From 15dbef17a0d22a39ebb616f2430c053fa0d3c6ea Mon Sep 17 00:00:00 2001
From: n4mlz <n4mlz.dev@gmail.com>
Date: Tue, 1 Sep 2026 11:24:19 +0900
Subject: [PATCH] =?UTF-8?q?:bug:=20Auth0=20issuer=20=E3=81=AE=E6=A4=9C?=
 =?UTF-8?q?=E8=A8=BC=E5=BD=A2=E5=BC=8F=E3=82=92=E4=BF=AE=E6=AD=A3?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 crates/presentation/src/auth.rs | 24 +++++++++++++++++++++---
 1 file changed, 21 insertions(+), 3 deletions(-)

diff --git a/crates/presentation/src/auth.rs b/crates/presentation/src/auth.rs
index a16df0fb..15a1b9e4 100644
--- a/crates/presentation/src/auth.rs
+++ b/crates/presentation/src/auth.rs
@@ -92,8 +92,8 @@ impl Authenticator {
         audience: String,
         dashboard_client_id: String,
     ) -> Self {
-        let issuer = issuer.trim_end_matches('/').to_owned();
-        let jwks_uri = format!("{issuer}/.well-known/jwks.json");
+        let issuer = format!("{}/", issuer.trim_end_matches('/'));
+        let jwks_uri = format!("{issuer}.well-known/jwks.json");
         Self {
             client,
             issuer,
@@ -230,7 +230,25 @@ fn principal_from_claims(
 
 #[cfg(test)]
 mod tests {
-    use super::{Claims, Principal, PrincipalKind, principal_from_claims};
+    use reqwest::Client;
+
+    use super::{Authenticator, Claims, Principal, PrincipalKind, principal_from_claims};
+
+    #[test]
+    fn normalizes_issuer_for_jwt_validation_and_jwks_lookup() {
+        let authenticator = Authenticator::new(
+            Client::new(),
+            "https://example.auth0.com".into(),
+            "https://api.example.com".into(),
+            "dashboard-client-id".into(),
+        );
+
+        assert_eq!(authenticator.issuer, "https://example.auth0.com/");
+        assert_eq!(
+            authenticator.jwks_uri,
+            "https://example.auth0.com/.well-known/jwks.json"
+        );
+    }
 
     #[test]
     fn converts_device_claims_to_device_principal() {