Repository navigation
test: fix integration flaky - #60
Merged
Merged
Conversation
Member
Author
This stack of pull requests is managed by Graphite. Learn more about stacking. |
Base automatically changed from
04-01-fix_cli_use_jsonc-parser_to_parse_wrangler.jsonc
to
main
April 1, 2026 08:09
Brooooooklyn
force-pushed
the
04-01-test_fix_integration_flaky
branch
from
April 1, 2026 08:10
c4101c5 to
080f81e
Compare
cpojer
pushed a commit
that referenced
this pull request
Sep 11, 2026
Admin and user JWTs were structurally identical (same claims, same signing key), allowing an admin_token cookie to be used as an API Bearer token or vice versa. Add an aud claim: "api" for user session tokens, "admin" for admin tokens. Each middleware now validates the expected audience, rejecting tokens issued for a different context. Existing sessions will require re-authentication after deploy. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Medium Risk** > Touches core JWT issuance/validation paths for both API and admin sessions; a mistake would cause widespread auth failures and forces all existing sessions to re-authenticate after deploy. > > **Overview** > **Adds JWT audience separation to prevent token confusion between admin and API contexts.** API login now signs tokens with `aud:"api"`, admin login signs `aud:"admin"`, and shared `verifyJwt` can enforce an `expectedAud`. > > All auth entry points (`authMiddleware`, `adminAuthMiddleware`, `authenticateDashboardToken`, and the proxy worker’s JWT verifier) now reject tokens with the wrong audience, and tests/helpers were updated to mint and use the correct token type (including a new `adminJwt` in `createTestUser`). > > <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 377cd9daede5a9e426a7f412bf999a32ff8452d7. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup> <!-- /CURSOR_SUMMARY -->
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
Medium Risk
Changes the asset hash algorithm and which files are uploaded, which can affect deploy caching/invalidations and missing asset issues if ignore patterns are wrong; test changes are low risk but hashing/packaging changes are behaviorally significant.
Overview
Updates asset packaging to match Wrangler behavior:
computeAssetHashnow uses BLAKE3 overbase64(content)+extension, and asset collection/packaging now skips._assetsignore,_headers,_redirects, plus patterns from.assetsignore.Stabilizes the kitchen-sink integration test by changing
waitForServerto optionally wait for an expected response body (instead of fixed sleeps) and adjusting timeouts; adds unit coverage for the new hashing and ignore semantics. Adds new depsblake3-jitandignore(lockfile updated).Written by Cursor Bugbot for commit 080f81e. This will update automatically on new commits. Configure here.