fix(nip-fi): close F1 scheduling witness and remove empty_for_test()

Thufir pass-3 escalation items, addressed:

Item 1 — production scheduling loop witness.
Extract the inner JWKS refresh scheduling loop (sleep/due-selection +
run_jwks_refresh_step call) into run_jwks_refresh_loop<S>. The supervisor
inner task now calls this function directly; removing that call site breaks
the test. Add f1_supervisor_loop_drives_recovery_and_restores_admission
(start_paused Tokio time): spawns run_jwks_refresh_loop with a real
ProductionJwksSource<ToggleJwksFetcher>, drives warm → hard-dead → fast-retry
→ recovery, then asserts IssuerKeySource::key_set returns Some (admission
restored). Red on three mutations: (1) remove run_jwks_refresh_loop from
supervisor → cache never updates → None; (2) revert cadence logic to warm
interval → 6 s advance misses 300 s deadline → None; (3) stub
snapshot_available to false → cache never warms → None.

Item 2 — remove empty_for_test(); seal AssertionKeySet construction.
Change JwksRefreshSource::get_snapshot return type to bool
(snapshot_available). Production impl maps
ProductionJwksSource::get_snapshot(…).is_some(). Mocks return bool
directly — no AssertionKeySet construction needed outside buzz-auth.
Add ToggleJwksFetcher to buzz-auth behind cfg(any(test, feature="test-utils"))
and re-export it: the only path for downstream crates to build a
controllable ProductionJwksSource without implementing the sealed
JwksFetcher trait themselves. Delete empty_for_test() from AssertionKeySet.

Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>

Author: Hayt

crates/buzz-auth/src/lib.rs

@@ -61,6 +61,8 @@ pub use access::MockAccessChecker;
 #[cfg(any(test, feature = "test-utils"))]
 pub use nip98_replay::AlwaysFreshReplayGuard;
 #[cfg(any(test, feature = "test-utils"))]
+pub use nip_fi::ToggleJwksFetcher;
+#[cfg(any(test, feature = "test-utils"))]
 pub use rate_limit::AlwaysAllowRateLimiter;
 
 /// How the connection was authenticated.

crates/buzz-auth/src/nip_fi/jwks/mod.rs

@@ -734,5 +734,66 @@ impl<F> std::fmt::Debug for ProductionJwksSource<F> {
     }
 }
 
+/// A toggle-controlled [`JwksFetcher`] for use in downstream-crate integration
+/// tests. Returns a minimal but valid JWKS document when the toggle is `true`,
+/// and `NetworkError` when `false`.
+///
+/// This is the only path by which a crate outside `buzz-auth` can build a
+/// `ProductionJwksSource` with a controllable fetch outcome — `sealed::Sealed`
+/// is crate-private, so downstream crates cannot implement `JwksFetcher`
+/// directly. Because the returned JWKS is real (not a synthetic shortcut), the
+/// full `ProductionJwksSource` code path — parse, bound, cache, hard-deadline —
+/// exercises itself normally, and the resulting `AssertionKeySet` is valid for
+/// verifier lookups.
+///
+/// Only available with the `test-utils` feature enabled.
+#[cfg(any(test, feature = "test-utils"))]
+#[derive(Clone, Debug)]
+pub struct ToggleJwksFetcher {
+    /// When `true` the fetcher returns a minimal valid JWKS body; when `false`
+    /// it returns `JwksFetchError::NetworkError`.
+    pub available: std::sync::Arc<std::sync::atomic::AtomicBool>,
+}
+
+#[cfg(any(test, feature = "test-utils"))]
+impl ToggleJwksFetcher {
+    /// Construct a new `ToggleJwksFetcher`. Pass `initial` as the starting
+    /// availability state; the shared `available` flag can be flipped from the
+    /// test after construction.
+    pub fn new(initial: bool) -> Self {
+        Self {
+            available: std::sync::Arc::new(std::sync::atomic::AtomicBool::new(initial)),
+        }
+    }
+}
+
+#[cfg(any(test, feature = "test-utils"))]
+impl super::verifier::sealed::Sealed for ToggleJwksFetcher {}
+
+#[cfg(any(test, feature = "test-utils"))]
+impl JwksFetcher for ToggleJwksFetcher {
+    fn fetch_jwks<'a>(
+        &'a self,
+        _uri: &'a str,
+    ) -> impl std::future::Future<Output = Result<String, JwksFetchError>> + Send + 'a {
+        // A minimal P-256 JWK.  The coordinates are the same values used in
+        // buzz-auth's own test suite (tests.rs `minimal_jwks_json`).
+        const TOGGLE_JWKS: &str = concat!(
+            r#"{"keys":[{"kty":"EC","crv":"P-256","#,
+            r#""x":"f83OJ3D2xF1Bg8vub9tLe1gHMzV76e8Tus9uPHvRVEU","#,
+            r#""y":"x_FEzRu9m36HLN_tue659LNpXW6pCyStikYjKIWI5a0","#,
+            r#""use":"sig","alg":"ES256","kid":"toggle-kid"}]}"#
+        );
+        let available = self.available.load(std::sync::atomic::Ordering::SeqCst);
+        async move {
+            if available {
+                Ok(TOGGLE_JWKS.to_string())
+            } else {
+                Err(JwksFetchError::NetworkError)
+            }
+        }
+    }
+}
+
 #[cfg(test)]
 mod tests;

crates/buzz-auth/src/nip_fi/mod.rs

@@ -33,5 +33,8 @@ pub use jwks::{
     HttpJwksFetcher, IssuerJwksConfig, JwksFetchError, JwksFetcher, JwksSourceContract,
     ProductionJwksSource,
 };
+
+#[cfg(any(test, feature = "test-utils"))]
+pub use jwks::ToggleJwksFetcher;
 pub use startup::{validate_nip_fi_config, NipFiMode, NipFiStartupError};
 pub use verifier::{AssertionKeySet, FederatedAssertionVerifier, IssuerKeySource, VerifierError};

crates/buzz-auth/src/nip_fi/verifier.rs

@@ -143,46 +143,6 @@ impl AssertionKeySet {
     pub(crate) fn hard_deadline(&self) -> chrono::DateTime<chrono::Utc> {
         self.hard_deadline
     }
-
-    /// Construct a minimal `AssertionKeySet` for tests that only need a
-    /// `Some(_)` return from a mock source — the key material and issuer are
-    /// arbitrary and the set is not valid for actual token verification.
-    ///
-    /// Named `_for_test` to signal intent; not gated by `cfg(test)` so it is
-    /// visible to downstream crates' test builds.
-    #[doc(hidden)]
-    pub fn empty_for_test() -> Self {
-        use jsonwebtoken::jwk::{
-            AlgorithmParameters, EllipticCurve, Jwk, JwkSet, KeyAlgorithm, OctetKeyPairParameters,
-            OctetKeyPairType,
-        };
-        // A syntactically minimal OKP key — its x coordinate is not real key
-        // material, so this set cannot sign or verify any token. Only the
-        // `Some(_)` vs `None` distinction matters in cadence-state tests.
-        let jwk = Jwk {
-            common: jsonwebtoken::jwk::CommonParameters {
-                public_key_use: None,
-                key_operations: None,
-                key_algorithm: Some(KeyAlgorithm::EdDSA),
-                key_id: Some("test-kid".to_string()),
-                x509_url: None,
-                x509_chain: None,
-                x509_sha1_fingerprint: None,
-                x509_sha256_fingerprint: None,
-            },
-            algorithm: AlgorithmParameters::OctetKeyPair(OctetKeyPairParameters {
-                key_type: OctetKeyPairType::OctetKeyPair,
-                curve: EllipticCurve::Ed25519,
-                x: "11qYAYKxCrfVS_7TyWQHOg7hcvPapiMlrwIaaPcHURo".to_string(),
-            }),
-        };
-        Self {
-            issuer: "https://test.example".to_string(),
-            generation: 1,
-            jwks: JwkSet { keys: vec![jwk] },
-            hard_deadline: chrono::Utc::now() + chrono::Duration::hours(1),
-        }
-    }
 }
 
 impl fmt::Debug for AssertionKeySet {