fix(security): drop python-jose, use PyJWT (closes #128)

[JohnRDOrazio]

Summary

• Replaces python-jose with PyJWT (already a direct dependency) for JWT validation in ontokit/core/auth.py.
• Removes 7 packages from the lockfile: ecdsa, pyasn1, rsa, six, python-jose, types-python-jose, types-pyasn1.
• Resolves Dependabot alerts Include branch refs in revision history response #5 (ecdsa Minerva timing — no upstream fix planned) and Wire SPARQL endpoint to project ontology graph #4 (ecdsa input validation) as a side effect, since both were blocked by python-jose==3.5.0's constraint on the older ecdsa.

Closes #128.

Changes

• ontokit/core/auth.py — from jose import JWTError, jwt → import jwt + from jwt.exceptions import PyJWTError. JWKs are converted via jwt.PyJWK(rsa_key).key before passing to jwt.decode. The except clause catches PyJWTError.
• tests/unit/test_auth_core.py — replace JWTError with PyJWTError in the one test that mocked a decode failure.
• pyproject.toml — drop python-jose[cryptography] from runtime deps and types-python-jose from dev deps.
• .pre-commit-config.yaml — replace python-jose / types-python-jose mypy stubs with pyjwt (PyJWT ships its own stubs).
• uv.lock — regenerated.

Why this is safe for our use case

We use JWTs in exactly one direction: validating Zitadel-issued access tokens with RS256 + JWKS rotation. PyJWT covers that path identically to python-jose. We don't use JWE, don't validate OIDC at_hash, and don't issue JWTs ourselves — none of python-jose's broader feature surface applies here. See issue #128 comments for a fuller drawbacks/counter-positives breakdown.

Test plan

• pytest tests/ -v — 1515 passed
• mypy ontokit/ — clean
• ruff check ontokit/ — clean
• Verified ecdsa, python-jose, pyasn1, rsa, six no longer present in uv.lock
• Manual smoke test before merge: start the dev stack, log into the frontend, exercise an authenticated endpoint, confirm the access token validates successfully against live Zitadel JWKS. Unit tests use mocked jwt, so they don't catch real signature-verification differences between libs.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Rate limit exceeded

@JohnRDOrazio has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 19 minutes and 12 seconds before requesting another review.

To keep reviews running without waiting, you can enable usage-based add-on for your organization. This allows additional reviews beyond the hourly cap. Account admins can enable it under billing.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: d452890a-9bce-4b3d-88eb-7fb91afbf1e2

📥 Commits

Reviewing files that changed from the base of the PR and between c15c127 and 2c0ede7.

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (4)

• .pre-commit-config.yaml
• ontokit/core/auth.py
• pyproject.toml
• tests/unit/test_auth_core.py

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/issue-128-drop-python-jose

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!