Repository navigation
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Prepare this service to verify Identity RS256 access tokens through its dedicated JWKS endpoint while retaining the dev Auth0 and machine issuers. Pin tc-core-library-js 4.0.0-rc.4 at immutable commit
c7c8fab502b7152dd06b1ce46cdb703e0e13b357, update the lockfile, and add the proposed dev policy and rollout notes.Fix VALID_ISSUERS parsing for JSON arrays and prepare the isolated signing task role in the dev manifest. Apply deployment-role PassRole and the live task-role change together with the manifest. Publish the public key while retaining HS256 before coordinating the signing switch.
Leave open: coordinate configuration before merging/deploying. The key and public settings are staged under
/config/identity-rs256-dev-staged/; running services do not consume them. This verifier removes implicit HMAC trust and enforces verified human identities and bounded token lifetimes. Any temporary HS256 issuer needs an explicit finite retirement deadline. Do not deploy this dependency change without its intended policy. Seedocs/identity-rs256-dev.md. Production configuration is outside this rollout.Validation: frozen dependency installation and service build passed. 13 focused signer, JWKS and issuer configuration tests; changed TypeScript ESLint passed. The shared verifier passed 47 tests and lint separately. Live RS256 activation and end-to-end login testing are deferred until the coordinated rollout.