oh hi, did not know that you are really reading this. I added the openid stuff! Well not all of it, I still need to do the ‘userinfo’ endpoint but meh, it works as it should.

I also added the cool JWK (the secret key [ES256] that is used to sign the JWTs) rotation stuff, which I can say that I tried at first over complicating it to then end up simplifying it because it was A HELL to use like you had to call a thousand hecking things or in one method give a thousand arguments (its an overestimation, probs not real [shy of 5, it wasnt generic, it was attached to the token flow] :3), it was a pain to use and IT EVEN GAVE ME a burn mark. As I said, I just redo’d everything and boom, simplified thigny you just call from the global state and boom, we do be working!

The JWKs are rotated every 2 months, and the old one is retired at the same time. After 1 month, the retired one is deleted. So, at any given time, there’s a maximum of 2 keys, the current one and the retired one. The retired one, as the name implies, is not used to sign new tokens but is still valid to verify old token. And all of this is fetched at startup and then via a scheduled job it is updated. AND as you might have (NOT) guessed the JWKs are stored in the database, so if you have multiple instances of mah meow meow server running, they all share the same JWKs and rotate… OH GOD THEY DO NOT ROTATE THEM AT THE SAME TIME GODDAMIT AAAGH.. the intention was there okay? I did that to, in one part, give more use to my job manager and, to let all isntances update at the same time but big brain me did not think that a job is always locked to the instance that picks it up.

also the token endpoint now supports using openid and spitting out a ‘id_token’ with the user info (some claims are gatekeept behind the scopes [like ‘profile’ or ‘email’ duh]).

that’s it actually, like i started really pulling my hair, fluff, feathers whatever because I was trying to overcomplicate it a lot and i really dunno why. like, for another example, i kept swapping from the ‘jsonwebtokens’ and ‘compact_jwt’ crates because I wanted to use ES256 but didnt want the other because i never used it but then ended up using the latter because it was easier, and then that I wanted to use EC25519 which is apparently not really talked about in the rfcs (that’s why i ended up with ES256! [also supported on compact_jwt]). AH! and also in the job queue, for the JWK rotation, I wanted first to add cron job for that but… why tho, I don’t really need it, I just need a way to NOT run a job until a specific time and then reschedule it inside the same worker.

here’s the shitty screenshots showing the oh wow ‘openid configuration’, oh wowie ‘it does output tokens and id_token’, oh thats nice ‘it does give out a valid jwt with valid claims that the programmer didn’t even do themselves because they used a library called compact_jwt’ and wow ‘it does have a job that tries to autorotate if the current key is older than two months’: