Address remaining compliance portal review nits

Fill in certificate renewal processing, preserve OAuth and JWKS
edge cases, embed the compliance-portal app in production builds,
and close the smaller portal routing and n8n update gaps.

Signed-off-by: Bryan Frimin <bryan@probo.com>

pkg/crypto/jose/jose.go

@@ -121,14 +121,23 @@ func RSAPublicKeyFromJWK(jwk JWK) (*rsa.PublicKey, error) {
 		return nil, fmt.Errorf("cannot decode rsa exponent: %w", err)
 	}
 
+	e := new(big.Int).SetBytes(eBytes)
+	if !e.IsInt64() || e.Sign() <= 0 {
+		return nil, fmt.Errorf("cannot convert jwk to rsa public key: invalid rsa exponent")
+	}
+
 	return &rsa.PublicKey{
 		N: new(big.Int).SetBytes(nBytes),
-		E: int(new(big.Int).SetBytes(eBytes).Int64()),
+		E: int(e.Int64()),
 	}, nil
 }
 
 // PublicKeyFromJWKS returns the RSA public key matching the given key ID.
 func PublicKeyFromJWKS(jwks *JWKS, kid string) (*rsa.PublicKey, error) {
+	if jwks == nil {
+		return nil, fmt.Errorf("cannot find signing key %q in jwks: jwks is nil", kid)
+	}
+
 	for _, key := range jwks.Keys {
 		if key.KeyID == kid {
 			return RSAPublicKeyFromJWK(key)
@@ -181,6 +190,10 @@ func VerifyJWT(raw string, pubKey *rsa.PublicKey) ([]byte, error) {
 
 // VerifyJWTWithJWKS verifies an RS256 JWT using the matching key from a JWKS.
 func VerifyJWTWithJWKS(raw string, jwks *JWKS) ([]byte, error) {
+	if jwks == nil {
+		return nil, fmt.Errorf("cannot verify jwt: jwks is nil")
+	}
+
 	parts := strings.Split(raw, ".")
 	if len(parts) != 3 {
 		return nil, fmt.Errorf("cannot verify jwt: invalid format")

pkg/crypto/jose/jose_test.go

@@ -325,6 +325,21 @@ func TestRSAPublicKeyFromJWK(t *testing.T) {
 			require.Error(t, err)
 		},
 	)
+
+	t.Run(
+		"rejects invalid rsa exponent",
+		func(t *testing.T) {
+			t.Parallel()
+
+			invalidExponent := jwk
+			invalidExponent.E = base64.RawURLEncoding.EncodeToString(
+				new(big.Int).Lsh(big.NewInt(1), 128).Bytes(),
+			)
+
+			_, err := jose.RSAPublicKeyFromJWK(invalidExponent)
+			require.Error(t, err)
+		},
+	)
 }
 
 func TestPublicKeyFromJWKS(t *testing.T) {
@@ -358,6 +373,16 @@ func TestPublicKeyFromJWKS(t *testing.T) {
 			require.Error(t, err)
 		},
 	)
+
+	t.Run(
+		"errors when jwks is nil",
+		func(t *testing.T) {
+			t.Parallel()
+
+			_, err := jose.PublicKeyFromJWKS(nil, "kid-1")
+			require.Error(t, err)
+		},
+	)
 }
 
 func TestVerifyJWT(t *testing.T) {
@@ -559,4 +584,17 @@ func TestVerifyJWTWithJWKS(t *testing.T) {
 			require.Error(t, err)
 		},
 	)
+
+	t.Run(
+		"rejects nil jwks",
+		func(t *testing.T) {
+			t.Parallel()
+
+			token, err := jose.SignJWT(key, "kid-1", map[string]string{"sub": "test"})
+			require.NoError(t, err)
+
+			_, err = jose.VerifyJWTWithJWKS(token, nil)
+			require.Error(t, err)
+		},
+	)
 }