Ruben FiszelandClaude Opus 4.8 e2c6e659ea fix: make the JWT audit gate atomic again; refuse-only negative cache; JWKS key_ops ...

- Gate the audit with a conditional upsert (`DO UPDATE ... WHERE NOT
  guest_activity.jwt_entry RETURNING 1`) read with fetch_optional. The row comes
  back exactly once per email per day, decided by the conflicting tuple, so it
  keeps the atomicity `xmax = 0` had (no double audit when two first requests race
  on a metered instance, which takes no advisory lock) and still fires on the
  first JWT after an IdP sign-in created today's row. The prior CTE decided this
  from the statement snapshot and could double-audit.
- Negative-cache only a real allowance refusal (`PermissionDenied`); a transient
  DB error inside guest_admission denies this request but no longer locks the
  email out for 30 seconds.
- Refuse a JWKS key whose `key_ops` is present and omits `verify`: it is published
  for something other than signature verification. Unit-tested.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VF3v6LA9399gNphmZaHYG3

2026-09-03 23:44:49 +02:00

..

src

fix: make the JWT audit gate atomic again; refuse-only negative cache; JWKS key_ops

2026-09-03 23:44:49 +02:00

Cargo.toml

refactor: extract windmill-api into subcrates for parallel compilation (#7845)

2026-02-07 22:12:55 +00:00