Ho Ngoc Hai 3705193f97 fix(auth): wire dual-key JWT verification into TokenService for WebSocket auth ...

Extract shared `verifyWithRotation` helper and `makeSecretOrKeyProvider` into
`jwt-rotation.ts` so both REST (passport-jwt strategy) and WebSocket
(TokenService.verifyAccessToken) paths honour JWT_SECRET_PREVIOUS during
secret rotation. Add env-validation for optional previous secrets and
document the rotation policy for WebSocket sessions.

Resolves GOO-237

Co-Authored-By: Claude Opus 4 <noreply@anthropic.com>

2026-04-24 14:44:23 +07:00

..

PAYMENT_MODULE_SECURITY_REVIEW.md

chore: update project documentation, audit reports, and initialize IDE configuration files

2026-04-19 03:12:54 +07:00

PAYMENT_REVIEW_EXECUTIVE_SUMMARY.txt

chore: organize docs — move 37 files from root into docs/ subfolders

2026-04-13 12:09:14 +07:00

PAYMENT_SECURITY_CHECKLIST.md

chore: update project documentation, audit reports, and initialize IDE configuration files

2026-04-19 03:12:54 +07:00

README_SECURITY_REVIEW.md

chore: update project documentation, audit reports, and initialize IDE configuration files

2026-04-19 03:12:54 +07:00

SECRET_ROTATION_POLICY.md

fix(auth): wire dual-key JWT verification into TokenService for WebSocket auth

2026-04-24 14:44:23 +07:00