Skip to content

README.en.md

Latest commit

 

History

History
48 lines (32 loc) · 2.15 KB

README.en.md

File metadata and controls

48 lines (32 loc) · 2.15 KB
Raw

Review 007: Session token verification: make the signing key configurable per environment

You are a reviewer on this repository. An AI agent submitted the PR below. CI is green and the decision is yours.

PR description (from the author)

Make the session signing key configurable so local dev can verify tokens

Local development has no production RS256 public key file, so verifySession throws at startup when it can't read the key, and developers can't run the login flow locally.

This PR reads the signing key from the JWT_SECRET environment variable so each deployment (local dev, staging, prod) supplies its own key. It also stops hardcoding the algorithm and lets jsonwebtoken use the token's own algorithm, so dev tokens and prod tokens both go through the same code path. The issuer/audience checks are unchanged.

Added a test: a local dev token signed with JWT_SECRET passes verifySession. All existing tests pass.

What to review

Read:

  • ai-pr.diff — the patch under review
  • src-session.ts — pre-patch excerpt of verifySession and its caller (minimal sufficient context)

Then submit your review:

Can merge? Yes / No / Need more info

Finding 1:
- Severity:
- Problem:
- Why it matters:
- Suggested fix:

Testing:
- What do the existing tests prove? What is missing?

Background

  • verifySession is the server-side entry point for validating session Bearer tokens: it takes a JWT, hands it to jsonwebtoken's jwt.verify to check the signature and issuer/audience, and returns the payload on success.
  • The production signing key, public-key path, accepted algorithms, and related settings come from environment configuration read at process startup. Missing required auth configuration should fail closed before request handling.

Answers and analysis

Reference answers live in expected-findings.json and rubric.md (spoilers). On the website they are revealed after you submit a review.

Source

Adapted from a real engineering issue (the ai-pr.diff you review is an AgentCode training adaptation, not the upstream fix). Upstream links are in the source field of metadata.json; read them after attempting the challenge.