IdP resolve: discovery + JWKS, keep-last-good on failure #7

Merged

ginjiruu merged 2 commits from feat/idp-resolve into master

2026-09-14 00:34:43 +00:00

ginjiruu commented

2026-09-14 00:30:15 +00:00

Owner

Closes #2

Implements the IdP resolve step (spec #1, seam 3) as a pure-Go package, internal/idp:

Resolve fetches the OIDC discovery document from the per-Client issuerURL and returns the resolved token endpoint and authorization endpoint, plus the JWKS signing keys (raw JWKS JSON) from the document's jwks_uri.
Resolvent (the leader-owned, per-Client state tracker) re-fetches on Refresh; on any fetch failure it keeps the last-good state, so a transient IdP outage never blanks the signing keys. A successful refresh picks up rotated keys; a partial (JWKS-only) failure never replaces the state.
Exercised against a stubbed (httptest) IdP that can be made to fail (discovery down, JWKS down, missing jwks_uri). The refresh TTL timer is seam 1's concern per the spec and is deliberately not in this change.

Also adds docs/agents/issue-tracker.md (Forgejo conventions + PR workflow) so the engineering skills' hard-check passes in this repo.

Verification: make test (envtest controllers + unit, go1.26.0 toolchain) and make lint (golangci-lint) pass clean.

Closes #2 Implements the IdP resolve step (spec #1, seam 3) as a pure-Go package, `internal/idp`: - `Resolve` fetches the OIDC discovery document from the per-Client `issuerURL` and returns the resolved token endpoint and authorization endpoint, plus the JWKS signing keys (raw JWKS JSON) from the document's `jwks_uri`. - `Resolvent` (the leader-owned, per-Client state tracker) re-fetches on `Refresh`; on any fetch failure it keeps the last-good state, so a transient IdP outage never blanks the signing keys. A successful refresh picks up rotated keys; a partial (JWKS-only) failure never replaces the state. - Exercised against a stubbed (httptest) IdP that can be made to fail (discovery down, JWKS down, missing `jwks_uri`). The refresh TTL timer is seam 1's concern per the spec and is deliberately not in this change. Also adds `docs/agents/issue-tracker.md` (Forgejo conventions + PR workflow) so the engineering skills' hard-check passes in this repo. Verification: `make test` (envtest controllers + unit, go1.26.0 toolchain) and `make lint` (golangci-lint) pass clean.

ginjiruu added 2 commits

2026-09-14 00:30:15 +00:00

add agents issue-tracker doc: forgejo conventions, pr workflow ffb2090a12

add idp resolve: discovery + jwks fetch, keep-last-good on failure

Lint / Run on Ubuntu (push) Has been cancelled

Details

E2E Tests / Run on Ubuntu (push) Has been cancelled

Details

Tests / Run on Ubuntu (push) Has been cancelled

Details

Lint / Run on Ubuntu (pull_request) Has been cancelled

Details