P1 auth: require type=access in /me (refresh token must not be an identity) #76

Activity

1. SlavaKuntsov

   added

   area:autharea:autharea:auth

   on Sep 18, 2026
2. SlavaKuntsov

   changed the title [-]P1 auth: lowercase migration for existing users.email and type check in /me[/-] [+]P1 auth: require type=access in /me (refresh token must not be an identity)[/+] on Sep 18, 2026
3. SlavaKuntsov commented on Sep 29, 2026

   

   SlavaKuntsov

   on Sep 29, 2026

   OwnerAuthor

   More actions

   Agent review — iteration 1

   Findings

   • None. Independent reviewer examined origin/main..8a5c619, both full source files, and re-ran checks. Confirmed: type-check placed after signature/exp validation and before sub/UUID parsing/DB query (services/auth/src/routers/auth.py:112); forged type claims fail signature verification; tokens without type fail closed (secure default, consistent with Go middleware from P1 infra: fail fast on empty JWT_SECRET/INTERNAL_TOKEN and require exp in JWT #53); decode_token has no other unchecked callers (/refresh already type-checks).

   Verdict

   ready for PR

   Verification

   • uv run pytest tests/test_auth.py -v — 19 passed (incl. new test_me_with_refresh_token_rejected: refresh → 401, DB never hit; existing test_me_success: access → 200)
   • uv run flake8 src tests — clean; uv run mypy src — clean
   • black --check on tests/test_auth.py fails on pre-existing long lines already present on origin/main (not introduced by this change)
4. SlavaKuntsov commented on Sep 29, 2026

   

   SlavaKuntsov

   on Sep 29, 2026

   OwnerAuthor

   More actions

   Ready for review

   Implemented

   • GET /api/v1/auth/me now requires payload.get("type") == "access" after decode_token — a refresh token gets 401 before any DB access (mirrors Go middleware from P1 infra: fail fast on empty JWT_SECRET/INTERNAL_TOKEN and require exp in JWT #53 and the existing /refresh type check)
   • Regression test test_me_with_refresh_token_rejected: refresh token → 401, db.execute never awaited

   Acceptance criteria

   • /me с refresh-токеном → 401 (identity не утекает, запрос к БД не выполняется)
   • /me с access-токеном → 200 (test_me_success)

   Verification

   • uv run pytest tests/test_auth.py -v — 19 passed
   • uv run flake8 src tests / uv run mypy src — clean
   • make e2e — not run: change is covered by unit tests at the token-parsing boundary; no end-to-end auth flow change

   Review cycle

   • Iterations: 1 (no findings)
   • Remaining risks: none

   Suggested PR title

   fix(auth): require type=access in /me
5. SlavaKuntsov commented on Sep 29, 2026

   

   SlavaKuntsov

   on Sep 29, 2026

   OwnerAuthor

   More actions

   Pull request opened

   #81 — will auto-close via Closes #76 on merge.

   Project status: Review (synced after PR creation).

   Verification

   • uv run pytest tests/test_auth.py -v — 19 passed
   • uv run flake8 src tests / uv run mypy src — clean

   Remaining risks

   None (make e2e не гонялся — e2e-флоу auth не менялся, изменение покрыто юнит-тестами).
6. SlavaKuntsov

   closed this as completedin #81on Sep 29, 2026
7. SlavaKuntsov

   added a commit that references this issue on Oct 4, 2026

   test(auth): pass jti to create_refresh_token in issue #76 test

   74e7efe