Repository navigation
Reject unverified member login and session issuance - #61
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Unverified members can currently pass Auth0 password authentication, and callback/RS256 refresh flows can issue sessions without checking persisted activation. Reject those logins with HTTP 403 and
EMAIL_VERIFICATION_REQUIREDunless the account is active and its primary email is verified.Apply verification before authorization-cache writes, cookies, last-login updates, and SSO/session issuance. Require explicit verification on Auth0 tokens exchanged for local JWTs, and include
emailVerified: trueon locally issued member JWTs only after database validation. The Auth0 profile endpoint retains activation/resend proofs for unverified members but no longer creates an SSO token for them.Pin the fixed v4 rc.2-compatible verifier (
c2df92b2227089909ab6e229df0ec6b658bb431a) and lockfile from topcoder-platform/tc-core-library-js#10. Browser handling is in topcoder-platform/tc-auth-lib#375; Platform UI has a companion session gate.Validation: 72 focused tests pass across AuthorizationService, password authentication, Auth0 profiles, and SSO issuance. Build and changed-file ESLint pass. Rejection tests check that no cookies, cached authorization, last-login updates, or SSO tokens are issued. Verified login and activation-proof behavior remain covered.
Known baseline limitations: the broader user/auth-flow suites have 53 failures on unchanged develop. A full TypeScript check also finds existing test typing errors; the production-only TypeScript check is blocked by the unchanged
ALL_USER_ROLESreference intopgear-user-roles.controller.ts. The normal SWC build passes. No live Auth0 tenant or database was used.Rollout: deploy verified-claim issuance and accounts handling before enforcing the new verifier across services. Auth0 must propagate the rejection code/message to show the activation page. Human tokens lacking verification will require fresh login. No deployment is included.