From 8063ae18a8f0ed2ff09ddede789fa26ae156021e Mon Sep 17 00:00:00 2001
From: Noste <83548733+Noooste@users.noreply.github.com>
Date: Fri, 26 Dec 2025 15:42:08 +0100
Subject: [PATCH] feat: enhance Ed25519 private key parsing to support PKCS#8
 format

Signed-off-by: Noste <83548733+Noooste@users.noreply.github.com>
---
 backend/internal/auth/jwt.go | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/backend/internal/auth/jwt.go b/backend/internal/auth/jwt.go
index 79cd982..c19ccee 100644
--- a/backend/internal/auth/jwt.go
+++ b/backend/internal/auth/jwt.go
@@ -3,6 +3,7 @@ package auth
 import (
 	"crypto/ed25519"
 	"crypto/rand"
+	"crypto/x509"
 	"encoding/base64"
 	"encoding/pem"
 	"fmt"
@@ -76,12 +77,22 @@ func parseEd25519PrivateKeyFromPEM(privateKeyPEM string) (ed25519.PrivateKey, er
 		return nil, fmt.Errorf("failed to decode PEM block")
 	}
 
-	// Check if it's raw Ed25519 private key bytes (64 bytes)
-	if len(block.Bytes) == ed25519.PrivateKeySize {
-		return ed25519.PrivateKey(block.Bytes), nil
+	// Try to parse as PKCS#8 format (standard format from openssl genpkey -algorithm ED25519)
+	key, err := x509.ParsePKCS8PrivateKey(block.Bytes)
+	if err == nil {
+		// Successfully parsed as PKCS#8, check if it's an Ed25519 key
+		if ed25519Key, ok := key.(ed25519.PrivateKey); ok {
+			return ed25519Key, nil
+		}
+		return nil, fmt.Errorf("PKCS#8 key is not an Ed25519 key")
 	}
 
-	return nil, fmt.Errorf("invalid Ed25519 private key format: expected %d bytes, got %d",
+	// Fallback: Check if it's raw Ed25519 private key bytes (64 bytes)
+	if len(block.Bytes) == ed25519.PrivateKeySize {
+		return block.Bytes, nil
+	}
+
+	return nil, fmt.Errorf("invalid Ed25519 private key format: not PKCS#8 and not raw %d bytes (got %d bytes)",
 		ed25519.PrivateKeySize, len(block.Bytes))
 }