feat(admin): JWT auth settings on the Security & Hardening page

[nmgarza5]

Description

Final PR of the JWT settings stack (on #14153): the admin UI for the DB-backed JWT auth settings.

• New "External JWT Authentication" card on Security & Hardening (single-tenant, like the page's other auth sections): Public Key URL, Expected Audience, Expected Issuer. Text fields commit on blur or Enter through the page's existing partial PUT, empty clears the override.
• GET /admin/security/pinned-fields tells the UI which fields an env var pins. A pinned field renders as static text with a "Pinned by an environment variable" note (an input promises editability), and the card renders only once the pinned state is known (fail closed).
• Save flow hardening that fell out of review: saves are serialized through a promise chain, only the last queued save adopts the server response, the optimistic patch applies at enqueue, and fields commit only user-typed text (focus and dirty guards). Applies to the whole page, closes a pre-existing out-of-order-response race.

with JWT_EXPECTED_AUDIENCE env-pinned (static text, no input):

How Has This Been Tested?

• Live in a real browser against an isolated scratch stack: card renders, saves land with the success toast, an SSRF-blocked URL surfaces the backend INVALID_INPUT toast and reverts, an env-pinned audience renders as static text with the env value winning, and lifting the pin shows the seeded value editable (the retirement path).
• Pinned-fields endpoint test added to the external-dependency suite; 32 security unit tests pass; tsc and ty clean.

Additional Options

• [Optional] Please cherry-pick this PR to the latest release version.
• [Optional] Override Linear Check

[github-actions]

Preview Deployment

Status	Preview	Commit	Updated
✅	https://onyx-preview-ei82ngnp8-danswer.vercel.app	0643c88	2026-08-22 00:24:03 UTC

[greptile-apps]

Greptile Summary

This PR adds administrator controls for database-backed external JWT authentication settings, including environment-variable pin detection and serialized optimistic saves.

• Adds an admin-only endpoint exposing environment-pinned security fields.
• Adds editable or read-only JWT URL, audience, and issuer controls to Security & Hardening.
• Serializes security-setting updates and prevents intermediate responses from overwriting newer optimistic edits.
• Adds the pinned-fields SWR key and backend endpoint coverage.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
backend/onyx/server/security/api.py	Adds a permission-protected endpoint returning the active environment-pinned security fields.
backend/tests/external_dependency_unit/server/security/test_security_settings_put.py	Verifies that the pinned-fields endpoint reflects environment-backed JWT configuration.
web/src/lib/swr-keys.ts	Registers the pinned-fields endpoint in the centralized SWR key registry.
web/src/views/admin/SecurityHardeningPage.tsx	Adds fail-closed JWT settings controls and serializes optimistic security-setting saves without leaving the previously reported editable-pinned-field failure reachable.

_{Reviews (3): Last reviewed commit: "feat(admin): render pinned JWT fields as..." | Re-trigger Greptile}

[nmgarza5]

@greptile

[nmgarza5]

@greptile

[github-actions]

Full-stack Preview (frontend + backend)

Status	Preview	Commit	Updated
✅	https://0643c88-onyx.preview.onyxcorp.dev/	0643c88	2026-08-22 00:22:34 UTC

Sign in with GitHub as an onyx-dot-app member to view it.