diff --git a/deploy/dev-jwt-issuer-policies.json b/deploy/dev-jwt-issuer-policies.json new file mode 100644 index 0000000..7da612a --- /dev/null +++ b/deploy/dev-jwt-issuer-policies.json @@ -0,0 +1,47 @@ +[ + { + "issuer": "https://api.topcoder-dev.com", + "algorithm": "RS256", + "audience": "https://api.topcoder-dev.com/v6", + "jwksUri": "https://api.topcoder-dev.com/v6/authorizations/.well-known/jwks.json" + }, + { + "issuer": "https://auth.topcoder-dev.com/", + "algorithm": "RS256", + "audience": "BXWXUWnilVUPdN01t2Se29Tw2ZYNGZvH", + "jwksUri": "https://auth.topcoder-dev.com/.well-known/jwks.json" + }, + { + "issuer": "https://topcoder-dev.auth0.com/", + "algorithm": "RS256", + "audience": [ + "BXWXUWnilVUPdN01t2Se29Tw2ZYNGZvH", + "https://m2m.topcoder-dev.com/" + ], + "jwksUri": "https://topcoder-dev.auth0.com/.well-known/jwks.json" + }, + { + "issuer": "https://keycloak.topcoder-dev.com/realms/topcoder-m2m-dev", + "algorithm": "RS256", + "audience": "https://m2m.topcoder-dev.com/", + "jwksUri": "https://keycloak.topcoder-dev.com/realms/topcoder-m2m-dev/protocol/openid-connect/certs" + }, + { + "issuer": "https://testsachin.topcoder-dev.com/", + "algorithm": "RS256", + "audience": [ + "BXWXUWnilVUPdN01t2Se29Tw2ZYNGZvH", + "https://m2m.topcoder-dev.com/" + ], + "jwksUri": "https://testsachin.topcoder-dev.com/.well-known/jwks.json" + }, + { + "issuer": "https://test-sachin-rs256.auth0.com/", + "algorithm": "RS256", + "audience": [ + "BXWXUWnilVUPdN01t2Se29Tw2ZYNGZvH", + "https://m2m.topcoder-dev.com/" + ], + "jwksUri": "https://test-sachin-rs256.auth0.com/.well-known/jwks.json" + } +] diff --git a/docs/identity-rs256-dev.md b/docs/identity-rs256-dev.md new file mode 100644 index 0000000..121d58e --- /dev/null +++ b/docs/identity-rs256-dev.md @@ -0,0 +1,11 @@ +# Identity RS256 preparation for dev + +This PR pins tc-core-library-js 4.0.0-rc.4 at commit `c7c8fab502b7152dd06b1ce46cdb703e0e13b357`. It requires explicit issuer policies and retains verified-email and identity-denylist enforcement. + +The public settings are staged in dev Parameter Store under `/config/identity-rs256-dev-staged/`; running services do not reference that namespace. The checked-in JSON is a reviewed configuration proposal, not an automatically applied deployment change. + +Before merging/deploying, coordinate with Identity and all token consumers. Set `JWT_ISSUER_POLICIES` to the JSON in `deploy/dev-jwt-issuer-policies.json`, retaining the service's machine audience and authorization checks. Merely adding `AUTH_SECRET` no longer enables HMAC trust. If a transition needs HS256, configure only that exact issuer with a finite UTC retirement deadline, then replace it with RS256 at the coordinated cutover. Never accept both algorithms for one issuer. + +Publish the Identity public key first; then test fresh login, expiry/refresh, logout, cross-app access, human authorization, machine authorization, wrong-audience rejection and legacy-HMAC rejection. Remove AUTH_SECRET only from public-key-only API verifiers; keep separate keys for application proofs, cursors, and independent local-login tokens. Existing browser sessions continue to use Auth0; do not put Identity-issued tokens into the Accounts connector cookie without implementing an Identity-aware refresh flow. + +Production is not changed. This dev policy intentionally does not trust the production Topcoder issuer. Do not merge this into production without its separately reviewed environment policy and key. diff --git a/package.json b/package.json index daf0f08..b41b42d 100644 --- a/package.json +++ b/package.json @@ -36,7 +36,7 @@ "pg": "^8.16.3", "reflect-metadata": "^0.1.13", "rxjs": "^7.8.2", - "tc-core-library-js": "github:topcoder-platform/tc-core-library-js#v4.0.0-rc.2" + "tc-core-library-js": "https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/c7c8fab502b7152dd06b1ce46cdb703e0e13b357" }, "devDependencies": { "@eslint/eslintrc": "^3.2.0", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 29b3ca1..94001f8 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -96,8 +96,8 @@ importers: specifier: ^7.8.2 version: 7.8.2 tc-core-library-js: - specifier: github:topcoder-platform/tc-core-library-js#v4.0.0-rc.2 - version: https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/58de37670180e183e8378c3d203df0112a0414f6(supports-color@8.1.1) + specifier: https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/c7c8fab502b7152dd06b1ce46cdb703e0e13b357 + version: https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/c7c8fab502b7152dd06b1ce46cdb703e0e13b357(supports-color@8.1.1) devDependencies: '@eslint/eslintrc': specifier: ^3.2.0 @@ -3161,9 +3161,9 @@ packages: resolution: {integrity: sha512-Re10+NauLTMCudc7T5WLFLAwDhQ0JWdrMK+9B2M8zR5hRExKmsRDCBA7/aV/pNJFltmBFO5BAMlQFi/vq3nKOg==} engines: {node: '>=6'} - tc-core-library-js@https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/58de37670180e183e8378c3d203df0112a0414f6: - resolution: {gitHosted: true, tarball: https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/58de37670180e183e8378c3d203df0112a0414f6} - version: 4.0.0-rc.2 + tc-core-library-js@https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/c7c8fab502b7152dd06b1ce46cdb703e0e13b357: + resolution: {tarball: https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/c7c8fab502b7152dd06b1ce46cdb703e0e13b357} + version: 4.0.0-rc.4 engines: {node: '>=22.13'} terser-webpack-plugin@5.3.14: @@ -6928,7 +6928,7 @@ snapshots: tapable@2.2.2: {} - tc-core-library-js@https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/58de37670180e183e8378c3d203df0112a0414f6(supports-color@8.1.1): + tc-core-library-js@https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/c7c8fab502b7152dd06b1ce46cdb703e0e13b357(supports-color@8.1.1): dependencies: '@types/jsonwebtoken': 9.0.10 jsonwebtoken: 9.0.3