fix(identity-webhook): OIDC composite app_<24hex>_<secret> token exchange

[eliteprox]

Summary

• Accept composite Bearer app_<24hex>_<secret> in OIDC mode when OIDC_TOKEN_EXCHANGE_BASE_URL is set.
• RFC 8693 token exchange at /api/v1/apps/{clientId}/oidc/token, then jwtVerify the minted access token (JWKS via discovery from fix(identity-webhook): resolve JWKS via OIDC discovery #62).
• Secret segment is opaque (operators may use their own key prefix); reject cs_ / _cs_ client-secret shapes.
• Harden exchange: salted HKDF cache keys, allowlist-sanitized logs; document new env vars in README / .env.example.

Behavior

• Opt-in: without OIDC_TOKEN_EXCHANGE_BASE_URL, OIDC mode stays JWT-only.
• Composite shape is app_ + 24 lowercase hex + _ + opaque secret (underscore separator for copy/select UX).
• Optional M2M client credentials: OIDC_EXCHANGE_M2M_CLIENT_ID + OIDC_EXCHANGE_M2M_CLIENT_SECRET (both or neither).
• Wired through createEndUserVerifierFromEnv (Docker / Compose path).

Test plan

• cd identity-webhook && npm test (42 passing: discovery, composite exchange, api_key mode)
• Merge fix(identity-webhook): resolve JWKS via OIDC discovery #62 first, then this PR
• Optional smoke: composite key against a staging exchange endpoint

Notes

• npm publish / legacy-env packaging is not in this PR (deferred).

[eliteprox]

Rebased onto retargeted fix/oidc-jwks-discovery (#62). Dropped npm-publish / legacy-env packaging from this PR; only the composite exchange feature remains. CI green.

[Copilot]

Pull request overview

Adds optional support in identity-webhook OIDC mode for composite Bearer app_<24hex>_<secret> credentials by exchanging them for an access token via RFC 8693 token exchange, then verifying the minted JWT, with documentation and tests to match.

Changes:

• Implement composite token parsing + RFC 8693 exchange flow in createOidcVerifier, including caching and hardened logging.
• Add unit tests for composite parsing/URL normalization and the end-to-end exchange→JWT verify path.
• Document new env vars in README.md and .env.example.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
README.md	Documents new OIDC token-exchange env vars and composite bearer behavior.
identity-webhook/verifiers.mjs	Implements composite key parsing, token exchange, caching, and JWT verification integration.
identity-webhook/verifiers.test.mjs	Adds coverage for composite parsing/normalization and exchange-based verification flow.
.env.example	Adds example env vars for enabling token exchange and optional M2M credentials.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[eliteprox]

Addressed Copilot review + related OIDC hardening in 378b79b:

• Cache: inflight composite-exchange entries now expire via expiresAt (same as results); unit test added.
• Algs: ALLOWED_JWT_ALGS is RS256/ES256 (documented in README).
• Exchange base URL: must be origin-only; path/query/hash are rejected instead of silently dropped.
• Also: require Bearer scheme; normalize issuer for discovery + jwtVerify; requiredClaims: [exp, subjectClaim]; clockTolerance: 60.

Same commit cherry-picked to pymthouse#6 (be32152).

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

[eliteprox]

Addressed the two latest Copilot comments in $(git rev-parse --short HEAD):

1. Trailing-slash iss: jwtVerify now accepts both normalized issuer and ${issuer}/ so tokens whose iss ends with / still verify after discovery normalization.
2. Inflight cache race: clearInflight / setResultForInflight only mutate the entry when it still points at the same promise, so an expired older exchange cannot clobber a newer one.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.

[eliteprox]

Addressed remaining Copilot review in e0be4d7:

• Userinfo: reject username/password in OIDC_TOKEN_EXCHANGE_BASE_URL (would be silently dropped by url.origin)
• Docs: README + .env.example note HTTPS-except-loopback and no userinfo
• bearerToken: already RFC 6750 b64token; added whitespace rejection tests

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[eliteprox]

Manual smoke — composite exchange against local clearinghouse stack

Tested on a stacked branch (feat/composite-app-token-exchange + feat/balance-gate + feat/owner-m2m-customer-identity) with Compose (kafka, identity-webhook, remote-signer, openmeter-collector).

Config

• IDENTITY_AUTH_MODE=oidc
• OIDC_TOKEN_EXCHANGE_BASE_URL=https://staging.pymthouse.com
• OIDC_ISSUER / OIDC_AUDIENCE = https://staging.pymthouse.com/api/v1/oidc
• OIDC_CLIENT_CLAIM=client_id, OIDC_SUBJECT_CLAIM=external_user_id, OIDC_REQUIRED_SCOPES=sign:job

Composite Bearer used

Authorization: Bearer app_a559adff001a1cbc50f53dac_pmth_<secret>

(app_<24hex>_<opaque> — exchanged via RFC 8693 at /api/v1/apps/{clientId}/oidc/token, then JWT verify)

Authorize (identity-webhook)

{
  "status": 200,
  "auth_id": "app_a559adff001a1cbc50f53dac:895773a5-7470-4638-bdf9-a2b3d15906b8",
  "identity": {
    "issuer": "http://identity-webhook:8090",
    "client_id": "app_a559adff001a1cbc50f53dac",
    "usage_subject": "895773a5-7470-4638-bdf9-a2b3d15906b8",
    "usage_subject_type": "external_user_id"
  }
}

Live LV2V stream (local signer 127.0.0.1:8081)

• Gateway: livepeer-python-gateway write_frames.py
• Orchestrator: ai.livepeer-utopia.xyz:8935
• Model: streamdiffusion-sdxl (60 frames @ 10 fps)
• Result: job started + frames published; remote-signer signed tickets with the composite-resolved auth_id above (e.g. Signed numTickets=… auth_id=app_a559…:895773a5-…)

Metering

Kafka create_signed_ticket events from the live payments were consumed by openmeter-collector and POSTed to OpenMeter (output_error=0).

Covers the optional smoke item in the PR test plan: composite key against a staging exchange endpoint, end-to-end through the Compose identity webhook + remote signer.

[eliteprox]

peer reviewed by @rickstaa, merging per discussion (change is bug fix, rather than feature)