Skip to content

[#22] - implement per-realm JWT secret rotation with lifecycle management#23

Merged
https-richardy merged 47 commits into
masterfrom
feature/22-per-realm-secret-rotation
Apr 24, 2026
Merged

[#22] - implement per-realm JWT secret rotation with lifecycle management#23
https-richardy merged 47 commits into
masterfrom
feature/22-per-realm-secret-rotation

Conversation

@https-richardy
Copy link
Copy Markdown
Owner

Currently, the application generates a single global RSA secret at startup if none exists. This secret is shared across all realms, which means a key compromise or rotation affects every realm simultaneously. There is also no concept of key expiration, grace periods, or historical key tracking.

One global secret shared by all realms. No expiration or rotation mechanism. No grace period — rotating would immediately invalidate all active tokens. Blocking async calls at startup.

Each realm should own a collection of secrets with full lifecycle tracking. A secret can be in one of three states: active (signs new tokens), in grace period (validates existing tokens only), or expired (discarded). Rotation creates a new active secret and moves the current one into a grace period long enough to cover any live tokens — after which it is cleaned up.

… the secret class to support per-realm secrets and key rotation
…creation and configuration of filters related to secrets. This improves the flexibility and reusability of filtering criteria within the domain.
… secret filtering, allowing dynamic filters to be applied in MongoDB pipelines for the secret entity
…ers and counts, updates the constructor to accept a realm provider, and implements aggregation pipelines in MongoDB for searching and counting secrets.
…sier to create standard or custom filter instances.
…tation service interface and implementation to manage the secret lifecycle (creation, rotation, deletion) with expiration logic and a grace period.
…ets are no longer generated automatically during service configuration, as this is now done per realm and during realm creation.
…tation interface and service, allowing you to remove all secrets from a realm.
…e that performs key rotation, validation, and secret cleanup for all realms every 24 hours, using parallel processing and logs for monitoring and error handling.
…alm in route and enhance response handling for JWKS endpoints
…ests to include realm association and expiration dates
…e public keys and enhance private key retrieval logic
… and ensure secret exists during realm creation
…nd directly uses the `scope factory` parameter in the constructor and in internal references.
…cret management to represent secret information and its expiration dates.
… make it easier to use types from this namespace throughout the project.
… realm, allowing you to retrieve secrets from a specific realm with the appropriate authorization.
…rets to rotate the secrets of a specific realm, using the rotation service and validating the realm's existence.
…cending order before being converted to the response format, ensuring that the most recent ones are returned first.
…lm secrets endpoints, covering both success and error scenarios. It also adds a global `using` statement for `Payloads.Secret` in `Us
…g per-realm key rotation and realm-specific .well-known endpoints
@https-richardy https-richardy self-assigned this Apr 24, 2026
@https-richardy https-richardy merged commit f4b47d6 into master Apr 24, 2026
5 checks passed
@https-richardy https-richardy deleted the feature/22-per-realm-secret-rotation branch April 24, 2026 16:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant