From 39336146b892297e57f1add3d829f68091003a34 Mon Sep 17 00:00:00 2001
From: jakeaturner <jturner@cosmistack.com>
Date: Thu, 24 Sep 2026 16:01:18 -0700
Subject: [PATCH] fix(EventSubscribers): ensure signature loaded for signing

---
 server/controllers/EventSubscriberController.ts | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/server/controllers/EventSubscriberController.ts b/server/controllers/EventSubscriberController.ts
index 51671e0..f59a1cc 100644
--- a/server/controllers/EventSubscriberController.ts
+++ b/server/controllers/EventSubscriberController.ts
@@ -105,7 +105,12 @@ export class EventSubscriberController {
   ): Promise<EventSubscriber[]> {
     try {
       const columnName = this.getColumnName(event);
-      const eventSubscribers = await EventSubscriber.findAll({
+      // unscoped: the DefaultScope on this model excludes signing_key, and
+      // signAndSend needs it to sign deliveries. Without this the key reads back
+      // as undefined and jose signs HS256 with zero bytes, producing tokens no
+      // subscriber can verify. Safe to unscope here because the only caller is
+      // EventSubscriberEmitter, so the key never reaches an API response.
+      const eventSubscribers = await EventSubscriber.unscoped().findAll({
         include: [
           {
             model: EventSubscriberEventConfig,