refactor!: secure JWT authentication with RS256 and token revocation (ADR-T-007)#853

Merged

da2ce7 merged 10 commits into

torrust:developfrom

peer-cat:feat/jwt-refactor

Apr 16, 2026

Commits on Apr 15, 2026

refactor!: centralise JWT handling into dedicated module (ADR-T-007 Phase 1)
peer-cat
committed
refactor(jwt): implement ADR-T-007 Phase 2 — per-purpose signing keys and RFC 7519 claims
peer-cat
committed
refactor(jwt)!: switch from HMAC-HS256 to RS256 asymmetric signing (ADR-T-007 Phase 3)
peer-cat
committed
feat(jwt): add token revocation via per-user generation counter (ADR-T-007 Phase 4)
peer-cat
committed
fix(e2e): provision JWT PEM keys and fix health-check script
peer-cat
committed
feat(jwt): auto-generate ephemeral RSA keys when none configured (ADR-T-007 Phase 5)
peer-cat
committed
feat: add generate-auth-keypair CLI and container auto-generation (ADR-T-007 Phase 6)
peer-cat
committed

Commits on Apr 16, 2026