Max Thompson d3a556aae3 ateapi: make the actor JWT issuer configurable and add typ to the header (#1834) ...

Part of #1756.

- Adds `--actor-jwt-issuer`. Unset, it defaults to
`https://idp.<namespace>.svc`, the Service ate-idp-server will serve
discovery from. Before this, `iss` was hardcoded to
`https://api.ate-system.svc`, which points at ateapi's gRPC port.
- Adds `oidcdiscovery.ParseIssuer`, which requires a canonical https URL
with no query, fragment, or user info and strips trailing slashes.
ate-idp-server will use it too, so both emit the same bytes.
- Actor JWT headers now include `typ: JWT`.
- Drops the `actorIdentityJWTIssuer` plumbing into `RPCService`, unused
since #1315.

The default `iss` changes, but `MintActorJWT` has no production caller
yet.

Testing: new unit tests for the parser, the default, the header, and
flag resolution. `TestMintActorJWT_Success` now checks `typ`, `iss`, and
`sub`. It needs Docker, so it hasn't run locally.

- [x] Tests pass
- [x] Appropriate changes to documentation are included in the PR (docs
land later in the #1756 series)

2026-09-25 19:22:25 +00:00

..

issuer_test.go

ateapi: make the actor JWT issuer configurable and add typ to the header (#1834)

2026-09-25 19:22:25 +00:00

issuer.go

ateapi: make the actor JWT issuer configurable and add typ to the header (#1834)

2026-09-25 19:22:25 +00:00