security fixes

Author: jaredLunde

.claude/skills/audit-security/SKILL.md

@@ -5,3 +5,4 @@
 .env.*
 !.env.example
 .claude/settings.local.json
+.sqlx

.gitignore

@@ -1,3 +1,6 @@
+[workspace]
+members = ["xtask"]
+
 [package]
 name = "beyond-auth"
 version = "0.1.0"

.sqlx/query-d2a9875d4953ff4c1ffd3787cde06425641dc7166ba8812cc77ff0addbe1e9dd.json

@@ -4,7 +4,8 @@ SET search_path = auth, public;
 
 ALTER TABLE auth.app_config
     ADD COLUMN jwt_enabled  bool NOT NULL DEFAULT false,
-    ADD COLUMN issuer_url   text;
+    ADD COLUMN issuer_url   text,
+    ADD COLUMN jwt_audience text;
 
 -- Tenants: personal (1:1 with user, created atomically on signup) and team tenants (Phase 3+)
 

Cargo.lock

@@ -6,3 +6,6 @@ yamlfmt = "latest"
 
 [tasks."format"]
 run = "dprint fmt"
+
+[tasks."sqlx:prepare"]
+run = "cargo run --package xtask"

Cargo.toml

@@ -10,12 +10,13 @@ pub struct AppConfig {
     pub session_ttl_seconds: i32,
     pub jwt_enabled: bool,
     pub issuer_url: Option<String>,
+    pub jwt_audience: Option<String>,
 }
 
 pub async fn load(pool: &PgPool) -> Result<AppConfig, AuthError> {
     sqlx::query_as!(
         AppConfig,
-        "SELECT jwt_mode, access_token_ttl_seconds, session_ttl_seconds, jwt_enabled, issuer_url
+        "SELECT jwt_mode, access_token_ttl_seconds, session_ttl_seconds, jwt_enabled, issuer_url, jwt_audience
          FROM auth.app_config
          WHERE id = true"
     )

migrations/0002_authn.sql

@@ -25,6 +25,9 @@ pub enum AuthError {
     #[error("password must be at least 8 characters")]
     PasswordTooShort,
 
+    #[error("password must be at most 128 characters")]
+    PasswordTooLong,
+
     #[error("password is too common")]
     PasswordTooCommon,
 
@@ -95,6 +98,9 @@ impl IntoResponse for AuthError {
             AuthError::PasswordTooShort => {
                 (StatusCode::UNPROCESSABLE_ENTITY, "password_too_short", self.to_string())
             }
+            AuthError::PasswordTooLong => {
+                (StatusCode::UNPROCESSABLE_ENTITY, "password_too_long", self.to_string())
+            }
             AuthError::PasswordTooCommon => {
                 (StatusCode::UNPROCESSABLE_ENTITY, "password_too_common", self.to_string())
             }

mise.toml

@@ -9,6 +9,7 @@ use crate::error::AuthError;
 pub fn issue_access_token(
     user_id: Uuid,
     issuer_url: &str,
+    audience: &str,
     ttl_seconds: i32,
     kid: Uuid,
     signing_key: &SigningKey,
@@ -30,9 +31,12 @@ pub fn issue_access_token(
 
     let claims = URL_SAFE_NO_PAD.encode(
         serde_json::to_string(&json!({
+            "jti": Uuid::new_v4().to_string(),
             "sub": user_id.to_string(),
             "iss": issuer_url,
+            "aud": audience,
             "iat": now,
+            "nbf": now - 5,
             "exp": exp,
         }))
         .map_err(|e| AuthError::internal_with("JWT claims serialization", e))?,