issuerURL`, a resolve step that fetches the IdP discovery document and derives the token endpoint and authorization endpoint, and fetches the JWKS signing keys. On any fetch failure it keeps the last-good keys, so a transient IdP outage does not blank the signing keys. Verifiable against a stubbed (httptest) IdP. ## Acceptance criteria - [ ] Given an `issuerURL`, it fetches the discovery document and returns the resolved token endpoint and authorization endpoint. - [ ] It fetches and returns the JWKS signing keys. - [ ] When a fetch fails, it retains the last-good JWKS (never blanks the keys). - [ ] The discovery/JWKS fetch is exercised against a stubbed (httptest) IdP that can be made to fail. ## Blocked by None — can start immediately.

ginjiruu added the

ready-for-agent

label

2026-09-13 20:40:29 +00:00

ginjiruu referenced this issue

2026-09-13 20:41:05 +00:00

Registry builder (the leader's core) #3

ginjiruu referenced this issue from a pull request that will close it,

2026-09-14 00:30:15 +00:00

IdP resolve: discovery + JWKS, keep-last-good on failure #7

ginjiruu closed this issue

2026-09-14 00:34:44 +00:00