feat: refuse developer JWTs whose signer was disabled

[zer0stars]

Why

Disabling a license signer (API key) stops dex from minting new developer JWTs with it, but tokens it already minted keep exchanging for vehicle JWTs for their full 336 hours. The console's team feature needs a removed member cut off within about 10 minutes, the vehicle JWT lifetime. dex now stamps the signer on developer JWTs as signer_address (DIMO-Network/dex#332).

What

• /v1/tokens/exchange: checks every token with signer_address whose ethereum_address is a developer license (Identity), whatever its audience.
  • Before, tokens issued to the mobile client (aud dimo-driver) skipped the dev-license middleware, and the grant uses ethereum_address, so an audience-based check could be bypassed.
  • Disabled signer: 403 signer no longer authorized for this license.
  • Identity or chain failure: 503 could not verify signer.
  • Tokens without the claim (minted before dex set it, and every DIMO Mobile user's token) pass with no lookup at all, so the mobile path never touches Identity.
• licensesigner.Checker: Identity lookup, then isSigner(signer) on the license account (new abigen binding).
  • 60 s cache for positive and negative answers, bounded at 10,000 entries; errors not cached;
  • singleflight for concurrent misses;
  • 3 s timeout per call.
• gRPC SignerCheck(license, signer) → is_signer: shares that cache. It answers true for non-licenses, InvalidArgument for non-hex input, and Unavailable on errors.
• pkg/signercheck: shared by vehicle-triggers-api, tesla-oracle and credit-tracker. It holds SIGNER_CHECK_MODE (enforce|log|off), the signer_check_total{service,result} metric, the Fiber middleware, and a SignerCheck client with a 5 s deadline.
• SIGNER_CHECK_MODE: log in dev and prod values; production switches to enforce after a week.
• Alert SignerCheckErrors (error above 1% of non-skipped checks, allowed + denied + error, over 5 min) as a PrometheusRule.
• README documents settings, metric, alert and rollback.

Effect on existing developers

In enforce mode, disabling an API key ends its tokens within about a minute instead of two weeks.

Successor services

dauth and vt aren't live. If either ships, it needs the same check (use pkg/signercheck).

Tests

• pkg/signercheck: every mode and result, claimless tokens skipped without a check, malformed claims, metric counts, gRPC client with timeout.
• licensesigner: call shape, TTL for both answers, not-a-license cached, errors not cached, keyed, bounded, 3 s timeout, singleflight.
• TestSignerCheckOnExchange: mobile-audience token for a license is checked; for a non-license it passes.
• TestSignerCheck (gRPC).
• make generate is clean.

Merge order

Merge after DIMO-Network/dex#332. Merging deploys to dev in log mode, which refuses nothing. vehicle-triggers-api, tesla-oracle and credit-tracker import pkg/signercheck from this branch until it merges.

[zer0stars]

Final review change (9d1a6d8): with SIGNER_CLAIM_REQUIRED_AFTER set, a claimless token issued after it whose license lookup fails (Identity down or slower than 3 s) now passes and counts as error, instead of getting 503. Every mobile user's exchange is claimless and would need that lookup, so the old behavior turned an Identity outage into a mobile outage. Tokens that carry signer_address still fail closed (503 on errors). The README's settings table says so.

[zer0stars]

Superseding my earlier comment: SIGNER_CLAIM_REQUIRED_AFTER is dropped entirely (24b46c9). It only backstopped a hypothetical dex path that forgets the claim, and once set it would have made every claimless exchange, DIMO Mobile users' included, look up Identity. Tokens without signer_address are never checked and never looked up; tokens with it still fail closed (503 on errors). The fail-open change from 9d1a6d8 is gone with it.