{"repo":"NousResearch/hermes-agent","public_id":"47815","display_label":"OIDC JWT clock-skew leeway for dashboard auth","summary":"These items address the lack of clock-skew tolerance in JWT/ID token verification for self-hosted OIDC dashboard authentication, covering the bug report, a fix, and a configurable leeway option.","subsystem":"dashboard","counts":{"members":3,"open_issues":0,"open_issues_distinct":0,"open_prs":0,"closed_issues":1,"merged_prs":1,"attempt_prs":1},"landed_fix":{"status":"merged_to_main","basis":"structural","pr":133873,"merged_at":"2026-10-06T15:14:29+00:00"},"resolution":{"state":"resolved","by":"pr-133873"},"freshness":{"state":"verified","last_verified_at":"2026-10-06T15:14:29+00:00","is_stale":false},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":0.6666666666666666},"fix_edges":[{"issue_number":47815,"pr_number":133873,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-10-06T15:14:29+00:00"}],"members":[{"kind":"issue","number":47815,"title":"Self-hosted OIDC dashboard auth: ID token verification has no clock-skew leeway (jwt.decode leeway=0)","url":null,"state":"closed"},{"kind":"pr","number":47816,"title":"feat(dashboard-auth): configurable id_token_leeway for self-hosted OIDC","url":null,"state":"closed","close_reason":{"category":"superseded_by_pr","implication":"superseded"},"merged":false},{"kind":"pr","number":133873,"title":"fix(dashboard-auth): clock-skew leeway for JWT verification; classify not-yet-valid tokens as validation failures","url":null,"state":"merged","close_reason":{"category":"merged"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["plugins/dashboard_auth/_shared.py","plugins/dashboard_auth/nous/__init__.py","plugins/dashboard_auth/self_hosted/__init__.py","tests/plugins/dashboard_auth/test_jwt_clock_skew_leeway.py","tests/plugins/dashboard_auth/test_nous_provider.py","tests/plugins/dashboard_auth/test_self_hosted_provider.py","website/docs/user-guide/features/web-dashboard.md"]}],"trust":{"default_tier":"verified","includes_suggested":false}}