http-api: T8989: address Copilot review comments

- Remove fallback 'oidc-client' identity - tokens without sub/client_id
  are now rejected
- Suppress OIDC validation error details from stdout
- Cache discovered JWKS URI back to session to avoid per-request discovery
- token_op now accepts X-API-Key header alongside form field
- Reset REST/OIDC session attributes on SIGHUP reload to prevent stale
  config persisting after nodes are removed

1 files changed, 6 insertions, 0 deletions

diff --git a/src/services/vyos-http-api-server b/src/services/vyos-http-api-server
index 64ac57499..6a420f499 100755
--- a/src/services/vyos-http-api-server
+++ b/src/services/vyos-http-api-server
@@ -182,6 +182,12 @@ def initialization(session: SessionState, app: FastAPI = app):
         session.keys = flatten_keys(server_config)
 
     rest_config = server_config.get('rest', {})
+    # Reset REST auth settings on reload so removed config nodes don't persist in-memory
+    session.rest_token_exp = None
+    session.rest_secret_len = None
+    session.oidc_issuer = None
+    session.oidc_jwks_uri = None
+    session.oidc_audience = None
     session.debug = bool('debug' in rest_config)
     session.strict = bool('strict' in rest_config)
     if isinstance(rest_config, dict):