feat: auth primitives - JWT/SIWE (pkg/auth/jwt)

[sadiq1971]

1 of 3 — read-API authentication, split for review. Merge order: this → auth-service → auth-integration.

Self-contained, reusable auth building blocks with no app wiring (nothing calls them yet), so this can be reviewed as a library in isolation.

• Issuer — mint short-lived RS256 JWTs; publish the public key as JWKS
• Validator — verify bearer JWTs (in-process key or remote JWKS URL)
• SIWEVerifier — validate EIP-4361 login messages, recover the signer, return the nonce
• RequireAuth — bearer-token HTTP middleware
• ParseRSAPrivateKey — load the base64-PEM signing key

Also folds in the previously-dead auth.JWTValidator (relocated from pkg/auth/jwt.go, zero callers). Full unit tests per file.

[gemini-code-assist]

Code Review

This pull request introduces a comprehensive JWT authentication package (pkg/auth/jwt) that supports Sign-In with Ethereum (SIWE) login flows, JWT session issuance, and verification via JWKS, replacing the previous auth implementation. The feedback identifies several important improvements: adding a mutex to serialize JWKS key refreshes to prevent a thundering herd problem, implementing a double-checked locking pattern in getKey to avoid redundant fetches, completely replacing the cached keys map during refreshes to ensure revoked keys are evicted, and adding a defensive nil check on msg.GetURI() in the SIWE verifier to prevent potential panics.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 81.81818% with 38 lines in your changes missing coverage. Please review.
⚠️ Please upload report for BASE (main@83d4116). Learn more about missing BASE report.

Files with missing lines	Patch %	Lines
pkg/auth/jwt/validator.go	73.80%	11 Missing and 11 partials ⚠️
pkg/auth/jwt/middleware.go	77.77%	6 Missing and 2 partials ⚠️
pkg/auth/jwt/issuer.go	93.54%	1 Missing and 1 partial ⚠️
pkg/auth/jwt/jwks.go	90.47%	1 Missing and 1 partial ⚠️
pkg/auth/jwt/keys.go	87.50%	1 Missing and 1 partial ⚠️
pkg/auth/jwt/verifier.go	90.47%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #352   +/-   ##
=======================================
  Coverage        ?   33.08%           
=======================================
  Files           ?      159           
  Lines           ?    12376           
  Branches        ?        0           
=======================================
  Hits            ?     4094           
  Misses          ?     7949           
  Partials        ?      333           

Flag	Coverage Δ
unittests	33.08% <81.81%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
pkg/auth/jwt/issuer.go	93.54% <93.54%> (ø)
pkg/auth/jwt/jwks.go	90.47% <90.47%> (ø)
pkg/auth/jwt/keys.go	87.50% <87.50%> (ø)
pkg/auth/jwt/verifier.go	90.47% <90.47%> (ø)
pkg/auth/jwt/middleware.go	77.77% <77.77%> (ø)
pkg/auth/jwt/validator.go	73.80% <73.80%> (ø)

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[sadiq1971]

Addressed Gemini's review in 9fa7b9c:

• validator.go (thundering herd, high): added a refreshMu and a double-checked cache read in getKey, so a burst of concurrent misses triggers a single JWKS fetch.
• validator.go (key rotation, security-high): refreshKeys now replaces the key cache wholesale instead of merging, so rotated-out keys stop being trusted.
• verifier.go (GetURI nil-guard, medium): skipped — not applicable. siwe-go's Message.GetURI() returns a url.URL value, not a pointer, so it can't be nil and the suggested gotURI == nil check wouldn't compile.