Repository navigation
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Human JWTs obtained directly from Auth0 must not authenticate without email verification. Pin the shared v4 verifier to immutable commit
c2df92b2227089909ab6e229df0ec6b658bb431a, rejecting missing, false, malformed, and conflicting verification claims. Public endpoints remain available without authentication, and genuine client-credentials grants remain supported.Depends on topcoder-platform/tc-core-library-js#10. This uses the v4 rc.2-compatible security backport (
4.0.0-rc.2.1), preserving this service's existing issuer/audience policy. Package, lockfile, and workspace overrides are updated together.Validation: frozen lockfile/install-plan validation passed; tarball checksums match the downloaded release. The shared backport passes all 33 tests and ESLint. Forums validation: 191 tests pass, with 13 database integration tests skipped. Valid member fixtures include verification, and missing, false, and string verification claims are explicitly rejected. Changed-file ESLint passes.
Rollout: verified-member token issuance and the identity/accounts companion PRs must precede enforcement. Older human tokens missing verification require fresh login. No deployment is performed by this PR.