fix(ocm): derive JWKS signing keyId per request, not from a frozen host

The JWKS signing keyId was persisted as a full URL, frozen at whichever
host provisioned the key first. An instance addressed by more than one
host (the two-port integration rig, or a port change behind a proxy) then
signed with a keyId whose host no longer matched its federated share
identity, so receivers rejected the request with an origin mismatch.

Persist only a stable opaque key id (ecdsa-p256-sha256-<n>) and rebuild
the full keyId per request from the current URL, in both the signing
signatory and the published JWK Set. The signature keyid and the JWKS kid
still match, since both are built from the same opaque id and the current
request host. Rotation still works: slots differ by the counter, and the
host is just fresh context.

Drops the resolveKidBase/canonicalKid hostname machinery and the
ocm_jwks_kid_base appconfig, which are no longer needed.

Assisted-by: ClaudeCode:glm-5.2

Signed-off-by: Micke Nordin <kano@sunet.se>

Author: mickenordin

lib/private/OCM/OCMSignatoryManager.php

@@ -57,8 +57,6 @@ class OCMSignatoryManager implements IJwkResolvingSignatoryManager {
 	private const APPKEY_JWKS_POOL_PREFIX = 'ocm_jwks_pool_';
 	private const APPCONFIG_JWKS_POOL_COUNTER = 'ocm_jwks_pool_counter';
 	private const APPCONFIG_JWKS_POOL_KID_PREFIX = 'ocm_jwks_pool_kid_';
-	/** Stable kid identity portion, reused across rotations so kids stay on one hostname. */
-	private const APPCONFIG_JWKS_KID_BASE = 'ocm_jwks_kid_base';
 	public const SLOT_ACTIVE = 'active';
 	public const SLOT_PENDING = 'pending';
 	public const SLOT_RETIRING = 'retiring';
@@ -262,82 +260,32 @@ public function listJwksKeys(): array {
 			}
 			$entries[] = [
 				'poolId' => $id,
-				'kid' => $this->canonicalKid(
-					$this->appConfig->getValueString('core', self::APPCONFIG_JWKS_POOL_KID_PREFIX . $id, ''),
-				),
+				'kid' => $this->appConfig->getValueString('core', self::APPCONFIG_JWKS_POOL_KID_PREFIX . $id, ''),
 				'slot' => $bySlot[$id] ?? null,
 			];
 		}
 		return $entries;
 	}
 
 	/**
-	 * Generate keypair into a new pool. Kid is canonicalised through
-	 * {@see Signatory::setKeyId} so admin output and wire form agree.
+	 * Generate keypair into a new pool. Only the opaque key id is persisted;
+	 * the host is derived fresh per request at use time, so a key provisioned
+	 * under one URL still verifies when the instance is addressed by another
+	 * (e.g. the two-port integration rig, or a port change behind a proxy).
 	 */
-	private function generatePool(string $kid): int {
+	private function generatePool(string $opaqueKeyId): int {
 		$poolId = $this->appConfig->getValueInt('core', self::APPCONFIG_JWKS_POOL_COUNTER, 0) + 1;
 		$this->appConfig->setValueInt('core', self::APPCONFIG_JWKS_POOL_COUNTER, $poolId);
 
 		$this->identityProofManager->generateEcdsaP256AppKey('core', self::APPKEY_JWKS_POOL_PREFIX . $poolId);
-		$this->appConfig->setValueString('core', self::APPCONFIG_JWKS_POOL_KID_PREFIX . $poolId, $this->canonicalKid($kid));
+		$this->appConfig->setValueString('core', self::APPCONFIG_JWKS_POOL_KID_PREFIX . $poolId, $opaqueKeyId);
 		return $poolId;
 	}
 
-	/** Canonical wire-form via a transient {@see Signatory::setKeyId} round-trip. */
-	private function canonicalKid(string $kid): string {
-		$probe = new Signatory(true);
-		$probe->setKeyId($kid);
-		return $probe->getKeyId();
-	}
-
-	/**
-	 * Build the next kid. Identity portion is derived once and persisted so
-	 * CLI-triggered rotations stay on the same hostname.
-	 *
-	 * @throws \RuntimeException if no instance identity can be derived
-	 */
+	/** Next opaque key id (`<fragment>-<n>`); the host is added per request. */
 	private function nextPoolKid(): string {
-		$base = $this->resolveKidBase();
 		$next = $this->appConfig->getValueInt('core', self::APPCONFIG_JWKS_POOL_COUNTER, 0) + 1;
-		return $base . '-' . $next;
-	}
-
-	/**
-	 * Stable identity portion (before the `-N` suffix). Resolution order:
-	 * stored APPCONFIG_JWKS_KID_BASE > active pool's kid sans suffix >
-	 * fresh from {@see buildLocalKeyId}. Persisted so CLI rotations stay
-	 * on one hostname.
-	 *
-	 * @throws \RuntimeException if no instance identity can be derived
-	 */
-	private function resolveKidBase(): string {
-		$base = $this->appConfig->getValueString('core', self::APPCONFIG_JWKS_KID_BASE, '');
-		if ($base !== '') {
-			return $base;
-		}
-
-		$activePool = $this->getSlotPool(self::SLOT_ACTIVE);
-		if ($activePool !== null) {
-			$kid = $this->canonicalKid(
-				$this->appConfig->getValueString('core', self::APPCONFIG_JWKS_POOL_KID_PREFIX . $activePool, ''),
-			);
-			$pos = strrpos($kid, '-');
-			if ($pos !== false) {
-				$base = substr($kid, 0, $pos);
-			}
-		}
-
-		if ($base === '') {
-			try {
-				$base = $this->canonicalKid($this->buildLocalKeyId(self::KEYID_FRAGMENT_JWKS));
-			} catch (IdentityNotFoundException $e) {
-				throw new \RuntimeException('cannot derive instance identity for JWKS kid', 0, $e);
-			}
-		}
-
-		$this->appConfig->setValueString('core', self::APPCONFIG_JWKS_KID_BASE, $base);
-		return $base;
+		return self::KEYID_FRAGMENT_JWKS . '-' . $next;
 	}
 
 	private function getSlotPool(string $slot): ?int {
@@ -357,19 +305,29 @@ private function clearSlot(string $slot): void {
 		$this->appConfig->deleteKey('core', 'ocm_jwks_slot_' . $slot);
 	}
 
-	/** Returns null if the underlying appkey was manually deleted. */
+	/**
+	 * Returns null if the underlying appkey was manually deleted. The keyId
+	 * is rebuilt per call from the opaque id and the current request URL, so
+	 * it tracks the host the instance is actually addressed as.
+	 *
+	 * @throws \RuntimeException if no instance identity can be derived
+	 */
 	private function signatoryFromPool(int $poolId): ?Signatory {
 		$appKey = self::APPKEY_JWKS_POOL_PREFIX . $poolId;
 		if (!$this->identityProofManager->hasAppKey('core', $appKey)) {
 			return null;
 		}
-		$kid = $this->appConfig->getValueString('core', self::APPCONFIG_JWKS_POOL_KID_PREFIX . $poolId, '');
-		if ($kid === '') {
+		$opaqueKeyId = $this->appConfig->getValueString('core', self::APPCONFIG_JWKS_POOL_KID_PREFIX . $poolId, '');
+		if ($opaqueKeyId === '') {
 			return null;
 		}
 		$keyPair = $this->identityProofManager->getAppKey('core', $appKey);
 		$signatory = new Signatory(true);
-		$signatory->setKeyId($kid);
+		try {
+			$signatory->setKeyId($this->buildLocalKeyId($opaqueKeyId));
+		} catch (IdentityNotFoundException $e) {
+			throw new \RuntimeException('cannot derive instance identity for JWKS kid', 0, $e);
+		}
 		$signatory->setPublicKey($keyPair->getPublic());
 		$signatory->setPrivateKey($keyPair->getPrivate());
 		return $signatory;

tests/lib/OCM/OCMSignatoryManagerRotationTest.php

@@ -86,7 +86,7 @@ public function testFirstCallProvisionsActiveKey(): void {
 		$this->assertSame($signatory->getKeyId(), $jwks[0]['kid']);
 
 		$listed = $this->signatoryManager->listJwksKeys();
-		$this->assertSame([['poolId' => 1, 'kid' => $signatory->getKeyId(), 'slot' => 'active']], $listed);
+		$this->assertSame([['poolId' => 1, 'kid' => 'ecdsa-p256-sha256-1', 'slot' => 'active']], $listed);
 	}
 
 	public function testStageDoesNotChangeActiveSignerButPublishesNewJwk(): void {
@@ -155,7 +155,7 @@ public function testRetireRemovesRetiringKeyFromJwks(): void {
 		// listJwksKeys also drops the retired pool.
 		$listed = $this->signatoryManager->listJwksKeys();
 		$this->assertCount(1, $listed);
-		$this->assertSame($staged->getKeyId(), $listed[0]['kid']);
+		$this->assertSame('ecdsa-p256-sha256-2', $listed[0]['kid']);
 		$this->assertNotContains($first->getKeyId(), array_column($listed, 'kid'));
 	}