fix(auth): jwt kid privatekey mismatch (#104)

[BKJN1]

Summary

Fixes #104 — auth was labeling JWTs with a kid fetched dynamically from JwksService while signing them with a static config.jwt.privateKey. When central rotates the active key, auth picks up the new kid before it's redeployed with the matching private key, producing tokens whose kid points to a public key that never actually signed them ("ghost key") — verifiers would reject a token that looks correctly keyed but has an invalid signature.

Root cause

Same pattern was present in 5 places, not just the 2 listed in the issue:

• TokenEndpointController.scala (access token + id token)
• UserInfoController.scala (JWT userinfo response)
• LogoutService.scala (back-channel logout token)
• ConversationRenderService.scala (id_token on conversation complete)
• AuthorizeEndpointService.scala (id_token, hybrid flow)

All five did:

signingKey <- jwksService.getPublicKeys.map(_.active)  // dynamic kid
...
signature = JWT.Signature.Asymmetric(
  keyId = signingKey.id,              // <- from JwksService
  privateKey = config.jwt.privateKey, // <- static config
)

Fix

Added keyId: String to CoreConfig.JwtConfig, so keyId and privateKey are always the matching pair auth signs with — mirrors the existing EdgeConfig.keyId/privateKey pattern already used for edge's own signing. All 5 sites now sign with config.jwt.keyId / JWT.Algorithm.RS256 directly, never with whatever JwksService currently reports as "active".

JwksService is untouched for verification (deserializing inbound tokens still uses the full dynamic key set — that's correct and unrelated to this bug). It's dropped entirely from LogoutService and ConversationRenderService, which no longer need it for anything.

This doesn't give zero-downtime key rotation (still requires a config/deploy step to stay in sync with central's JWKS) — but it makes drift fail safely: a mismatched keyId now produces an "unknown kid" rejection at verification time instead of a token that looks valid but isn't.

Other changes

• scripts/gen-env.scala — emits jwt.key-id alongside jwt.private-key in the generated auth conf.

Tests

• TestEnvConfig.scala — jwtConfig now carries keyId.
• LogoutServiceSpec.scala, ConversationRenderServiceSpec.scala — updated constructor calls for the new (smaller) arity.
• TokenEndpointControllerSpec.scala — new regression test: JwksService reports an "active" key with a different, unrelated kid; asserts /token still signs with config.jwt.keyId and the signature verifies against the real key. Fails on the old code (kid would be the unrelated one), passes now.

[augmentcode]

🤖 Augment PR Summary

Summary: This PR fixes auth JWTs whose header kid could drift from the static private key used to sign them.

Changes:

• Adds optional jwt.key-id configuration alongside auth’s existing JWT private key.
• Uses that configured key ID and explicit RS256 for access, ID, userinfo, and back-channel logout JWTs.
• Updates OIDC c_hash and at_hash generation to match RS256 signing.
• Removes dynamic JWKS signing-key lookups from token generation paths that only need the configured key pair.
• Keeps dynamic JWKS retrieval in verification paths, including incoming access-token and ID-token-hint validation.
• Simplifies the conversation-render and logout service layers after removing their JWKS dependency.
• Updates generated auth configuration to emit jwt.key-id.
• Updates test configuration and constructor wiring for the new configuration/service signatures.
• Adds a token-endpoint regression test covering JWKS active-key drift and missing key-ID behavior.

Technical Notes: Existing configurations without jwt.key-id continue to boot, but signing requests fail until the matching key ID is configured; this avoids producing misleading tokens with invalid signatures.

_{🤖 Was this summary useful? React with 👍 or 👎}

[augmentcode]

Review completed. 1 suggestion posted.

Comment augment review to trigger a new review at any time.

[augmentcode]

keyId is now mandatory when parseConfig[CoreConfig] starts auth, but every existing auth config generated before this PR contains only jwt.issuer and jwt.private-key; deploying this image before the separately maintained runtime config is migrated will make auth fail to start.

Severity: high

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}

[BKJN1]

augment review

[augmentcode]

Review completed. No suggestions at this time.

Comment augment review to trigger a new review at any time.

[BKJN1]

augment review

[augmentcode]

Review completed. No suggestions at this time.

Comment augment review to trigger a new review at any time.

[BKJN1]

@goshacodes
ready for approve