From e2ff72fc48df0654cc1bf31abf072a506ac5acf0 Mon Sep 17 00:00:00 2001
From: ItalyPaleAle <43508+ItalyPaleAle@users.noreply.github.com>
Date: Sun, 9 Aug 2026 17:56:57 -0700
Subject: [PATCH] Sort hashes in-memory by created-at

---
 backend/internal/model/oidc.go | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/backend/internal/model/oidc.go b/backend/internal/model/oidc.go
index 5b037e39..ae674fa2 100644
--- a/backend/internal/model/oidc.go
+++ b/backend/internal/model/oidc.go
@@ -3,6 +3,7 @@ package model
 import (
 	"database/sql/driver"
 	"encoding/json"
+	"slices"
 	"time"
 
 	datatype "github.com/pocket-id/pocket-id/backend/internal/model/types"
@@ -151,6 +152,11 @@ func (occ OidcClientCredentials) ActiveSecrets() []OidcClientSecret {
 		}
 	}
 
+	// Sort the copy so the primary hash is always the most recently created active secret
+	slices.SortStableFunc(active, func(a, b OidcClientSecret) int {
+		return b.CreatedAt.ToTime().Compare(a.CreatedAt.ToTime())
+	})
+
 	return active
 }