feat: Add optional jwt_issuer option for session token validation - #725

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

Greptile Summary

Adds optional issuer validation for session access tokens while preserving existing behavior when no issuer is configured.

• Exposes jwt_issuer on synchronous and asynchronous clients, with support for one issuer or a sequence.
• Parses WORKOS_ISSUER as a trimmed comma-separated fallback.
• Applies issuer checks consistently during authentication and token refresh.
• Documents the configuration and tests authentication and refresh behavior for both client implementations.

Confidence Score: 5/5

The PR appears safe to merge; issuer validation is consistently applied and the previously missing refresh coverage has been added.

No actionable new failures or repository-rule violations remain. The previous refresh-testing finding is fully addressed with matching and mismatched issuer tests for both synchronous and asynchronous refresh paths.

Important Files Changed

%%{init: {'theme': 'neutral'}}%%
flowchart LR
    A[Client configuration] --> B{jwt_issuer provided?}
    B -->|Yes| C[Use configured issuer or sequence]
    B -->|No| D{WORKOS_ISSUER set?}
    D -->|Yes| E[Parse comma-separated issuers]
    D -->|No| F[Disable issuer validation]
    C --> G[Authenticate or refresh]
    E --> G
    F --> G
    G --> H[Verify signature, lifetime, and optional issuer]
    H -->|Valid| I[Return session success]
    H -->|Invalid| J[Return invalid JWT failure]

_{Reviews (2): Last reviewed commit: "Keep empty jwt_issuer lists and cover re..." | Re-trigger Greptile}