Repository navigation
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Human JWTs obtained directly from Auth0 must not authenticate without email verification. Pin the shared v4 verifier to immutable commit
c2df92b2227089909ab6e229df0ec6b658bb431a, rejecting missing, false, malformed, and conflicting verification claims. Public endpoints remain available without authentication, and genuine client-credentials grants remain supported.Depends on topcoder-platform/tc-core-library-js#10. This uses the v4 rc.2-compatible security backport (
4.0.0-rc.2.1), preserving this service's existing issuer/audience policy. Package, lockfile, and workspace overrides are updated together. Valid-user JWT test fixtures now explicitly include email verification.Validation: frozen lockfile/install-plan validation passed; tarball checksums match the downloaded release. The shared backport passes all 33 tests and ESLint. Service validation passed: the complete unit suite (71 tests), including HTTP rejection for missing, false, and string verification claims. The full service suite was not run unless stated above.
Rollout: verified-member token issuance and the identity/accounts companion PRs must precede enforcement. Older human tokens missing verification require fresh login. No deployment is performed by this PR.