Inline OAuth2 signing key in config

[gearnode]

Summary

• Switch AuthConfig.OAuth2Server.SigningKeys[].KeyFile (path on disk) to PrivateKey (inline PEM string) so the OAuth2/OIDC server follows the same config convention as the SAML private key and the ACME account key. probod now decodes the PEM directly instead of calling os.ReadFile.
• Teach pkg/bootstrap about the OAuth2 server: a new GenerateOAuth2SigningKey helper mints a 2048-bit RSA PEM on demand, builder.Build populates OAuth2Server with OAUTH2_SERVER_* env vars (falling back to auto-generation when no key is supplied), and durations have sensible prod defaults (1h / 30d / 10m / 10m).
• Drop the static e2e/console/testdata/config.yaml and the test-only PEM it referenced; e2e/internal/testutil now renders the e2e config through bootstrap.NewBuilder at setup, writes it to a per-run temp file, and hands the path to probod. CI injects the Pebble rootCA.pem via ACME_ROOT_CA inline instead of mutating a YAML on disk.

Test plan

• make lint (Go + JS) passes
• go test ./pkg/bootstrap/... ./pkg/probod/... passes (new bootstrap tests cover auto-gen, env-driven, and preset paths)
• go build ./... including cmd/probod-bootstrap
• make test-e2e boots probod with a bootstrap-generated config (no PEM file on disk) and the OIDC/OAuth2 flows succeed
• /.well-known/openid-configuration + JWKS serve a key whose kid matches the one used to sign issued id_tokens

---

Summary by cubic

Inline OAuth2/OIDC signing keys (PEM) in config and route OAuth2 server settings through pkg/bootstrap. Add make dev-config to generate cfg/dev.yaml from repo-root .env with a per-dev RSA key and inject ACME_ROOT_CA to trust the local Pebble ACME server.

• New Features

  • pkg/probod reads probod.auth.oauth2-server.signing-keys[].private-key (inline PEM) to sign tokens.
  • pkg/bootstrap adds GenerateOAuth2SigningKey() (2048-bit RSA), maps OAUTH2_SERVER_* with defaults (KID "default"; access 1h, refresh 30d, auth/device codes 10m), and requires OAUTH2_SERVER_SIGNING_KEY.
  • Config generation: make dev-config writes cfg/dev.yaml, stashes a stable RSA key at cfg/.dev-oauth2-signing-key.pem, sources ./.env (ships .env.example), and injects ACME_ROOT_CA from compose/pebble/certs/rootCA.pem. E2E config is rendered via bootstrap.NewBuilder with a per-run key; the static e2e/console/testdata/config.yaml and PROBO_E2E_CONFIG are removed. CI passes ACME_ROOT_CA via env.

• Migration

  • Replace signing-keys[].key-file with signing-keys[].private-key (inline PEM).
  • Set OAUTH2_SERVER_SIGNING_KEY (optional OAUTH2_SERVER_SIGNING_KEY_KID); bootstrap will not auto-generate a key.

^{Written for commit 565b715. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 12 files

[cubic-dev-ai]

2 issues found across 3 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="pkg/bootstrap/builder.go">

<violation number="1" location="pkg/bootstrap/builder.go:340">
P1: `validateRequired` now makes OAuth2 signing key mandatory, but the new `getOAuth2SigningKey` no longer auto-generates one. This causes `Build()` to fail when no key is supplied instead of falling back to generated credentials.</violation>
</file>

<file name="pkg/bootstrap/builder_test.go">

<violation number="1" location="pkg/bootstrap/builder_test.go:51">
P2: Tests now enforce `OAUTH2_SERVER_SIGNING_KEY` as required, which contradicts the intended auto-generation fallback and can lock in incorrect bootstrap behavior.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P1: validateRequired now makes OAuth2 signing key mandatory, but the new getOAuth2SigningKey no longer auto-generates one. This causes Build() to fail when no key is supplied instead of falling back to generated credentials.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At pkg/bootstrap/builder.go, line 340:

<comment>`validateRequired` now makes OAuth2 signing key mandatory, but the new `getOAuth2SigningKey` no longer auto-generates one. This causes `Build()` to fail when no key is supplied instead of falling back to generated credentials.</comment>

<file context>
@@ -340,6 +337,10 @@ func (b *Builder) validateRequired() error {
 		}
 	}
 
+	if b.oauth2SigningKey == "" && b.getEnv("OAUTH2_SERVER_SIGNING_KEY") == "" {
+		missing = append(missing, "OAUTH2_SERVER_SIGNING_KEY")
+	}
</file context>

[cubic-dev-ai]

1 issue found across 7 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="GNUmakefile">

<violation number="1" location="GNUmakefile:164">
P2: `cfg/dev.yaml` generation uses `cfg/dev.env` but does not depend on it, so env changes won’t trigger regeneration.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}