Prepare dev Identity RS256 verification and issuer policies

deploy/dev-jwt-issuer-policies.json

@@ -0,0 +1,47 @@
+[
+  {
+    "issuer": "https://api.topcoder-dev.com",
+    "algorithm": "RS256",
+    "audience": "https://api.topcoder-dev.com/v6",
+    "jwksUri": "https://api.topcoder-dev.com/v6/authorizations/.well-known/jwks.json"
+  },
+  {
+    "issuer": "https://auth.topcoder-dev.com/",
+    "algorithm": "RS256",
+    "audience": "BXWXUWnilVUPdN01t2Se29Tw2ZYNGZvH",
+    "jwksUri": "https://auth.topcoder-dev.com/.well-known/jwks.json"
+  },
+  {
+    "issuer": "https://topcoder-dev.auth0.com/",
+    "algorithm": "RS256",
+    "audience": [
+      "BXWXUWnilVUPdN01t2Se29Tw2ZYNGZvH",
+      "https://m2m.topcoder-dev.com/"
+    ],
+    "jwksUri": "https://topcoder-dev.auth0.com/.well-known/jwks.json"
+  },
+  {
+    "issuer": "https://keycloak.topcoder-dev.com/realms/topcoder-m2m-dev",
+    "algorithm": "RS256",
+    "audience": "https://m2m.topcoder-dev.com/",
+    "jwksUri": "https://keycloak.topcoder-dev.com/realms/topcoder-m2m-dev/protocol/openid-connect/certs"
+  },
+  {
+    "issuer": "https://testsachin.topcoder-dev.com/",
+    "algorithm": "RS256",
+    "audience": [
+      "BXWXUWnilVUPdN01t2Se29Tw2ZYNGZvH",
+      "https://m2m.topcoder-dev.com/"
+    ],
+    "jwksUri": "https://testsachin.topcoder-dev.com/.well-known/jwks.json"
+  },
+  {
+    "issuer": "https://test-sachin-rs256.auth0.com/",
+    "algorithm": "RS256",
+    "audience": [
+      "BXWXUWnilVUPdN01t2Se29Tw2ZYNGZvH",
+      "https://m2m.topcoder-dev.com/"
+    ],
+    "jwksUri": "https://test-sachin-rs256.auth0.com/.well-known/jwks.json"
+  }
+]

docs/identity-rs256-dev.md

@@ -0,0 +1,11 @@
+# Identity RS256 preparation for dev
+
+This PR pins tc-core-library-js 4.0.0-rc.4 at commit `c7c8fab502b7152dd06b1ce46cdb703e0e13b357`. It requires explicit issuer policies and retains verified-email and identity-denylist enforcement.
+
+The public settings are staged in dev Parameter Store under `/config/identity-rs256-dev-staged/`; running services do not reference that namespace. The checked-in JSON is a reviewed configuration proposal, not an automatically applied deployment change.
+
+Before merging/deploying, coordinate with Identity and all token consumers. Set `JWT_ISSUER_POLICIES` to the JSON in `deploy/dev-jwt-issuer-policies.json`, retaining the service's machine audience and authorization checks. Merely adding `AUTH_SECRET` no longer enables HMAC trust. If a transition needs HS256, configure only that exact issuer with a finite UTC retirement deadline, then replace it with RS256 at the coordinated cutover. Never accept both algorithms for one issuer.
+
+Publish the Identity public key first; then test fresh login, expiry/refresh, logout, cross-app access, human authorization, machine authorization, wrong-audience rejection and legacy-HMAC rejection. Remove AUTH_SECRET only from public-key-only API verifiers; keep separate keys for application proofs, cursors, and independent local-login tokens. Existing browser sessions continue to use Auth0; do not put Identity-issued tokens into the Accounts connector cookie without implementing an Identity-aware refresh flow.
+
+Production is not changed. This dev policy intentionally does not trust the production Topcoder issuer. Do not merge this into production without its separately reviewed environment policy and key.

package.json

@@ -51,7 +51,7 @@
     "qs": "6.17.1",
     "reflect-metadata": "^0.2.2",
     "rxjs": "^7.8.2",
-    "tc-core-library-js": "https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/c2df92b2227089909ab6e229df0ec6b658bb431a",
+    "tc-core-library-js": "https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/c7c8fab502b7152dd06b1ce46cdb703e0e13b357",
     "uuid": "^14.0.3",
     "winston": "^3.19.0"
   },

pnpm-workspace.yaml

@@ -47,7 +47,7 @@ overrides:
   browserslist: 4.28.8
   axios@<1: 0.34.0
   axios@>=1: 1.21.0
-  tc-core-library-js: https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/c2df92b2227089909ab6e229df0ec6b658bb431a
+  tc-core-library-js: https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/c7c8fab502b7152dd06b1ce46cdb703e0e13b357
   deepmerge-ts: 8.0.0
   defu: 6.1.7
   effect@^3: 3.22.0

src/shared/modules/global/jwt.service.spec.ts

@@ -26,11 +26,25 @@ function signToken(payload: Record<string, unknown>): string {
 
 describe('JwtService', () => {
   let service: JwtService;
+  const previousPolicies = process.env.JWT_ISSUER_POLICIES;
+  afterEach(() => {
+    if (previousPolicies === undefined) delete process.env.JWT_ISSUER_POLICIES;
+    else process.env.JWT_ISSUER_POLICIES = previousPolicies;
+  });
 
   beforeEach(() => {
     process.env.AUTH_SECRET = 'test-secret-with-at-least-32-bytes-long';
     process.env.VALID_ISSUERS = JSON.stringify(['https://issuer.test/']);
     process.env.AUTH0_AUDIENCE = 'api';
+    process.env.JWT_ISSUER_POLICIES = JSON.stringify([
+      {
+        issuer: 'https://issuer.test/',
+        algorithm: 'HS256',
+        audience: 'api',
+        legacyHs256Until: new Date(Date.now() + 3_600_000).toISOString(),
+      },
+      { issuer: 'https://machine.test/', algorithm: 'RS256', audience: 'api' },
+    ]);
     service = new JwtService();
     service.onModuleInit();
   });
@@ -89,7 +103,7 @@ describe('JwtService', () => {
       {
         algorithm: 'RS256',
         keyid: 'test-key',
-        issuer: 'https://issuer.test/',
+        issuer: 'https://machine.test/',
         audience: 'api',
         expiresIn: 300,
       },