Feat nxe phase

.gitmodules

@@ -4,3 +4,6 @@
 [submodule "nxe-jwx"]
 	path = nxe-jwx
 	url = https://github.com/kjdev/nxe-jwx.git
+[submodule "nxe-phase"]
+	path = nxe-phase
+	url = https://github.com/kjdev/nxe-phase.git

CHANGELOG.md

@@ -5,6 +5,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+### Dependencies
+
+- Add the `nxe-phase` submodule and register the PREACCESS/ACCESS phase handlers through `nxe_phase_add_handler()` (priority `NXE_PHASE_PRIO_JWT` = 200) instead of a direct `ngx_array_push()`. nginx's `ngx_http_init_phase_handlers()` walks each phase's handler array tail-to-head, so the previous direct push made this module's execution order relative to other same-phase modules (e.g. an httpsig or OAuth2 bearer-token module) depend on `--add-module` / `load_module` order rather than on `nginx.conf`. With `nxe-phase`, the order is fixed by the shared priority band regardless of build/load order.
+
 ## [0.14.2] - 2026-07-14
 
 ### Fixed

Dockerfile

@@ -32,6 +32,7 @@ COPY config /build/
 COPY src/ /build/src/
 COPY nxe-json/ /build/nxe-json/
 COPY nxe-jwx/ /build/nxe-jwx/
+COPY nxe-phase/ /build/nxe-phase/
 
 WORKDIR /build/nginx
 RUN sh -ex <<'EOS'

config

@@ -25,18 +25,30 @@ CFLAGS="$CFLAGS -DNXE_JWX_HAVE_HMAC"
 
 . "$nxe_jwx_dir/config.ngx"
 
+# --- submodule: nxe-phase ---
+nxe_phase_dir="$ngx_addon_dir/nxe-phase"
+nxe_phase_tag="auth_jwt"
+
+if [ ! -f "$nxe_phase_dir/config.ngx" ]; then
+    echo "$0: error: $nxe_phase_dir/config.ngx not found" >&2
+    exit 1
+fi
+
+. "$nxe_phase_dir/config.ngx"
+
 # --- module definition ---
 ngx_module_type=HTTP
-ngx_module_name=ngx_http_auth_jwt_module
-ngx_module_deps="$nxe_json_module_deps $nxe_jwx_module_deps"
-ngx_module_incs="$nxe_json_module_incs $nxe_jwx_module_incs"
+ngx_module_name="ngx_http_auth_jwt_module $nxe_phase_module_name"
+ngx_module_deps="$nxe_json_module_deps $nxe_jwx_module_deps $nxe_phase_module_deps"
+ngx_module_incs="$nxe_json_module_incs $nxe_jwx_module_incs $nxe_phase_module_incs"
 ngx_module_srcs="\
   $nxe_json_module_srcs \
   $nxe_jwx_module_srcs \
+  $nxe_phase_module_srcs \
   $ngx_addon_dir/src/ngx_auth_jwt_claims.c \
   $ngx_addon_dir/src/ngx_auth_jwt_field.c \
   $ngx_addon_dir/src/ngx_auth_jwt_operator.c \
   $ngx_addon_dir/src/ngx_http_auth_jwt_module.c"
-ngx_module_libs="$nxe_json_module_libs $nxe_jwx_module_libs -lssl"
+ngx_module_libs="$nxe_json_module_libs $nxe_jwx_module_libs $nxe_phase_module_libs -lssl"
 
 . auto/module

src/ngx_http_auth_jwt_module.c

@@ -3,6 +3,7 @@
 #include <ngx_http.h>
 
 #include <nxe_jwx.h>
+#include <nxe_phase.h>
 
 #include "ngx_auth_jwt_claims.h"
 #include "ngx_auth_jwt_field.h"
@@ -1493,22 +1494,21 @@ ngx_http_auth_jwt_pre_conf(ngx_conf_t *cf)
 static ngx_int_t
 ngx_http_auth_jwt_post_conf(ngx_conf_t *cf)
 {
-    ngx_http_handler_pt *handler;
-    ngx_http_core_main_conf_t *conf;
-
-    conf = ngx_http_conf_get_module_main_conf(cf, ngx_http_core_module);
-
-    handler = ngx_array_push(&conf->phases[NGX_HTTP_PREACCESS_PHASE].handlers);
-    if (handler == NULL) {
+    if (nxe_phase_add_handler(cf, NGX_HTTP_PREACCESS_PHASE,
+                              NXE_PHASE_PRIO_JWT,
+                              ngx_http_auth_jwt_preaccess_handler,
+                              "auth_jwt") != NGX_OK)
+    {
         return NGX_ERROR;
     }
-    *handler = ngx_http_auth_jwt_preaccess_handler;
 
-    handler = ngx_array_push(&conf->phases[NGX_HTTP_ACCESS_PHASE].handlers);
-    if (handler == NULL) {
+    if (nxe_phase_add_handler(cf, NGX_HTTP_ACCESS_PHASE,
+                              NXE_PHASE_PRIO_JWT,
+                              ngx_http_auth_jwt_access_handler,
+                              "auth_jwt") != NGX_OK)
+    {
         return NGX_ERROR;
     }
-    *handler = ngx_http_auth_jwt_access_handler;
 
     return NGX_OK;
 }