Add JWKS Support

[yaroslav-ilin]

Summary

Disclaimer: I have no prior experience writing Haskell and most of this contribution is driven by AI.

Added support for JWKS (JWK Sets). JWK was already supported by the current version of postgres-websocket, although not very well documented. It works by specifying PGWS_JWT_SECRET=@/run/secrets/jwk.json. However this only supports single key right now. JWKS (multiple keys) is supported by the underlying jose library and this pull request extends its use in postgres-websocket. This change should make it compatible with PostgREST implementation which already supports JWKS with PGRST_JWT_SECRET=@/run/secrets/jwks.json.

It first tries to parse the secret as JWKS, then as single JWK object and then finally as HMAC fallback for backwards compatibility.

Changes

1. Claims.hs:

   • parseJWK → parseSecret: Now handles JWKSet, single JWK, and plain string secrets with fallback logic
   • jwtClaims signature: Accepts JWKSet for verification (supports automatic key selection by kid)
   • Added type annotation :: SignedJWT for jose-0.12 compatibility

2. postgres-websockets.cabal: Bumped jose from < 0.12 to < 0.13

3. cabal.project: New configuration file with constraints: ram < 0 (workaround for jose#138)

4. ClaimsSpec.hs: 3 new tests

   • Token validation with JWK secret
   • Token validation with JWKS secret
   • Rejection with wrong key in JWKS

Build & Test

# Prerequisites
brew install libpq ghcup
ghcup set ghc 9.6.7

# Build
cd postgres-websockets
PATH="/opt/homebrew/opt/libpq/bin:$PATH" cabal build --constraint='ram < 0'

# Test (Claims only, no DB required)
cabal test --constraint='ram < 0' -- --match "validate claims"

Result: All 10 tests pass (7 existing + 3 new JWKS tests)

[yaroslav-ilin]

Not sure if anyone has seen this PR so far. I'd like to understand if this is a move in the right direction. And let me know if Copilot reviews above need to be addressed.

[yaroslav-ilin]

Hello @diogob, any chance you can have a look at this any time soon?

[diogob]

Hi @yaroslav-ilin tahnks for the PR. Sorry, I missed the notification about this PR and just saw it now. I'll take a look tomorrow. Don't worry about the co-pilot review, I believe github enabled this feature by default without my consent.

[diogob]

Thanks again for the PR @yaroslav-ilin . Will prepare a release later this week.

[yaroslav-ilin]

Thanks 🎉 Regarding Copilot it's probably a setting on my side 😊