Improve load_jwks metadata verification

Author: bbockelm

src/scitokens.h

@@ -310,7 +310,8 @@ int keycache_set_background_refresh(int enabled, char **err_msg);
 int keycache_stop_background_refresh(char **err_msg);
 
 /**
- * Load the JWKS from the keycache for a given issuer, refreshing only if needed.
+ * Load the JWKS from the keycache for a given issuer, refreshing only if
+ * needed.
  * - Returns 0 if successful, nonzero on failure.
  * - If the existing JWKS has not expired, this will return the cached JWKS
  *   without triggering a download.
@@ -326,7 +327,6 @@ int keycache_load_jwks(const char *issuer, char **jwks, char **err_msg);
  * - `metadata` is an output variable set to a JSON string containing:
  *   - "expires": expiration time (Unix epoch seconds)
  *   - "next_update": next update time (Unix epoch seconds)
- *   - "extra": additional metadata (currently an empty JSON object)
  * - If the issuer does not exist in the cache, returns an error.
  */
 int keycache_get_jwks_metadata(const char *issuer, char **metadata,

src/scitokens_cache.cpp

@@ -433,7 +433,7 @@ std::string scitokens::Validator::load_jwks(const std::string &issuer) {
     auto now = std::time(NULL);
     picojson::value jwks;
     int64_t next_update;
-    
+
     try {
         // Try to get from cache
         if (get_public_keys_from_db(issuer, now, jwks, next_update)) {
@@ -448,12 +448,12 @@ std::string scitokens::Validator::load_jwks(const std::string &issuer) {
         // Negative cache hit - return empty keys
         return std::string("{\"keys\": []}");
     }
-    
+
     // Either not in cache or past next_update - refresh
     if (!refresh_jwks(issuer)) {
         throw CurlException("Failed to load JWKS for issuer: " + issuer);
     }
-    
+
     // Get the newly refreshed JWKS
     return get_jwks(issuer);
 }
@@ -462,57 +462,57 @@ std::string scitokens::Validator::get_jwks_metadata(const std::string &issuer) {
     auto now = std::time(NULL);
     int64_t next_update = -1;
     int64_t expires = -1;
-    
+
     // Get the metadata from database without expiry check
     auto cache_fname = get_cache_file();
     if (cache_fname.size() == 0) {
         throw std::runtime_error("Unable to access cache file");
     }
-    
+
     sqlite3 *db;
     int rc = sqlite3_open(cache_fname.c_str(), &db);
     if (rc) {
         sqlite3_close(db);
         throw std::runtime_error("Failed to open cache database");
     }
     sqlite3_busy_timeout(db, SQLITE_BUSY_TIMEOUT_MS);
-    
+
     sqlite3_stmt *stmt;
     rc = sqlite3_prepare_v2(db, "SELECT keys from keycache where issuer = ?",
                             -1, &stmt, NULL);
     if (rc != SQLITE_OK) {
         sqlite3_close(db);
         throw std::runtime_error("Failed to prepare database query");
     }
-    
+
     if (sqlite3_bind_text(stmt, 1, issuer.c_str(), issuer.size(),
                           SQLITE_STATIC) != SQLITE_OK) {
         sqlite3_finalize(stmt);
         sqlite3_close(db);
         throw std::runtime_error("Failed to bind issuer to query");
     }
-    
+
     rc = sqlite3_step(stmt);
     if (rc == SQLITE_ROW) {
         const unsigned char *data = sqlite3_column_text(stmt, 0);
         std::string metadata(reinterpret_cast<const char *>(data));
         sqlite3_finalize(stmt);
         sqlite3_close(db);
-        
+
         picojson::value json_obj;
         auto err = picojson::parse(json_obj, metadata);
         if (!err.empty() || !json_obj.is<picojson::object>()) {
             throw JsonException("Invalid JSON in cache entry");
         }
-        
+
         auto top_obj = json_obj.get<picojson::object>();
-        
+
         // Extract expires
         auto iter = top_obj.find("expires");
         if (iter != top_obj.end() && iter->second.is<int64_t>()) {
             expires = iter->second.get<int64_t>();
         }
-        
+
         // Extract next_update
         iter = top_obj.find("next_update");
         if (iter != top_obj.end() && iter->second.is<int64_t>()) {
@@ -521,13 +521,16 @@ std::string scitokens::Validator::get_jwks_metadata(const std::string &issuer) {
             // Default next_update to 4 hours before expiry
             next_update = expires - DEFAULT_NEXT_UPDATE_OFFSET_S;
         }
-        
-        // Build metadata JSON
+
+        // Build metadata JSON (add future keys at top level if needed)
         picojson::object metadata_obj;
-        metadata_obj["expires"] = picojson::value(expires);
-        metadata_obj["next_update"] = picojson::value(next_update);
-        metadata_obj["extra"] = picojson::value(picojson::object());
-        
+        if (expires != -1) {
+            metadata_obj["expires"] = picojson::value(expires);
+        }
+        if (next_update != -1) {
+            metadata_obj["next_update"] = picojson::value(next_update);
+        }
+
         return picojson::value(metadata_obj).serialize();
     } else {
         sqlite3_finalize(stmt);
@@ -541,22 +544,22 @@ bool scitokens::Validator::delete_jwks(const std::string &issuer) {
     if (cache_fname.size() == 0) {
         return false;
     }
-    
+
     sqlite3 *db;
     int rc = sqlite3_open(cache_fname.c_str(), &db);
     if (rc) {
         sqlite3_close(db);
         return false;
     }
     sqlite3_busy_timeout(db, SQLITE_BUSY_TIMEOUT_MS);
-    
+
     // Use the existing remove_issuer_entry function
     // Note: remove_issuer_entry closes the database on error
     if (remove_issuer_entry(db, issuer, true) != 0) {
         // Database already closed by remove_issuer_entry
         return false;
     }
-    
+
     sqlite3_close(db);
     return true;
 }