Summary
TINA4_JWT_ALGORITHM is a documented environment variable honoured by PHP and Node. Python never reads it.
Where
The variable is registered in the CLI's known_vars, which is the source of truth for what a TINA4_* variable does:
// tina4/src/env_config.rs:84
("TINA4_JWT_ALGORITHM", "HS256", "JWT signing algorithm", "Auth"),tina4/src/env_migrate.rs:30 migrates the legacy JWT_ALGORITHM name onto it, so the variable is treated as real enough to warrant a migration path.
Read by:
- PHP:
Tina4/Auth.php:196 and :237
- Node:
packages/core/src/auth.ts:176 and :213
Not referenced anywhere in tina4-python:
grep -rn "TINA4_JWT_ALGORITHM" --include="*.py" .
# no matches
Reproduction
Set in .env:
TINA4_JWT_ALGORITHM=RS256
PHP and Node sign with RS256. Python signs with HMAC-SHA256 and reports nothing.
Why it matters
A team running a mixed-language estate, or migrating a service from PHP to Python, gets a silent downgrade from asymmetric to symmetric signing. Nothing errors, so the env var appears to work.
This also breaks the env-uniformity contract, where the CLI's known_vars defines what a variable does in every framework. A variable that is registered and documented but ignored by one framework makes that contract unreliable.
Suggested fix
Either implement RS256 in Python for full parity with PHP and Node, or read the variable and raise on any value Python cannot honour.
Related to the JWT header advertising issue filed separately. Implementing RS256 properly resolves both.
Found by
Auditing Auth across all four frameworks while grounding a course module on configuration and secrets. No fix applied.
Summary
TINA4_JWT_ALGORITHMis a documented environment variable honoured by PHP and Node. Python never reads it.Where
The variable is registered in the CLI's
known_vars, which is the source of truth for what aTINA4_*variable does:tina4/src/env_migrate.rs:30migrates the legacyJWT_ALGORITHMname onto it, so the variable is treated as real enough to warrant a migration path.Read by:
Tina4/Auth.php:196and:237packages/core/src/auth.ts:176and:213Not referenced anywhere in
tina4-python:Reproduction
Set in
.env:PHP and Node sign with RS256. Python signs with HMAC-SHA256 and reports nothing.
Why it matters
A team running a mixed-language estate, or migrating a service from PHP to Python, gets a silent downgrade from asymmetric to symmetric signing. Nothing errors, so the env var appears to work.
This also breaks the env-uniformity contract, where the CLI's
known_varsdefines what a variable does in every framework. A variable that is registered and documented but ignored by one framework makes that contract unreliable.Suggested fix
Either implement RS256 in Python for full parity with PHP and Node, or read the variable and raise on any value Python cannot honour.
Related to the JWT header advertising issue filed separately. Implementing RS256 properly resolves both.
Found by
Auditing
Authacross all four frameworks while grounding a course module on configuration and secrets. No fix applied.