feat(adapters): real inbound JWT verification (stunt-nu5) + eight P2 slices - #46
Merged
Conversation
stunt-nu5 (auth adapters now VERIFY inbound JWTs cryptographically, serving real JWKS from fixed synthetic key material): - signin-with-apple: ES256 id_tokens + client_secret verification (signature, aud, exp) via a real EC keypair; /auth/keys JWKS - apple-apns: ES256 provider-token signature + expiry verification (403 ExpiredProviderToken) - aws-cognito: real RS256 tokens with kid + claim sets, JWKS at the real pool path, inbound signature/iss/exp/token_use checks - entra-id: minted tokens carry aud/iat/exp and are signature-verified (kid, iss, aud cross-check), not just store-look-up - google-style / google-iam: RS256 id_tokens when scope has openid, /oauth2/v3/certs JWKS, JWT-bearer grants cryptographically verified - all verifiers guard crypto/json builtins so malformed tokens 4xx instead of 500-ing P2 slices (workflow wf_819aecaa-38e): - stripe: decline/SCA magic test cards (real decline_codes, requires_action + 3DS confirmation), refund state machine with fleet-wide over-refund guard, GET /v1/events (+ by id) - drive: real q grammar (AND'ed predicates, 400 on unparseable), OAuth2 auth-code + refresh with validated tokens, live changes feed - appstoreconnect: appStoreVersions lifecycle (PREPARE_FOR_SUBMISSION -> READY_FOR_SALE derive-on-read), build listing, app PATCH, bundleId dedupe; anaplan: chunked file upload/download, import jobs that apply uploaded data, export jobs symmetric, catalog endpoints - azure-servicebus: peek-lock receive with LockToken/lockedUntil, complete/renew/abandon/defer, lock expiry 410, topics + subscriptions fan-out; jumio verified (async slice covered it) - marketo: custom-field-preserving upserts with per-record sync status, updateOnly semantics, bulk extract jobs with downloadable results, /leads/describe; firebase: token-bound getAccountInfo, securetoken refresh exchange, Firestore runQuery, documentId + nested paths, FCM topic/condition routing - gdocs: structural document model (startIndex/endIndex content, paragraphs, styles) with the real batchUpdate vocabulary (insertText utf16-aware, deleteContentRange, updateParagraphStyle/ TextStyle, bullets, page breaks, images), 400 on unknown requests
…ck rotation, P2 cleanups
- NEW builtin json_safe_decode(s) -> value|None (UseNumber, int-when-
integral like the stdlib decoder): Starlark has no try/except and
json.decode raises -> 500 on malformed input; the shape guards could
not catch brace-wrapped non-JSON ({"a"}). Wired into the five JWT
adapters' claim decoding, gdocs multipart metadata, firebase runQuery
from-list validation
- servicebus: LockToken rotates per delivery (stale holder can no
longer settle a message a later receiver owns; 410 as documented)
- apple-apns: provider-token failures return InvalidProviderToken (was
BadDeviceToken, reserved for device tokens)
- apple family pure-Starlark b64 decoders (asc/music/searchads): reject
out-of-table indexes (was a reachable 500 on every request)
- gdocs: _valid_b64 rejects misplaced padding (AA=A no longer 500s)
- digit-run literals in new slices assembled at runtime (gdocs primes,
anaplan chunk sizes, marketo ids, firebase frozen timestamps ->
clock-derived)
- TestRSAPublicJWK now reconstructs the original modulus/exponent
- stripe README notes the unkeyed POST /v1/refunds concurrency window
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
stunt-nu5 (auth adapters now VERIFY inbound JWTs cryptographically,
serving real JWKS from fixed synthetic key material):
(signature, aud, exp) via a real EC keypair; /auth/keys JWKS
(403 ExpiredProviderToken)
real pool path, inbound signature/iss/exp/token_use checks
(kid, iss, aud cross-check), not just store-look-up
/oauth2/v3/certs JWKS, JWT-bearer grants cryptographically verified
instead of 500-ing
P2 slices (workflow wf_819aecaa-38e):
requires_action + 3DS confirmation), refund state machine with
fleet-wide over-refund guard, GET /v1/events (+ by id)
auth-code + refresh with validated tokens, live changes feed
-> READY_FOR_SALE derive-on-read), build listing, app PATCH,
bundleId dedupe; anaplan: chunked file upload/download, import jobs
that apply uploaded data, export jobs symmetric, catalog endpoints
complete/renew/abandon/defer, lock expiry 410, topics +
subscriptions fan-out; jumio verified (async slice covered it)
status, updateOnly semantics, bulk extract jobs with downloadable
results, /leads/describe; firebase: token-bound getAccountInfo,
securetoken refresh exchange, Firestore runQuery, documentId +
nested paths, FCM topic/condition routing
paragraphs, styles) with the real batchUpdate vocabulary
(insertText utf16-aware, deleteContentRange, updateParagraphStyle/
TextStyle, bullets, page breaks, images), 400 on unknown requests