tegwick 52d44daec2 refactor(local-identity): post-Stage4 cleanups and micro-fixes ...

- audit: chmod only on file creation, not every append (TOCTOU fix)
- jwt_utils: add extract_unverified_payload() helper
- cli: use extract_unverified_payload + JWTError instead of inline decode
- keys: extract _public_key_bytes() helper, import _b64url from jwt_utils
- security: FileNotFoundError try/except instead of path.exists() (TOCTOU fix)
- serve: cache JWK response at server init instead of per-request recompute

138 tests passing.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-03-02 08:25:21 +01:00

..

src/local_identity

refactor(local-identity): post-Stage4 cleanups and micro-fixes

2026-03-02 08:25:21 +01:00

tests

feat(local-identity): Stage 4 — security hardening (NK-WP-0002-T04)

2026-03-02 08:06:56 +01:00

pyproject.toml

feat(local-identity): Stage 3 — minimal native OIDC provider (NK-WP-0002-T03)

2026-03-02 01:05:50 +01:00

uv.lock

feat(local-identity): Stage 3 — minimal native OIDC provider (NK-WP-0002-T03)

2026-03-02 01:05:50 +01:00