Repository navigation
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Prepare this service to verify Identity RS256 access tokens through its dedicated JWKS endpoint while retaining the dev Auth0 and machine issuers. Pin tc-core-library-js 4.0.0-rc.4 at immutable commit
c7c8fab502b7152dd06b1ce46cdb703e0e13b357, update the lockfile, and add the proposed dev policy and rollout notes.Allow public-key-only operation without AUTH_SECRET and pass explicit issuer policies through the validated configuration. Keep temporary HMAC policies explicit and time-limited.
Leave open: coordinate configuration before merging/deploying. The key and public settings are staged under
/config/identity-rs256-dev-staged/; running services do not consume them. This verifier removes implicit HMAC trust and enforces verified human identities and bounded token lifetimes. Any temporary HS256 issuer needs an explicit finite retirement deadline. Do not deploy this dependency change without its intended policy. Seedocs/identity-rs256-dev.md. Production configuration is outside this rollout.Validation: frozen dependency installation and service build passed. 51 focused authentication and policy tests, including RSA without a shared secret and forged-HMAC rejection; changed TypeScript ESLint passed. The shared verifier passed 47 tests and lint separately. Live RS256 activation and end-to-end login testing are deferred until the coordinated rollout.
Additional validation: 68 unit tests and 28 PostgreSQL integration tests passed. Authentication fixtures now use explicit time-limited HMAC policies, separate RSA issuers where applicable, and valid issued-at/verified-email claims.