fix: empty or malformed JWTs now produce a zero expiration without dereferencing a nil token

[oliverbaehler]

Reported via #1095

[Copilot]

Pull request overview

This PR improves robustness around bearer token handling by preventing nil dereferences during JWT expiration parsing and by adding a fast-path for in-memory bearer tokens when no token file is configured.

Changes:

• Avoids nil dereferences in bearerExpirationTime by checking parse errors / nil tokens and validating claim types.
• Updates BearerToken() to return the configured in-memory token when bearerTokenFile is empty.
• Fixes the --allowed-paths flag to populate allowedPaths (instead of an unrelated variable) and removes the unused variable.

Reviewed changes

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

File	Description
main.go	Fixes CLI flag wiring for --allowed-paths and removes an unused slice variable.
internal/webserver/webserver.go	Hardens JWT expiration parsing and adjusts bearer token retrieval behavior (file vs in-memory).

Suppressed comments (1)

internal/webserver/webserver.go:839

• bearerExpirationTime can still panic when the JWT is missing an exp claim (or it is null) because claims["exp"].(type) will type-assert on a nil interface. Also, when exp is absent/invalid the current code falls back to mil=0 and returns time.Unix(0,0) (1970-01-01) instead of a zero time.Time{} as intended by the PR.

	var mil int64

	switch iat := claims["exp"].(type) {
	case float64:
		mil = int64(iat)

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Svarrogh1337]

Lgtm