fix(auth): don't validate JWT client-side, let server handle it

commit: ff4c2dda3c888475c396c0245d8157bc3b5d1031
author: brice · 7mo ago · 2026-03-23 05:20 UTC
parent: f05fed4
signature: GPG VerifiedCD88F9E564E0102646FB6077A1A07C7C7C3E349D · arch-gpg Verified for the committer email

1 file · +2 -1

M internal/adapters/in/cli/remote/client.go +2 -1


@@ -180,12 +180,13 @@ func (c *Client) exchangeToken(ctx context.Context) error {
180	180
181	181		// bearerToken returns the token to use in Authorization headers.
182	182		// It exchanges the long-lived token for an ephemeral one via /auth/token.
	183	+	// If subject extraction failed, uses "unknown" — the server validates everything.
183	184		func (c *Client) bearerToken(ctx context.Context) (string, error) {
184	185		if c.token == "" {
185	186		return "", nil
186	187		}
187	188		if c.subject == "" {
188		-	return "", fmt.Errorf("invalid token: could not extract subject from JWT; regenerate with: gordon auth token generate")
	189	+	c.subject = "unknown"
189	190		}
190	191		c.mu.Lock()
191	192		defer c.mu.Unlock()

 // bearerToken returns the token to use in Authorization headers.
 // It exchanges the long-lived token for an ephemeral one via /auth/token.
+// If subject extraction failed, uses "unknown" — the server validates everything.
 func (c *Client) bearerToken(ctx context.Context) (string, error) {
 	if c.token == "" {
 		return "", nil
 	}
 	if c.subject == "" {
-		return "", fmt.Errorf("invalid token: could not extract subject from JWT; regenerate with: gordon auth token generate")
+		c.subject = "unknown"
 	}
 	c.mu.Lock()
 	defer c.mu.Unlock()