Syk/only one jwk at a time

[itsoyou]

SYN-117

rendered

---

Note

Medium Risk
Stricter config validation can break deployments that previously set multiple JWK options; behavior is clearer but may require config cleanup on upgrade.

Overview
Enforces mutually exclusive JWK configuration so deployers cannot specify overlapping key sources that were previously ambiguous.

Runtime validation in EPaConfig and JwtValidationConfig now requires exactly one of: inline JWK/JWKSet, PEM file path, or JWKS URL. Setting two or more (e.g. jwk_set plus jwks_endpoint, or enc_jwk plus enc_jwk_file) raises a ValidationError at startup instead of silently picking one path.

Documentation in README.md is reorganized (JWT/OIDC/ePA sections, shared “Types” for validators/paths/auth) and states these exclusivity rules explicitly, including new JwtConfig / OIDCConfig tables and check_external_id on OAuth.

Tests cover invalid combinations for ePA encryption keys and signing/JWKS sources.

^{Reviewed by Cursor Bugbot for commit 95c433a. Bugbot is set up for automated code reviews on this repo. Configure here.}

[codecov]

Codecov Report

❌ Patch coverage is 68.75000% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 77.26%. Comparing base (75ea954) to head (62451f5).

Files with missing lines	Patch %	Lines
synapse_token_authenticator/config/epa.py	70.00%	2 Missing and 1 partial ⚠️
synapse_token_authenticator/config/oauth.py	66.66%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #102      +/-   ##
==========================================
- Coverage   77.71%   77.26%   -0.46%     
==========================================
  Files          13       13              
  Lines         875      884       +9     
  Branches      157      160       +3     
==========================================
+ Hits          680      683       +3     
- Misses        123      126       +3     
- Partials       72       75       +3     

Files with missing lines	Coverage Δ
synapse_token_authenticator/config/oauth.py	81.81% <66.66%> (-1.36%)	⬇️
synapse_token_authenticator/config/epa.py	72.41% <70.00%> (-2.90%)	⬇️

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 75ea954...62451f5. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[itsoyou]

I will scope out the Docs change that is unrelated to jwk/enc_jwk topic into separate PR.

[FrenchGithubUser]

looks good to me, might want to squash before merging :)

The base branch was changed.