fix(auth): read access JWT from criticalbit_access cookie - #83
Merged
Conversation
Align the cookie name this resource server reads with the service-scoped name now issued by criticalbit-auth-api. Hard cut, no dual-accept — must deploy after the auth-api rename is live in the target environment, otherwise existing sessions 401 until they re-login. Adds TestAuthCookie wire-level coverage so a future rename or typo is caught in CI instead of silently breaking every authenticated request.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
app_accesstocriticalbit_access, matching the service-scoped name now issued by criticalbit-auth-api#24.TestAuthCookiewire-level coverage: mints an RS256 JWT with an ephemeral keypair, patchesget_public_key, and asserts (a) a validcriticalbit_accesscookie authenticates a request to/v1/user/inventories, and (b) no cookie returns 401. This locks the cross-service cookie-name contract so a future rename or typo fails CI instead of silently 401-ing every authenticated request.Scope of audit
The logout refresh-token revocation fix from the upstream PR does not apply here — this repo has no logout handler, no refresh-token decode, no
fastapi_users.jwtimport (it uses raw PyJWT), and no OAuth/CSRF cookies. This service is a pure resource server that verifies RS256 tokens via JWKS fromauth-api.criticalbit.gg; it is not an auth provider. The only cross-repo change that lands here is the single cookie read.Test plan
uv run pytest— 26/26 pass locallyuv run ruff check .— cleanuv run ruff format --check .— clean/v1/user/inventoriesworks from the frontend in the target env (only meaningful after auth-api#24 is deployed there)