{"record":{"id":"40306c8b2dafa097","repo":"zeroclaw-labs/zeroclaw","slug":"local-jwks-token-validation-is-not-yet-implemented","errorCode":null,"errorMessage":"Local JWKS token validation is not yet implemented. Set token_validation = \"remote\" to use the Nevis introspection endpoint.","messagePattern":"Local JWKS token validation is not yet implemented\\. Set token_validation = \"remote\" to use the Nevis introspection endpoint\\.","errorType":"http","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/zeroclaw-runtime/src/security/nevis.rs","lineNumber":241,"sourceCode":"            mfa_verified: body.acr.as_deref() == Some(\"mfa\")\n                || body\n                    .amr\n                    .iter()\n                    .flatten()\n                    .any(|m| m == \"fido2\" || m == \"passkey\" || m == \"otp\" || m == \"webauthn\"),\n            session_expiry: body.exp.unwrap_or(0),\n        })\n    }\n\n    #[allow(clippy::unused_async)] // Will use async when JWKS validation is implemented\n    async fn validate_token_local(&self, token: &str) -> Result<NevisIdentity> {\n        // JWT structure check: header.payload.signature\n        let parts: Vec<&str> = token.split('.').collect();\n        if parts.len() != 3 {\n            bail!(\"Invalid JWT structure: expected 3 dot-separated parts\");\n        }\n\n        bail!(\n            \"Local JWKS token validation is not yet implemented. \\\n             Set token_validation = \\\"remote\\\" to use the Nevis introspection endpoint.\"\n        );\n    }\n\n    /// Validate a Nevis session token (cookie-based sessions).\n    pub async fn validate_session(&self, session_token: &str) -> Result<NevisIdentity> {\n        if session_token.is_empty() {\n            bail!(\"empty session token\");\n        }\n\n        let session_url = format!(\n            \"{}/auth/realms/{}/protocol/openid-connect/userinfo\",\n            self.instance_url.trim_end_matches('/'),\n            self.realm,\n        );\n\n        let resp = self","sourceCodeStart":223,"sourceCodeEnd":259,"githubUrl":"https://github.com/zeroclaw-labs/zeroclaw/blob/88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc/crates/zeroclaw-runtime/src/security/nevis.rs#L223-L259","documentation":"Local JWKS validation is a stub: after the 3-part structure check, validate_token_local always bails with this message (nevis.rs:241-244). It deliberately errors rather than silently falling back to remote introspection. Only token_validation = \"remote\" currently validates tokens end to end.","triggerScenarios":"Building the provider with token_validation = \"local\" plus a jwks_url (that combination passes NevisAuthProvider::new, nevis.rs:108-113), then calling validate_token with any well-formed JWT.","commonSituations":"Config copied from docs or another deployment that assumed local validation works; trying to avoid the per-request introspection round-trip before the feature exists.","solutions":["Set token_validation = \"remote\" in the auth provider config — remote introspection is the only implemented path","Drop the jwks_url setting once remote is chosen (it is only required for local mode)","Track the runtime changelog for JWKS support instead of keeping local mode configured"],"exampleFix":"# before\n[auth.nevis]\ntoken_validation = \"local\"\njwks_url = \"https://nevis.example.com/.well-known/jwks.json\"\n\n# after\n[auth.nevis]\ntoken_validation = \"remote\"","handlingStrategy":"validation","validationCode":"let mode = TokenValidationMode::from_str_config(&cfg.token_validation)?;\nif mode == TokenValidationMode::Local {\n    anyhow::bail!(\"refusing to start: local JWKS validation is not implemented; set token_validation = \\\"remote\\\"\");\n}","typeGuard":null,"tryCatchPattern":"If the error escapes to runtime, treat the first occurrence as a fatal config error and stop routing token traffic — retrying cannot help a stub.","preventionTips":["Fail config load when token_validation is 'local' until JWKS support ships","Add a startup smoke test that validates one token end to end","Watch release notes for local JWKS validation before switching modes"],"tags":["auth","nevis","jwks","not-implemented","config","rust"],"backgroundTag":"feature-not-implemented","analyzedSha":"88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc","analyzedAt":"2026-08-23T01:07:41.857Z","schemaVersion":2},"datasetVersion":"2026-08-23T08:06:27.607Z"}