fix: Add JWT signature validation for OAuth connectors

[rodageve]

Summary

Introduces cryptographic JWT token verification for the Google Drive, OneDrive, and SharePoint OAuth connectors. A new src/utils/jwt_verification.py utility validates tokens against their respective JWKS endpoints following Microsoft's documented multi-tenant token validation algorithm (RFC 7519 / RFC 8725 / Microsoft identity platform docs). OAuth connections that return a token with an invalid signature, expired expiry, or mismatched issuer are now rejected at the point of token acquisition rather than silently passed through.

---

Motivation

IBM security compliance requires cryptographic verification of OAuth tokens received from external identity providers (Microsoft Entra ID, Google). Previously, tokens obtained via MSAL and Google OAuth were accepted without any signature or claims validation.

---

Changes

src/utils/jwt_verification.py (new file)

• TTL-cached JWKS fetcher (1 h, per-URL keyed)
• verify_google_id_token() — RS256 signature, expiry, audience, issuer hardcoded to accounts.google.com
• verify_microsoft_access_token() — implements Microsoft's documented algorithm:
  • Audience-aware pass-through: tokens whose aud is a resource we don't own (e.g. MS Graph 00000003-…) are not signature-verified — per MS docs "you can't validate tokens for Microsoft Graph". Full verification only applies when aud == MICROSOFT_GRAPH_OAUTH_CLIENT_ID
  • v1/v2 JWKS endpoint selection: v1 tokens (iss = sts.windows.net/…) use /discovery/keys; v2 tokens use /discovery/v2.0/keys
  • Signing-key issuer validation: reads the issuer property from the matched key entry in the JWKS document, substitutes the {tenantid} placeholder with the token's tid, requires exact match against iss — per Microsoft's published pseudo-code
  • Tenant allow-list (off by default): when MICROSOFT_ALLOWED_TENANT_IDS is set, the verified tid must be in the list
• Structured exception hierarchy: JWTVerificationError, InvalidSignatureError, ExpiredTokenError, InvalidAudienceError, InvalidIssuerError

src/connectors/google_drive/oauth.py

• _verify_id_token() raises on failure instead of silently returning None
• Verification applied at load_credentials() and at handle_authorization_callback() — connection rejected before credentials are persisted

src/connectors/sharepoint/oauth.py and src/connectors/onedrive/oauth.py

• _verify_access_token() raises on failure across all token acquisition paths (get_access_token, get_access_token_for_resource)
• Passes MICROSOFT_ALLOWED_TENANT_IDS through to the verification function

src/utils/env_utils.py — new get_env_set() helper (comma-separated env var → set[str] | None, None means unset/skip check)

src/config/settings.py — adds MICROSOFT_ALLOWED_TENANT_IDS = get_env_set("MICROSOFT_ALLOWED_TENANT_IDS")

src/tui/config_fields.py and src/tui/managers/env_manager.py — surfaces MICROSOFT_ALLOWED_TENANT_IDS in the TUI wizard with descriptive helper text

---

Security compliance

Requirement | Implementation -- | -- Signature (RFC 7519 §7.2) | RS256 checked via JWKS public key for tokens issued to our app Algorithm enforcement (RFC 8725 §3.1) | algorithms=["RS256"] — no algorithm confusion Expiry (RFC 7519 §4.1.4) | verify_exp=True Audience (RFC 7519 §4.1.3) | Enforced for aud == client_id; correctly skipped for resource tokens per MS docs Issuer (RFC 8725 §3.6 + MS docs) | Signing-key issuer substitution + exact match; tid cross-checked against iss URL Tenant isolation (business policy) | Optional MICROSOFT_ALLOWED_TENANT_IDS allow-list, enforced post-signature on the verified tid Google issuer pinning | Hardcoded to accounts.google.com

---

Behaviour changes

No breaking change for existing deployments. MS Graph access tokens (the majority of MSAL-issued tokens in this flow) have aud = 00000003-0000-0000-c000-000000000000 and are passed through per the Microsoft docs. MICROSOFT_ALLOWED_TENANT_IDS is unset by default.

Failure mode change: a token that previously produced a warning log and was silently returned now raises JWTVerificationError, propagating as a 401 at the API layer. This is the intended behaviour.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 33371034-8551-4035-b8b9-0bf18f90562d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch jwt-validation-cpd

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Build successful! ✅
Deploying docs draft.
Deploy successful! View draft

[edwinjosechittilappilly]

LGTM