Migrated here from gitea-mcp#8 — the cited code moved to this module in gitea-mcp@658f4ba. Fixing it here fixes it for every consumer (gitea-mcp, brain-mcp/ingestion, future template-go-agent spawns).
Problem
NewJWTValidator hardcodes the JWKS min-refresh interval at 1 hour:
If Dex rotates signing keys, every consumer rejects valid JWTs issued under the new key for up to 60 minutes.
Proposed change
Make the interval configurable; default to 1h to preserve current behaviour.
Log the effective value at validator init.
API-shape decision (needs a call)
NewJWTValidator(ctx, issuerURL, audience) is consumed by gitea-mcp/cmd/gitea-mcp/main.go (and others). Three options, in rough order of preference:
Variadic option — NewJWTValidator(ctx, issuer, aud, opts ...Option) with WithRefreshInterval(d). Non-breaking; existing callers compile unchanged. Cleanest for a shared lib.
New positional param — breaking; forces a coordinated bump in every consumer's go.mod + call site.
Read JWKS_REFRESH_INTERVAL env inside the library — avoid; a shared lib reaching into the process env is a hidden dependency and surprises consumers.
Lean option 1. Consumer then surfaces its own env→duration parse and passes the option, keeping config ownership at the edge.
Acceptance
Refresh interval configurable, default 1h
Effective value logged at init
No breaking change to existing NewJWTValidator callers (or, if breaking, a v0.2.0 tag + consumer-bump checklist)
Test covers a non-default interval reaching jwk.WithMinRefreshInterval
Ref: gitea-mcp#8
Migrated here from `gitea-mcp#8` — the cited code moved to this module in `gitea-mcp@658f4ba`. Fixing it here fixes it for every consumer (gitea-mcp, brain-mcp/ingestion, future template-go-agent spawns).
## Problem
`NewJWTValidator` hardcodes the JWKS min-refresh interval at 1 hour:
```go
// auth/jwt.go — NewJWTValidator
cache.Register(doc.JWKSURI, jwk.WithMinRefreshInterval(time.Hour))
```
If Dex rotates signing keys, every consumer rejects valid JWTs issued under the new key for up to 60 minutes.
## Proposed change
- Make the interval configurable; default to 1h to preserve current behaviour.
- Log the effective value at validator init.
## API-shape decision (needs a call)
`NewJWTValidator(ctx, issuerURL, audience)` is consumed by `gitea-mcp/cmd/gitea-mcp/main.go` (and others). Three options, in rough order of preference:
1. **Variadic option** — `NewJWTValidator(ctx, issuer, aud, opts ...Option)` with `WithRefreshInterval(d)`. Non-breaking; existing callers compile unchanged. Cleanest for a shared lib.
2. New positional param — breaking; forces a coordinated bump in every consumer's `go.mod` + call site.
3. Read `JWKS_REFRESH_INTERVAL` env inside the library — avoid; a shared lib reaching into the process env is a hidden dependency and surprises consumers.
Lean **option 1**. Consumer then surfaces its own env→duration parse and passes the option, keeping config ownership at the edge.
## Acceptance
- [ ] Refresh interval configurable, default 1h
- [ ] Effective value logged at init
- [ ] No breaking change to existing `NewJWTValidator` callers (or, if breaking, a v0.2.0 tag + consumer-bump checklist)
- [ ] Test covers a non-default interval reaching `jwk.WithMinRefreshInterval`
Ref: gitea-mcp#8
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Migrated here from
gitea-mcp#8— the cited code moved to this module ingitea-mcp@658f4ba. Fixing it here fixes it for every consumer (gitea-mcp, brain-mcp/ingestion, future template-go-agent spawns).Problem
NewJWTValidatorhardcodes the JWKS min-refresh interval at 1 hour:If Dex rotates signing keys, every consumer rejects valid JWTs issued under the new key for up to 60 minutes.
Proposed change
API-shape decision (needs a call)
NewJWTValidator(ctx, issuerURL, audience)is consumed bygitea-mcp/cmd/gitea-mcp/main.go(and others). Three options, in rough order of preference:NewJWTValidator(ctx, issuer, aud, opts ...Option)withWithRefreshInterval(d). Non-breaking; existing callers compile unchanged. Cleanest for a shared lib.go.mod+ call site.JWKS_REFRESH_INTERVALenv inside the library — avoid; a shared lib reaching into the process env is a hidden dependency and surprises consumers.Lean option 1. Consumer then surfaces its own env→duration parse and passes the option, keeping config ownership at the edge.
Acceptance
NewJWTValidatorcallers (or, if breaking, a v0.2.0 tag + consumer-bump checklist)jwk.WithMinRefreshIntervalRef: gitea-mcp#8