Security context

Highlights

Auth Bypass: 3 prior fixes. Scrutinize any change in this area.

src/authenticationMiddleware.ts: most-fixed (1 issue). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Auth Bypass: Array-based audience validation allowed any matching audience in the list, enabling tokens issued for other services to pass. The fix restricts to a single string audience, but any future code that reintroduces array handling or partial matching will recreate the bypass.

Auth Bypass: User cache keyed only by email allowed cross-service permission leakage, letting a user from one service inherit another service's permissions. The fix adds servicePermissionsIdentifier to the key, but any cache miss path that omits this identifier or uses a different key derivation is vulnerable.

Auth Bypass: Authentication was enforced in GraphQL middleware, which could be bypassed on non-GraphQL routes or when middleware ordering changed. Moving to Express middleware ensures all routes validate tokens, but any new route or framework integration that skips this middleware reintroduces the gap.