From 1e65dda440cf2f7a5b190e4822b5408923972b5e Mon Sep 17 00:00:00 2001
From: Maksim Nabokikh <maksim.nabokikh@flant.com>
Date: Tue, 17 Mar 2026 14:13:27 +0100
Subject: [PATCH] fix(localSigner): simplify Algorithm method to always return
 RSA algorithm (#4655)

Signed-off-by: maksim.nabokikh <max.nabokih@gmail.com>
---
 server/signer/local.go      | 13 +++-----
 server/signer/local_test.go | 60 +++++++++++++++++++++++++++++++++++++
 2 files changed, 64 insertions(+), 9 deletions(-)
 create mode 100644 server/signer/local_test.go

diff --git a/server/signer/local.go b/server/signer/local.go
index a210aaa0..da9f99fb 100644
--- a/server/signer/local.go
+++ b/server/signer/local.go
@@ -105,13 +105,8 @@ func (l *localSigner) ValidationKeys(ctx context.Context) ([]*jose.JSONWebKey, e
 	return jwks, nil
 }
 
-func (l *localSigner) Algorithm(ctx context.Context) (jose.SignatureAlgorithm, error) {
-	keys, err := l.storage.GetKeys(ctx)
-	if err != nil {
-		return "", fmt.Errorf("failed to get keys: %v", err)
-	}
-	if keys.SigningKey == nil {
-		return "", fmt.Errorf("no signing key found")
-	}
-	return signatureAlgorithm(keys.SigningKey)
+func (l *localSigner) Algorithm(_ context.Context) (jose.SignatureAlgorithm, error) {
+	// Local signer always uses RSA keys (see rotationStrategy.key).
+	// TODO(nabokihms): add support for other key types and algorithms in the future.
+	return jose.RS256, nil
 }
diff --git a/server/signer/local_test.go b/server/signer/local_test.go
new file mode 100644
index 00000000..9e0f7e8d
--- /dev/null
+++ b/server/signer/local_test.go
@@ -0,0 +1,60 @@
+package signer
+
+import (
+	"context"
+	"log/slog"
+	"testing"
+	"time"
+
+	"github.com/go-jose/go-jose/v4"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/dexidp/dex/storage/memory"
+)
+
+func newTestLocalSigner(t *testing.T) *localSigner {
+	t.Helper()
+
+	logger := slog.New(slog.DiscardHandler)
+	s := memory.New(logger)
+	r := &keyRotator{
+		Storage:  s,
+		strategy: defaultRotationStrategy(time.Hour, time.Hour),
+		now:      time.Now,
+		logger:   logger,
+	}
+
+	return &localSigner{
+		storage: s,
+		rotator: r,
+		logger:  logger,
+	}
+}
+
+func TestLocalSignerAlgorithm(t *testing.T) {
+	ls := newTestLocalSigner(t)
+
+	// Algorithm should return RS256 even before keys are rotated (empty storage).
+	alg, err := ls.Algorithm(context.Background())
+	require.NoError(t, err)
+	assert.Equal(t, jose.RS256, alg)
+}
+
+func TestLocalSignerSignAndValidate(t *testing.T) {
+	ls := newTestLocalSigner(t)
+	ctx := context.Background()
+
+	// Rotate keys so we have a signing key.
+	require.NoError(t, ls.rotator.rotate())
+
+	payload := []byte(`{"sub":"test-user"}`)
+	signed, err := ls.Sign(ctx, payload)
+	require.NoError(t, err)
+	assert.NotEmpty(t, signed)
+
+	// Validation keys should be available.
+	keys, err := ls.ValidationKeys(ctx)
+	require.NoError(t, err)
+	assert.NotEmpty(t, keys)
+}