feat(auth): move JWT auth settings to DB-backed security settings

[nmgarza5]

Description

Follow-up to #14151 (stacked on it): moves the JWT auth config off env vars and into the Security & Hardening settings, per the customer thread.

• Three nullable columns on security_settings (alembic e7c00417d1e5, verified up and down against a scratch Postgres).
• Precedence: env var if set (pin, UI writes refused with a clear error), else DB row, else off. Missing row and unset env is exactly today's behavior.
• The env pin is deliberate: infra keeps auth-gating values as config-as-code that an app-level admin compromise cannot flip.
• jwt.py and the users.py gate read get_security_settings(); the public-key fetch cache is keyed on the URL so runtime changes take effect.
• Idempotent startup seed mirrors set env values into the DB row (re-syncs on change so later env retirement keeps the last pinned value; overwrites are audited).
• Every settings change emits an audit event with actor and old/new per field.
• Frontend SecuritySettings type mirrors the new nullable fields. The admin UI itself is the next PR.

How Has This Been Tested?

• 76 unit tests across the security store/models, jwt claim enforcement, seed behavior (idempotency, re-sync, MT no-op, failure never blocks boot), and usage-credential identity.
• PUT pin-gate tests added to the external-dependency suite (runs in CI; its fixture wipes the live settings row so not run against the shared dev DB).
• Full alembic chain, upgrade and downgrade, against a scratch Postgres 15.2.
• ruff format, project-wide ty, and local Greptile (5/5, zero comments) clean.

Additional Options

• [Optional] Please cherry-pick this PR to the latest release version.
• [Optional] Override Linear Check

[greptile-apps]

Greptile Summary

The PR moves external JWT verification settings from environment-only configuration into DB-backed security settings while retaining environment precedence.

• Adds nullable JWT URL, audience, and issuer columns with matching backend and frontend models.
• Adds environment seeding, write restrictions for pinned fields, and security-setting audit events.
• Reads effective JWT settings at request time and keys the public-key cache by URL.
• Hardens database-configured key retrieval with SSRF-policy propagation, per-hop HTTPS validation, and resolved-IP pinning.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
backend/onyx/auth/jwt.py	Loads effective JWT settings dynamically and safely fetches DB-origin verification keys under the configured SSRF policy.
backend/onyx/utils/url.py	Adds resolved-IP connection pinning and preserves HTTPS-only validation across every redirect hop.
backend/onyx/server/security/store.py	Implements environment precedence, startup seeding, write locking, persistence, and audit emission for JWT settings.
backend/onyx/server/security/api.py	Validates JWT key URLs, rejects writes to environment-pinned fields, and attaches the authenticated actor to audits.
backend/alembic/versions/e7c00417d1e5_add_jwt_auth_columns_to_security_.py	Adds and cleanly removes the three nullable JWT security-setting columns.
backend/onyx/server/security/models.py	Extends effective and override settings models with environment-pinned JWT fields.
backend/onyx/auth/users.py	Enables external JWT authentication from the current effective DB-backed settings.
web/src/lib/types.ts	Mirrors the nullable JWT security-setting fields in the frontend API type.

Sequence Diagram

sequenceDiagram
  participant Admin
  participant API as Security Settings API
  participant DB as security_settings
  participant Auth as JWT Authentication
  participant Guard as SSRF URL Guard
  participant IdP as IdP Key Endpoint

  Admin->>API: PUT JWT settings
  API->>API: Reject environment-pinned fields
  API->>Guard: Validate DB-configured key URL
  API->>DB: Store settings and audit changes
  Auth->>DB: Load effective security settings
  alt URL pinned by environment
    Auth->>IdP: Fetch operator-controlled URL
  else URL stored in database
    Auth->>Guard: Validate URL and SSRF policy
    Guard->>IdP: HTTPS fetch to validated IP
  end
  IdP-->>Auth: PEM or JWKS
  Auth->>Auth: Verify signature, audience, and issuer

Loading

_{Reviews (8): Last reviewed commit: "fix(security): hold https_only across ev..." | Re-trigger Greptile}

[github-actions]

Preview Deployment

Status	Preview	Commit	Updated
✅	https://onyx-preview-euao0nz29-danswer.vercel.app	f9eaf61	2026-08-22 00:06:56 UTC

[nmgarza5]

@greptile

[nmgarza5]

@greptile

[nmgarza5]

@greptile

[nmgarza5]

@greptile

[nmgarza5]

@greptile

[github-actions]

Full-stack Preview (frontend + backend)

Status	Preview	Commit	Updated
✅	https://9bcec51-onyx.preview.onyxcorp.dev/	9bcec51	2026-08-22 00:22:28 UTC

Sign in with GitHub as an onyx-dot-app member to view it.

[nmgarza5]

@greptile

[nmgarza5]

@greptile

[github-actions]

🖼️ Visual Regression Report

Project	Changed	Added	Removed	Unchanged	Report
admin	10	0	0	177	View Report
exclusive	0	0	0	10	✅ No changes