Local JWKS token validation is not yet implemented. Set toke

Error message

Local JWKS token validation is not yet implemented. Set token_validation = "remote" to use the Nevis introspection endpoint.

What it means

Local JWKS validation is a stub: after the 3-part structure check, validate_token_local always bails with this message (nevis.rs:241-244). It deliberately errors rather than silently falling back to remote introspection. Only token_validation = "remote" currently validates tokens end to end.

Source

Thrown at crates/zeroclaw-runtime/src/security/nevis.rs:241

            mfa_verified: body.acr.as_deref() == Some("mfa")
                || body
                    .amr
                    .iter()
                    .flatten()
                    .any(|m| m == "fido2" || m == "passkey" || m == "otp" || m == "webauthn"),
            session_expiry: body.exp.unwrap_or(0),
        })
    }

    #[allow(clippy::unused_async)] // Will use async when JWKS validation is implemented
    async fn validate_token_local(&self, token: &str) -> Result<NevisIdentity> {
        // JWT structure check: header.payload.signature
        let parts: Vec<&str> = token.split('.').collect();
        if parts.len() != 3 {
            bail!("Invalid JWT structure: expected 3 dot-separated parts");
        }

        bail!(
            "Local JWKS token validation is not yet implemented. \
             Set token_validation = \"remote\" to use the Nevis introspection endpoint."
        );
    }

    /// Validate a Nevis session token (cookie-based sessions).
    pub async fn validate_session(&self, session_token: &str) -> Result<NevisIdentity> {
        if session_token.is_empty() {
            bail!("empty session token");
        }

        let session_url = format!(
            "{}/auth/realms/{}/protocol/openid-connect/userinfo",
            self.instance_url.trim_end_matches('/'),
            self.realm,
        );

        let resp = self

View on GitHub (pinned to 88bb9c8533)

Solutions

Set token_validation = "remote" in the auth provider config — remote introspection is the only implemented path
Drop the jwks_url setting once remote is chosen (it is only required for local mode)
Track the runtime changelog for JWKS support instead of keeping local mode configured

Example fix

# before
[auth.nevis]
token_validation = "local"
jwks_url = "https://nevis.example.com/.well-known/jwks.json"

# after
[auth.nevis]
token_validation = "remote"

Defensive patterns

Strategy: validation

Validate before calling

let mode = TokenValidationMode::from_str_config(&cfg.token_validation)?;
if mode == TokenValidationMode::Local {
    anyhow::bail!("refusing to start: local JWKS validation is not implemented; set token_validation = \"remote\"");
}

Try / catch

If the error escapes to runtime, treat the first occurrence as a fatal config error and stop routing token traffic — retrying cannot help a stub.

Prevention

Fail config load when token_validation is 'local' until JWKS support ships
Add a startup smoke test that validates one token end to end
Watch release notes for local JWKS validation before switching modes

When it happens

Trigger: Building the provider with token_validation = "local" plus a jwks_url (that combination passes NevisAuthProvider::new, nevis.rs:108-113), then calling validate_token with any well-formed JWT.

Common situations: Config copied from docs or another deployment that assumed local validation works; trying to avoid the per-request introspection round-trip before the feature exists.

Related errors

AI-assisted analysis of zeroclaw-labs/zeroclaw@88bb9c8533 (2026-08-23). Data as JSON: /api/errors/40306c8b2dafa097. Report an issue: GitHub.