hotfix/jwks-fix

[mainick]

No description provided.

[Copilot]

Pull request overview

This pull request refactors the JWKS token decoder implementation to use the Firebase JWT library's built-in JWK parsing functionality instead of custom ASN.1 encoding and manual PEM conversion. The changes improve security by enforcing server-side algorithm validation and strengthen URL validation for JWKS endpoints.

Key changes:

• Replaced custom jwkToPem() and ASN.1 encoding methods with Firebase JWT's JWK::parseKeySet() for more robust key parsing
• Enhanced JWT validation with explicit format checking (3-part structure) and server-side algorithm enforcement
• Made HTTP client mandatory for JWKS fetching (removed file_get_contents fallback) and added configurable timeout options
• Added comprehensive test coverage for edge cases including missing kid, algorithm mismatches, empty JWKS, expired tokens, and invalid issuers

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 7 comments.

File	Description
src/Token/JWKSTokenDecoder.php	Refactored to use Firebase JWT's JWK::parseKeySet instead of custom PEM conversion; added JWT format validation, server-side algorithm enforcement, and enhanced security checks; removed readonly constraint from options property; made HTTP client required
tests/Token/JWKSTokenDecoderTest.php	Added JSON_THROW_ON_ERROR flag for consistency; implemented previously stubbed testRequiresHttpsForJwksEndpoint test; added 7 new comprehensive test cases covering missing kid, algorithm mismatch, kid not in JWKS, empty JWKS, expired tokens, invalid issuer, and invalid JWT format

Comments suppressed due to low confidence (1)

src/Token/JWKSTokenDecoder.php:102

• The catch block for TokenDecoderException has been removed, but this creates a problem. When TokenDecoderException is thrown from helper methods like getKeyForKid() or fetchJwks(), it will now be caught by the generic Exception handler at line 100-102, which will wrap it in another TokenDecoderException. This results in double-wrapping of the exception and loss of the original specific error context. The TokenDecoderException catch block should be restored to preserve the original exception when it's already of the correct type.

        }
        catch (\JsonException $e) {
            throw TokenDecoderException::forDecodingError('JSON parsing failed: ' . $e->getMessage(), $e);
        }
        catch (\Exception $e) {
            throw TokenDecoderException::forDecodingError($e->getMessage(), $e);
        }

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.