JWKS endpoint: serve standard RFC 7517 keys array alongside legacy public_key PEM

OP OpenVibers committed 17 Aug 2026 · 21f0f69c9b · 1 file, +12 −2

Media verifies user JWTs offline via JWKS and found no keys in the legacy
shape, disabling user-token auth entirely (all logged-in browsing 401'd).

Co-Authored-By: Claude Opus 4.8 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Xw6Sf5zzSALw8m93XNu5JE

Changes

ddiff --git a/server/index.js b/server/index.js
iindex a71b9aca..55eb3be0 100644
---- a/server/index.js
++++ b/server/index.js
@@@ -366,9 +366,19 @@ function requireAuth(req, res, next) {
  }
  
  // ── Routes ───────────────────────────────────────────────────
--// Public key endpoint (services fetch this to verify JWTs)
++// Public key endpoint (services fetch this to verify JWTs).
++// Serves BOTH the standard JWKS `keys` array (RFC 7517 — Media and other
++// spec-compliant consumers) and the legacy `public_key` PEM shape that the
++// inherited service clients read.
  app.get('/api/.well-known/jwks', (_req, res) => {
--    res.json({ public_key: publicKey, algorithm: privateKey === publicKey ? 'HS256' : 'RS256' });
++    const out = { public_key: publicKey, algorithm: privateKey === publicKey ? 'HS256' : 'RS256' };
++    if (publicKey.includes('BEGIN')) {
++        try {
++            const jwk = require('crypto').createPublicKey(publicKey).export({ format: 'jwk' });
++            out.keys = [{ ...jwk, use: 'sig', alg: 'RS256', kid: 'ov-network-1' }];
++        } catch { /* legacy shape still served */ }
++    }
++    res.json(out);
  });
  
  // Health check