From 892d7d6dd1acd6e21283ea8a29442e5bfe108bac Mon Sep 17 00:00:00 2001 From: Justin Gasper Date: Mon, 9 Nov 2026 11:52:21 +1100 Subject: [PATCH] Prepare dev Identity RS256 verification and issuer policies --- deploy/dev-jwt-issuer-policies.json | 47 +++++++++++++++++++++++++++++ docs/identity-rs256-dev.md | 11 +++++++ package.json | 2 +- pnpm-lock.yaml | 12 ++++---- 4 files changed, 65 insertions(+), 7 deletions(-) create mode 100644 deploy/dev-jwt-issuer-policies.json create mode 100644 docs/identity-rs256-dev.md diff --git a/deploy/dev-jwt-issuer-policies.json b/deploy/dev-jwt-issuer-policies.json new file mode 100644 index 0000000..7da612a --- /dev/null +++ b/deploy/dev-jwt-issuer-policies.json @@ -0,0 +1,47 @@ +[ + { + "issuer": "https://api.topcoder-dev.com", + "algorithm": "RS256", + "audience": "https://api.topcoder-dev.com/v6", + "jwksUri": "https://api.topcoder-dev.com/v6/authorizations/.well-known/jwks.json" + }, + { + "issuer": "https://auth.topcoder-dev.com/", + "algorithm": "RS256", + "audience": "BXWXUWnilVUPdN01t2Se29Tw2ZYNGZvH", + "jwksUri": "https://auth.topcoder-dev.com/.well-known/jwks.json" + }, + { + "issuer": "https://topcoder-dev.auth0.com/", + "algorithm": "RS256", + "audience": [ + "BXWXUWnilVUPdN01t2Se29Tw2ZYNGZvH", + "https://m2m.topcoder-dev.com/" + ], + "jwksUri": "https://topcoder-dev.auth0.com/.well-known/jwks.json" + }, + { + "issuer": "https://keycloak.topcoder-dev.com/realms/topcoder-m2m-dev", + "algorithm": "RS256", + "audience": "https://m2m.topcoder-dev.com/", + "jwksUri": "https://keycloak.topcoder-dev.com/realms/topcoder-m2m-dev/protocol/openid-connect/certs" + }, + { + "issuer": "https://testsachin.topcoder-dev.com/", + "algorithm": "RS256", + "audience": [ + "BXWXUWnilVUPdN01t2Se29Tw2ZYNGZvH", + "https://m2m.topcoder-dev.com/" + ], + "jwksUri": "https://testsachin.topcoder-dev.com/.well-known/jwks.json" + }, + { + "issuer": "https://test-sachin-rs256.auth0.com/", + "algorithm": "RS256", + "audience": [ + "BXWXUWnilVUPdN01t2Se29Tw2ZYNGZvH", + "https://m2m.topcoder-dev.com/" + ], + "jwksUri": "https://test-sachin-rs256.auth0.com/.well-known/jwks.json" + } +] diff --git a/docs/identity-rs256-dev.md b/docs/identity-rs256-dev.md new file mode 100644 index 0000000..121d58e --- /dev/null +++ b/docs/identity-rs256-dev.md @@ -0,0 +1,11 @@ +# Identity RS256 preparation for dev + +This PR pins tc-core-library-js 4.0.0-rc.4 at commit `c7c8fab502b7152dd06b1ce46cdb703e0e13b357`. It requires explicit issuer policies and retains verified-email and identity-denylist enforcement. + +The public settings are staged in dev Parameter Store under `/config/identity-rs256-dev-staged/`; running services do not reference that namespace. The checked-in JSON is a reviewed configuration proposal, not an automatically applied deployment change. + +Before merging/deploying, coordinate with Identity and all token consumers. Set `JWT_ISSUER_POLICIES` to the JSON in `deploy/dev-jwt-issuer-policies.json`, retaining the service's machine audience and authorization checks. Merely adding `AUTH_SECRET` no longer enables HMAC trust. If a transition needs HS256, configure only that exact issuer with a finite UTC retirement deadline, then replace it with RS256 at the coordinated cutover. Never accept both algorithms for one issuer. + +Publish the Identity public key first; then test fresh login, expiry/refresh, logout, cross-app access, human authorization, machine authorization, wrong-audience rejection and legacy-HMAC rejection. Remove AUTH_SECRET only from public-key-only API verifiers; keep separate keys for application proofs, cursors, and independent local-login tokens. Existing browser sessions continue to use Auth0; do not put Identity-issued tokens into the Accounts connector cookie without implementing an Identity-aware refresh flow. + +Production is not changed. This dev policy intentionally does not trust the production Topcoder issuer. Do not merge this into production without its separately reviewed environment policy and key. diff --git a/package.json b/package.json index e6cf719..43b522a 100644 --- a/package.json +++ b/package.json @@ -41,7 +41,7 @@ "qs": "^6.16.1", "reflect-metadata": "^0.2.2", "rxjs": "^7.8.1", - "tc-core-library-js": "https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/c2df92b2227089909ab6e229df0ec6b658bb431a", + "tc-core-library-js": "https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/c7c8fab502b7152dd06b1ce46cdb703e0e13b357", "uuid": "^14.0.1" }, "devDependencies": { diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index dbe965a..e6e6ada 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -109,8 +109,8 @@ importers: specifier: ^7.8.1 version: 7.8.2 tc-core-library-js: - specifier: https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/c2df92b2227089909ab6e229df0ec6b658bb431a - version: https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/c2df92b2227089909ab6e229df0ec6b658bb431a(supports-color@8.1.1) + specifier: https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/c7c8fab502b7152dd06b1ce46cdb703e0e13b357 + version: https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/c7c8fab502b7152dd06b1ce46cdb703e0e13b357(supports-color@8.1.1) uuid: specifier: 14.0.1 version: 14.0.1 @@ -3482,9 +3482,9 @@ packages: tar-stream@3.1.7: resolution: {integrity: sha512-qJj60CXt7IU1Ffyc3NJMjh6EkuCFej46zUqJ4J7pqYlThyd9bO0XBTmcOIhSzZJVWfsLks0+nle/j538YAW9RQ==} - tc-core-library-js@https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/c2df92b2227089909ab6e229df0ec6b658bb431a: - resolution: {gitHosted: true, integrity: sha512-n+4KUOeV4LEIsTI/R216dBc6bUkbSyO/2O0LpoY3Hk7eqKsRQFUHloB3y0hfK/v1rzf8qYQxTdv8ikeRGBn4pQ==, tarball: https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/c2df92b2227089909ab6e229df0ec6b658bb431a} - version: 4.0.0-rc.2.1 + tc-core-library-js@https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/c7c8fab502b7152dd06b1ce46cdb703e0e13b357: + resolution: {gitHosted: true, integrity: sha512-6Cx3QMnGU0fwNQHX3ix714U/XPs04js8cMJ4Ojge0S+QGGaPnUawttOKmR+Zu6o7vs+IZt3g2XjlplQme3h1TQ==, tarball: https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/c7c8fab502b7152dd06b1ce46cdb703e0e13b357} + version: 4.0.0-rc.4 engines: {node: '>=22.13'} terser-webpack-plugin@5.6.1: @@ -7547,7 +7547,7 @@ snapshots: - bare-abort-controller - react-native-b4a - tc-core-library-js@https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/c2df92b2227089909ab6e229df0ec6b658bb431a(supports-color@8.1.1): + tc-core-library-js@https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/c7c8fab502b7152dd06b1ce46cdb703e0e13b357(supports-color@8.1.1): dependencies: '@types/jsonwebtoken': 9.0.10 jsonwebtoken: 9.0.3