zeekayandHanzo Dev 415097f535 fix(kms): accept multiple white-label issuers (lux.id + hanzo.id) ...

KMS_EXPECTED_ISSUER now takes a comma-separated allowlist so one KMS can
serve several white-label brands that share IAM signing keys. The Lux-brand
KMS (kms.lux.network) must accept lux.id tokens — lux.cloud users carry
iss=https://lux.id — while still honoring hanzo.id. JWKS is unchanged
(fetched in-cluster; both brands sign with the same keys), so this is a pure
issuer-string allowlist: parse+dedupe, then validate membership after the
signature/expiry check. Backward compatible: a single-value
KMS_EXPECTED_ISSUER behaves exactly as before.

Deploy: KMS_EXPECTED_ISSUER=https://hanzo.id,https://lux.id on the Lux KMS.

Co-authored-by: Hanzo Dev <dev@hanzo.ai>

2026-07-14 10:15:00 -07:00

..

casibase-import

lux/kms: orphan history at f2e793bf8 (was: kms: wire luxfi/mpc as REK backend)

2026-06-07 14:28:09 -07:00

kms

fix(kms): accept multiple white-label issuers (lux.id + hanzo.id)

2026-07-14 10:15:00 -07:00

kms-operator

rebrand: neutralize legacy upstream brand across UI, backend, docs; add NOTICE

2026-06-24 11:19:41 -07:00

smoke-replay

lux/kms: orphan history at f2e793bf8 (was: kms: wire luxfi/mpc as REK backend)

2026-06-07 14:28:09 -07:00