2 Commits

Author	SHA1	Message	Date
Oleksandr Bezdieniezhnykh	f979e18811	[AZ-494] Enable JWT iss/aud validation with fail-fast startup ... Option B per user decision: production ships with empty Jwt.Issuer / Jwt.Audience in appsettings.json so the API process refuses to start unless JWT_ISSUER + JWT_AUDIENCE env vars are supplied. Development ships with grep-friendly DEV-ONLY- placeholders so local + docker flows keep working unchanged. AuthenticationServiceCollectionExtensions flips ValidateIssuer + ValidateAudience to true and wires ValidIssuer / ValidAudience via a new ResolveRequiredOrThrow helper that all three required values (secret, iss, aud) now share. JwtTokenFactory.Create + CreateExpired gain optional iss / aud parameters (default null) so existing call sites compile unchanged. JwtTestHelpers adds MintAuthenticated / MintExpired wrappers that resolve iss + aud from env, plus ResolveIssuerOrThrow / ResolveAudienceOrThrow. PerfBootstrap.MintToken + Program.cs JWT bootstrap migrated to the new surface so the perf harness and the integration runner both validate against the same contract. Adds 4 fail-fast unit tests (missing/empty issuer + audience), 2 negative integration scenarios (WrongIssuer_Returns401, WrongAudience_Returns401), and re-tags every existing integration mint site via MintAuthenticated. Compose, .env.example, run-tests.sh, run-performance-tests.sh all load + export JWT_ISSUER + JWT_AUDIENCE alongside JWT_SECRET. Resolves F-AUTH-2 (security_report.md + owasp_review.md). AC-7 (cross-repo suite/_docs/10_auth.md write) deferred — outside this workspace; tracked in deploy_cycle2.md R3 follow-up. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-05-12 02:28:48 +03:00
Oleksandr Bezdieniezhnykh	e9f4e84adb	[AZ-487] [AZ-488] docs: cycle 2 deploy report ... Per-cycle deploy report covering AZ-487 (JWT baseline) + AZ-488 (UAV tile batch upload). Lists all 12 cycle-2 commits already pushed to origin/dev, recaps Steps 11-15 gate outcomes, flags three operator-gated risks (R1 consumer Bearer-token coordination, R2 JWT_SECRET prod-distinct verification, R3 GPS-permission claim provisioning), documents rollback (image flip; zero schema change), and lists deferred follow-ups (PT-07/PT-08 harness + run-perf script JWT-attach, F1 doc-folder choice). Advances autodev pointer to Step 17 (Retrospective). Co-authored-by: Cursor <cursoragent@cursor.com>	2026-05-12 00:37:32 +03:00