feat(07.3-02): ES256 JWT algorithm upgrade + startup rotation hook

curo/kite

- config.py: add refresh_token_expire_hours=16, jwt_private_key, jwt_public_key fields (D-01, D-09)
- services/auth.py: swap all 4 JWT sites to ES256 via base64-decoded PEM keys; remove HS256 (D-02, D-03)
- main.py: add _rotate_tokens_on_algorithm_change lifespan hook — bulk-revokes refresh tokens on algorithm change; idempotent on repeat boots (D-04, D-05)
- test_auth_es256.py: promote ES256-01..05 + CFG-01 stubs to 6 passing tests; RM-01..03 remain xfail
- docker-compose.yml: inject JWT_PRIVATE_KEY + JWT_PUBLIC_KEY into backend + celery-worker (D-07)
- README.md: add JWT key env vars + key generation Python one-liner snippet
- .env.example: add JWT_PRIVATE_KEY= and JWT_PUBLIC_KEY= lines
- Version bump to 0.1.2

This commit is contained in:

curo1305

2026-06-06 17:19:50 +02:00

parent 99f55825aa

commit 8be792ab4c

8 changed files with 268 additions and 20 deletions

									
										frontend/package.json
									
		+1
		-1
	
												View File
												
				@@ -1,6 +1,6 @@

				{

				  "name": "document-scanner-frontend",

				  "version": "0.1.1",

				  "version": "0.1.2",

				  "type": "module",

				  "scripts": {

				    "dev": "vite",