http-api: T8989: address Copilot review comments

- Remove fallback 'oidc-client' identity - tokens without sub/client_id
  are now rejected
- Suppress OIDC validation error details from stdout
- Cache discovered JWKS URI back to session to avoid per-request discovery
- token_op now accepts X-API-Key header alongside form field
- Reset REST/OIDC session attributes on SIGHUP reload to prevent stale
  config persisting after nodes are removed

3 files changed, 12 insertions, 5 deletions

diff --git a/src/services/api/rest/libs/token_auth.py b/src/services/api/rest/libs/token_auth.py
index ea0b14a9c..e0710cc20 100644
--- a/src/services/api/rest/libs/token_auth.py
+++ b/src/services/api/rest/libs/token_auth.py
@@ -46,6 +46,7 @@ def verify_oidc_token(token: str):
             disc_url = f"{state.oidc_issuer}/.well-known/openid-configuration"
             with _req.urlopen(disc_url, timeout=10) as r:
                 jwks_uri = _json.loads(r.read())["jwks_uri"]
+            state.oidc_jwks_uri = jwks_uri
         jwks_client = PyJWKClient(jwks_uri, cache_keys=True)
         signing_key = jwks_client.get_signing_key_from_jwt(token)
         decode_options = {"require": ["exp"]}
@@ -60,9 +61,8 @@ def verify_oidc_token(token: str):
         else:
             decode_options["verify_aud"] = False
         payload = jwt.decode(token, signing_key.key, **decode_kwargs)
-        return payload.get("sub") or payload.get("client_id") or "oidc-client"
-    except Exception as e:
-        print(f"OIDC token validation failed: {e}", flush=True)
+        return payload.get("sub") or payload.get("client_id")
+    except Exception:
         return None
 
 
diff --git a/src/services/api/rest/routers.py b/src/services/api/rest/routers.py
index 0f0662327..1808e5a5b 100644
--- a/src/services/api/rest/routers.py
+++ b/src/services/api/rest/routers.py
@@ -1046,9 +1046,10 @@ def traceroute_op(data: TracerouteModel):
 
 
 @router.post('/token')
-def token_op(data: ApiModel):
+def token_op(data: ApiModel, x_api_key: Optional[str] = Header(None)):
     session = SessionState()
-    key_id = check_auth(session.keys, data.key)
+    key = data.key or x_api_key
+    key_id = check_auth(session.keys, key)
     if not key_id:
         raise HTTPException(status_code=401, detail='Valid API key is required')
     return success(generate_token(key_id))
diff --git a/src/services/vyos-http-api-server b/src/services/vyos-http-api-server
index 64ac57499..6a420f499 100755
--- a/src/services/vyos-http-api-server
+++ b/src/services/vyos-http-api-server
@@ -182,6 +182,12 @@ def initialization(session: SessionState, app: FastAPI = app):
         session.keys = flatten_keys(server_config)
 
     rest_config = server_config.get('rest', {})
+    # Reset REST auth settings on reload so removed config nodes don't persist in-memory
+    session.rest_token_exp = None
+    session.rest_secret_len = None
+    session.oidc_issuer = None
+    session.oidc_jwks_uri = None
+    session.oidc_audience = None
     session.debug = bool('debug' in rest_config)
     session.strict = bool('strict' in rest_config)
     if isinstance(rest_config, dict):