Phase 1, Task 6: Ed25519 JWT Service #19

New Issue

claude · 2026-03-30T09:22:44+02:00

claude commented

2026-03-30 09:22:44 +02:00

Plan Reference

docs/superpowers/plans/2026-03-29-phase-1-foundation-auth.md → Task 6

Scope

JwtConfig — Ed25519 key pair generation (java.security.KeyPairGenerator)
JwtService full implementation — manual JWT construction (header.payload.signature) with Ed25519 signing
- generateToken(UserEntity) — JWT with sub, uid, name, roles, iat, exp claims
- extractEmail(String), extractUserId(String), extractRoles(String)
- isTokenValid(String) — signature verification + expiry check
No third-party JWT library — uses JDK Ed25519 + Jackson for JSON

Why No JWT Library?

Ed25519 (EdDSA) support in Java JWT libraries is inconsistent. Manual construction is simpler and avoids the dependency. Consistent with cameleer3-server's Ed25519 config signing pattern.

Steps

Write failing tests (6 tests: generate, extract email, valid, tampered, roles, userId)
Run tests — verify failure
Implement JwtConfig with Ed25519 key generation
Implement full JwtService with signing and verification
Run tests — verify all 6 pass
Commit

Depends On

#18 (Task 5: User Entity + Registration)

#2 (Identity & Access Management)
#11 (Security & SOC 2 — Ed25519 cryptographic signing)

## Plan Reference `docs/superpowers/plans/2026-03-29-phase-1-foundation-auth.md` → Task 6 ## Scope - `JwtConfig` — Ed25519 key pair generation (`java.security.KeyPairGenerator`) - `JwtService` full implementation — manual JWT construction (header.payload.signature) with Ed25519 signing - `generateToken(UserEntity)` — JWT with sub, uid, name, roles, iat, exp claims - `extractEmail(String)`, `extractUserId(String)`, `extractRoles(String)` - `isTokenValid(String)` — signature verification + expiry check - No third-party JWT library — uses JDK Ed25519 + Jackson for JSON ## Why No JWT Library? Ed25519 (EdDSA) support in Java JWT libraries is inconsistent. Manual construction is simpler and avoids the dependency. Consistent with cameleer3-server's Ed25519 config signing pattern. ## Steps - [ ] Write failing tests (6 tests: generate, extract email, valid, tampered, roles, userId) - [ ] Run tests — verify failure - [ ] Implement JwtConfig with Ed25519 key generation - [ ] Implement full JwtService with signing and verification - [ ] Run tests — verify all 6 pass - [ ] Commit ## Depends On - #18 (Task 5: User Entity + Registration) ## Related Epics - #2 (Identity & Access Management) - #11 (Security & SOC 2 — Ed25519 cryptographic signing)

claude referenced this issue

2026-03-30 09:22:48 +02:00

Phase 1, Task 7: Login Endpoint #20

claude added the auth phase-1 security task labels 2026-03-30 09:23:14 +02:00

claude closed this issue

2026-04-04 14:38:59 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: cameleer/cameleer-saas#19