chore: identify the gateway with a User-Agent header on requests to Twingate

[minhtule]

Related Tickets & Documents

• Issue:

Changes

• Send User-Agent: Twingate-Gateway/<version> on requests to Twingate (Twingate hostname resolution and the JWKS fetch).

Notes

• version.Version is dev in local builds and set via ldflags by goreleaser, so released builds report the real version.

[Copilot]

Pull request overview

This PR introduces a shared mechanism for identifying the gateway via an outbound User-Agent: Twingate-Gateway/<version> header, and wires it into the two places the gateway makes HTTP requests to Twingate (hostname resolution and JWKS fetch for JWT verification).

Changes:

• Added internal/util/useragent helper (string + http.RoundTripper wrapper) to stamp the gateway User-Agent onto outbound requests.
• Updated Twingate hostname resolution HTTP client to use the User-Agent transport.
• Updated JWKS retrieval (keyfunc) to use a custom HTTP client transport so the User-Agent header is applied, and added tests to verify the header is sent.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
internal/util/useragent/useragent.go	New helper for generating the gateway User-Agent and applying it via a transport wrapper.
internal/util/useragent/useragent_test.go	Unit test validating the User-Agent string formatting.
internal/token/parser.go	JWKS client customization so keyfunc JWKS fetch includes the gateway User-Agent.
internal/token/parser_test.go	Test verifying JWKS endpoint receives the expected User-Agent.
internal/config/config.go	Hostname resolution HTTP client updated to use the User-Agent transport.
internal/config/config_test.go	Test verifying hostname resolution sends the expected User-Agent.

Suppressed comments (1)

internal/token/parser.go:40

• The override http.Client used for JWKS fetching should set a timeout to avoid hanging on network stalls. Without it, NewParser can block indefinitely while waiting for the initial JWKS fetch.

		jwks, err := keyfunc.NewDefaultOverrideCtx(context.Background(), []string{config.JWKSURL}, keyfunc.Override{
			Client: &http.Client{Transport: useragent.Transport{}},
		})
		if err != nil {

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Suppressed comments (1)

internal/config/config_test.go:127

• This select uses a default branch, so the assertion can be skipped if the request arrives slightly after the check. Waiting up to a short timeout makes the test deterministic while still failing quickly when no request is made.

		select {
		case userAgent := <-userAgents:
			assert.Equal(t, "Twingate-Gateway/dev", userAgent)
		default:
			t.Fatal("hostname resolution endpoint was not requested")

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.66%. Comparing base (56c122d) to head (089258e).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #459      +/-   ##
==========================================
+ Coverage   90.63%   90.66%   +0.03%     
==========================================
  Files          41       42       +1     
  Lines        2903     2915      +12     
==========================================
+ Hits         2631     2643      +12     
  Misses        177      177              
  Partials       95       95              

Flag	Coverage Δ
integration	57.87% <92.30%> (+0.07%)	⬆️
unit	85.86% <100.00%> (+0.23%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
internal/config/config.go	90.52% <100.00%> (+0.03%)	⬆️
internal/token/parser.go	91.30% <100.00%> (+0.82%)	⬆️
internal/util/useragent/useragent.go	100.00% <100.00%> (ø)

... and 2 files with indirect coverage changes

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.