From 71b870f8c32c788d97874b5fb41c4a5caa5c703c Mon Sep 17 00:00:00 2001 From: Justin Gasper Date: Fri, 6 Nov 2026 09:05:28 +1100 Subject: [PATCH 1/2] Require verified email through shared JWT verifier --- package.json | 2 +- pnpm-lock.yaml | 12 ++++++------ 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/package.json b/package.json index 9f724d7..1875fdf 100644 --- a/package.json +++ b/package.json @@ -62,7 +62,7 @@ "sequelize": "6.37.8", "stripe": "^11.3.0", "swagger-ui-express": "^4.4.0", - "tc-core-library-js": "https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/58de37670180e183e8378c3d203df0112a0414f6", + "tc-core-library-js": "https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/2067e74f73d7fe3442c96f375fc97f8486f79be4", "uuid": "^11.1.1", "winston": "^3.7.2", "xss": "^1.0.11", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index bb90ab0..91e0016 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -122,8 +122,8 @@ importers: specifier: ^4.4.0 version: 4.6.3(express@4.21.2(supports-color@5.5.0)) tc-core-library-js: - specifier: https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/58de37670180e183e8378c3d203df0112a0414f6 - version: https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/58de37670180e183e8378c3d203df0112a0414f6(supports-color@5.5.0) + specifier: https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/2067e74f73d7fe3442c96f375fc97f8486f79be4 + version: https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/2067e74f73d7fe3442c96f375fc97f8486f79be4(supports-color@5.5.0) uuid: specifier: 11.1.1 version: 11.1.1 @@ -2586,9 +2586,9 @@ packages: peerDependencies: express: '>=4.0.0 || >=5.0.0-beta' - tc-core-library-js@https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/58de37670180e183e8378c3d203df0112a0414f6: - resolution: {tarball: https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/58de37670180e183e8378c3d203df0112a0414f6} - version: 4.0.0-rc.2 + tc-core-library-js@https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/2067e74f73d7fe3442c96f375fc97f8486f79be4: + resolution: {gitHosted: true, integrity: sha512-4xzx6ycEdy8Rs5BpIOUhg/YX0cUUQpOCtTM60vcb9JF4XvqI1fLfIDmHNvZNek49dBo1Il1Lp8O/HLhKfLhhVg==, tarball: https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/2067e74f73d7fe3442c96f375fc97f8486f79be4} + version: 4.0.0-rc.4 engines: {node: '>=22.13'} test-exclude@8.0.0: @@ -5633,7 +5633,7 @@ snapshots: express: 4.21.2(supports-color@5.5.0) swagger-ui-dist: 5.32.2 - tc-core-library-js@https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/58de37670180e183e8378c3d203df0112a0414f6(supports-color@5.5.0): + tc-core-library-js@https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/2067e74f73d7fe3442c96f375fc97f8486f79be4(supports-color@5.5.0): dependencies: '@types/jsonwebtoken': 9.0.10 jsonwebtoken: 9.0.3 From 1bfcbbd2fcdb083a81750d5fb53eea171f23ca25 Mon Sep 17 00:00:00 2001 From: Justin Gasper Date: Fri, 6 Nov 2026 09:22:46 +1100 Subject: [PATCH 2/2] Use compatible v4 verification backport and verified JWT fixtures --- package.json | 2 +- pnpm-lock.yaml | 12 ++++++------ test/security/routes.test.cjs | 2 +- 3 files changed, 8 insertions(+), 8 deletions(-) diff --git a/package.json b/package.json index 1875fdf..3347fa2 100644 --- a/package.json +++ b/package.json @@ -62,7 +62,7 @@ "sequelize": "6.37.8", "stripe": "^11.3.0", "swagger-ui-express": "^4.4.0", - "tc-core-library-js": "https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/2067e74f73d7fe3442c96f375fc97f8486f79be4", + "tc-core-library-js": "https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/c2df92b2227089909ab6e229df0ec6b658bb431a", "uuid": "^11.1.1", "winston": "^3.7.2", "xss": "^1.0.11", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 91e0016..6f9778e 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -122,8 +122,8 @@ importers: specifier: ^4.4.0 version: 4.6.3(express@4.21.2(supports-color@5.5.0)) tc-core-library-js: - specifier: https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/2067e74f73d7fe3442c96f375fc97f8486f79be4 - version: https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/2067e74f73d7fe3442c96f375fc97f8486f79be4(supports-color@5.5.0) + specifier: https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/c2df92b2227089909ab6e229df0ec6b658bb431a + version: https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/c2df92b2227089909ab6e229df0ec6b658bb431a(supports-color@5.5.0) uuid: specifier: 11.1.1 version: 11.1.1 @@ -2586,9 +2586,9 @@ packages: peerDependencies: express: '>=4.0.0 || >=5.0.0-beta' - tc-core-library-js@https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/2067e74f73d7fe3442c96f375fc97f8486f79be4: - resolution: {gitHosted: true, integrity: sha512-4xzx6ycEdy8Rs5BpIOUhg/YX0cUUQpOCtTM60vcb9JF4XvqI1fLfIDmHNvZNek49dBo1Il1Lp8O/HLhKfLhhVg==, tarball: https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/2067e74f73d7fe3442c96f375fc97f8486f79be4} - version: 4.0.0-rc.4 + tc-core-library-js@https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/c2df92b2227089909ab6e229df0ec6b658bb431a: + resolution: {gitHosted: true, integrity: sha512-n+4KUOeV4LEIsTI/R216dBc6bUkbSyO/2O0LpoY3Hk7eqKsRQFUHloB3y0hfK/v1rzf8qYQxTdv8ikeRGBn4pQ==, tarball: https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/c2df92b2227089909ab6e229df0ec6b658bb431a} + version: 4.0.0-rc.2.1 engines: {node: '>=22.13'} test-exclude@8.0.0: @@ -5633,7 +5633,7 @@ snapshots: express: 4.21.2(supports-color@5.5.0) swagger-ui-dist: 5.32.2 - tc-core-library-js@https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/2067e74f73d7fe3442c96f375fc97f8486f79be4(supports-color@5.5.0): + tc-core-library-js@https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/c2df92b2227089909ab6e229df0ec6b658bb431a(supports-color@5.5.0): dependencies: '@types/jsonwebtoken': 9.0.10 jsonwebtoken: 9.0.3 diff --git a/test/security/routes.test.cjs b/test/security/routes.test.cjs index 9676f0d..8395765 100644 --- a/test/security/routes.test.cjs +++ b/test/security/routes.test.cjs @@ -18,7 +18,7 @@ let machineIssuer function token (claims, secret = process.env.AUTH_SECRET) { const header = Buffer.from(JSON.stringify(claims.gty ? { alg: 'RS256', typ: 'JWT', kid: 'fixture' } : { alg: 'HS256', typ: 'JWT' })).toString('base64url') - const payload = Buffer.from(JSON.stringify({ iss: claims.gty ? machineIssuer : 'https://issuer.test.invalid/', exp: Math.floor(Date.now() / 1000) + 60, ...claims })).toString('base64url') + const payload = Buffer.from(JSON.stringify({ emailVerified: true, iss: claims.gty ? machineIssuer : 'https://issuer.test.invalid/', exp: Math.floor(Date.now() / 1000) + 60, ...claims })).toString('base64url') const data = `${header}.${payload}` const signature = claims.gty ? sign('RSA-SHA256', Buffer.from(data), privateKey).toString('base64url') : createHmac('sha256', secret).update(data).digest('base64url') return `${data}.${signature}`