feat: add support for asymmetrical url signing keys, auth style key rotation and well-known by itslenny · Pull Request #1257 · supabase/storage

itslenny · 2026-07-23T19:25:05Z

What kind of change does this PR introduce?

Feature

What is the current behavior?

Only supports symmetric (HMAC) url signing keys
No way to create standby keys or swap them (similar to how auth key rotation works)
No way to list tenant jwks
JWK/JWT includes the mutable kind as a prefix in the kid - this makes swapping keys problematic

What is the new behavior?

Remove kind prefix from kid
Support generating/using asymmetrical signing keys (ECDSA)
Add endpoints to support "auth style" key rotation
- Create standby signing keys
- Swap standby signing keys to active (used to sign URLs via api)
- List jwks
Add public .well-known/jwks.json so asymmetric keys can be validated at the gateway

coveralls · 2026-07-23T19:31:16Z

Coverage Report for CI Build 32157055349

Coverage increased (+0.1%) to 81.29%

Details

Coverage increased (+0.1%) from the base build.
Patch coverage: 6 uncovered changes across 4 files (118 of 124 lines covered, 95.16%).
1 coverage regression across 1 file.

Uncovered Changes

File	Changed	Covered	%
src/storage/events/jwks/jwks-create-signing-secret.ts	2	0	0.0%
src/test/utils/config-change-awaiter.ts	12	10	83.33%
src/internal/auth/jwks/manager.ts	22	21	95.45%
src/internal/auth/jwks/store-pg.ts	15	14	93.33%
Total (13 files)	124	118	95.16%

Coverage Regressions

1 previously-covered line in 1 file lost coverage.

File	Lines Losing Coverage	Coverage
src/http/routes/s3/index.ts	1	87.42%

Coverage Stats


Relevant Lines:	13102
Covered Lines:	11079
Line Coverage:	84.56%
Relevant Branches:	7764
Covered Branches:	5883
Branch Coverage:	75.77%
Branches in Coverage %:	Yes
Coverage Strength:	601.55 hits per line

💛 - Coveralls

…otation and well-known

ferhatelmas · 2026-08-20T16:01:22Z

  const signingSecret = JWT_HMAC_ALGOS.includes(alg)
    ? await getPreparedJWTSigningKey(secret, alg)
    : await importJWK(secret)


this becomes statistically true with the feature, we should use the cached one unconditionally, it already handles internally

ferhatelmas · 2026-08-20T16:03:52Z

+      if (typeof urlSigningKey !== 'string' && kid === urlSigningKey.kid) {
+        return reply.status(409).send({ error: 'Cannot deactivate the current url signing key' })
+      }


nit: shall we add active:true into condition as noop?

noting, this is using cached version, should we keep this check in db layer just in case?

ferhatelmas · 2026-08-20T16:08:15Z

+      if (typeof urlSigningKey !== 'string' && kid === urlSigningKey.kid) {
+        return reply.status(409).send({ error: 'Cannot deactivate the current url signing key' })
+      }
      const result = await jwksManager.toggleJwkActive(tenantId, kid, active)


nit: this can throw 500 if already existing active. By normal client, it won't be the case but might be better to catch and return 400/409

ferhatelmas · 2026-08-20T16:10:24Z

+  }
+}
+
+interface JwksGenerateStandbyRequestInterface extends RequestGenericInterface {


nit: this seems same with JwksRollRequestInterface

itslenny requested a review from a team as a code owner July 23, 2026 19:25

This comment has been minimized.

Sign in to view

This comment was marked as outdated.

Sign in to view

itslenny force-pushed the lenny/jwks-support-standby-key-and-asymmetric-keys branch 5 times, most recently from 868168d to 385ef32 Compare July 29, 2026 19:31

depthfirst-app Bot reviewed Jul 29, 2026

View reviewed changes

Comment thread src/internal/auth/jwks/store-pg.ts

itslenny force-pushed the lenny/jwks-support-standby-key-and-asymmetric-keys branch from 385ef32 to 81b3ff4 Compare July 31, 2026 21:05

depthfirst-app Bot reviewed Jul 31, 2026

View reviewed changes

Comment thread src/storage/events/jwks/jwks-roll-url-signing-key.ts Outdated

itslenny force-pushed the lenny/jwks-support-standby-key-and-asymmetric-keys branch 3 times, most recently from 911b0a0 to 22eead5 Compare August 4, 2026 20:47