[MichaelGrafnetter]

The client_applications resource (GET /oauth2/v1/clients) validates each OAuth client with the ClientApplication model, whose nested JWK required kid. The kid member is optional in RFC 7517, and Okta accepts keys registered through the Apps API or dynamic client registration without one, returning them with kid: null. Validation then failed and DLT discarded the whole client row, not just the key. Because client_role_assignments is fed from this resource, a service client affected this way also lost all of its direct admin role assignments in the graph.

kid is now optional on the client application JWK model, matching the JWK model in models/application.py that actually produces Okta_JWK nodes. Nothing reads jwks from ClientApplication.

Summary by CodeRabbit

• Bug Fixes
  • Private-key JWT OAuth clients can now use JWKS keys without a key ID.
  • JWKS keys with a null or missing key ID are handled correctly while preserving client details.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: a8989341-7b8b-449f-aa2c-8b869a70a829

📥 Commits

Reviewing files that changed from the base of the PR and between 68eb714 and 4d449e6.

📒 Files selected for processing: 2

• src/openhound_okta/models/client_apps.py
• tests/test_application_jwk.py

Included review availability: This review used your included allowance. 2 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

Walkthrough

The JWK model now allows kid to be absent. A regression test checks that client validation accepts JWKS keys with a null or missing kid.

Changes

Optional JWK Key IDs

Layer / File(s)	Summary
JWK key ID model and validation src/openhound_okta/models/client_apps.py, tests/test_application_jwk.py	JWK.kid now defaults to None. The regression test checks that client validation accepts keys with a null or absent kid and preserves the client ID.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~6 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 4d449

No actionable merge-blocking issue is identified; the change is ready for normal checks.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: allowing null kid values in embedded JWKs.
Docstring Coverage		Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{A rabbit checks each key with care,
Some have no kid to declare.
The model lets those keys pass through,
The tests confirm the null ones too.
The client ID stays in view.}

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

🟢 Approval recommended

The narrowly scoped model change covers both reported validation cases with regression tests and has no identified blocking issues.

No open issues 🎉

What changed in this PR

Prevents OAuth clients with missing or null JWK identifiers from being rejected during collection, preserving downstream role assignments.

Changes:

• Makes the client application JWK kid field optional.
• Adds regression coverage for both null and absent kid values.

File	Description
tests/​test_application_jwk.py	Tests client validation with null and absent key identifiers.
src/​openhound_okta/​models/​client_apps.py	Allows kid to be omitted or null.

_{Review effort: Balanced}