fix(auth): serve /.well-known/jwks.json past the .json rewrite; drop dead v1 .json routes - #684
Merged
Merged
Conversation
JsonExtensionMiddleware strips a .json suffix from every path outside /openapi before routing, so the jwks_uri both discovery documents advertise never reached WellKnownController and relying parties could not fetch the key set. Exempt /.well-known alongside /openapi. The same rewrite made the v1 devicestatus.json, food.json and status.json route declarations unreachable; they only ever delegated to their stripped siblings, so drop them and the OpenAPI operations they published for paths that do not exist. Claude-Session: https://claude.ai/code/session_01NwnN3ND2eSXKAxJteNWSXb
Contributor
Preview Container ImagesPublished for commit
This comment is updated on each push to this PR. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
JsonExtensionMiddlewarestrips any.jsonsuffix before routing (legacy Nightscout content-negotiation), exempting only/openapi./.well-known/jwks.json— the exact URL both discovery documents advertise asjwks_uri— was therefore rewritten to/.well-known/jwks, which matches no endpoint. A relying party fetching our JWKS got a 401 (no endpoint metadata, so[AllowAnonymous]never applied).The same rewrite made three v1
.jsonroute templates unreachable dead code that also published duplicate OpenAPI operations:DeviceStatusController.GetDeviceStatusJson,FoodController.GetFoodJson,StatusController.GetStatusJson. All three were pure delegations to their stripped siblings, so removing them changes no behaviour (status.jsonresponses still go throughGetStatus, which returns JSON when the middleware forces the Accept header).Fix
/openapispecial case becomes aLiteralJsonPrefixesexemption list covering/openapiand/.well-known.Tests
New
WellKnownControllerTests: a theory over both discovery documents that reads the advertisedjwks_uriout of the served document, GETs that exact URL, and asserts the key set comes back. Both cases fail (401) without the middleware exemption — verified by reverting once.Full unit suite: 5142 passed / 0 failed. The v1 parity/golden tests covering
status.jsonet al. request the URLs, not the actions, and stay green.Noted while here (not in this PR)
The discovery documents serialize with MVC's default camelCase policy, emitting
jwksUri/authorizationEndpointinstead of the spec-mandatedjwks_uri/authorization_endpoint. A strict OIDC relying party won't find the fields. The new test reads the property name-agnostically so it doesn't pin that as correct.Follow-up from #651.
https://claude.ai/code/session_01NwnN3ND2eSXKAxJteNWSXb