Kevin JahnsandManuel Raynaud 43c48dbc10 🔒️(collaboration) reject admin jwts not issued for the yhub audience ...

yhub verified Django's RS256 admin JWT without checking "aud", so the
y-converter token Django hands to the converter process was replayable
here — and admin: true short-circuits getAccessType to "rw" on every
document, plus the backend-internal reset-connections purpose and the
X-User-Id attribution override. Require aud: "yhub", as y-provider
already does for its own audience. Nothing in the backend calls yhub's
admin endpoints yet, so no caller is affected.

Signed-off-by: Kevin Jahns <kevin.jahns@protonmail.com>

2026-09-22 16:00:46 +02:00

..

backend

🛂(backend) add audience to jwt

2026-09-22 16:00:44 +02:00

frontend

🔥(frontend) remove content GET PATCH

2026-09-22 16:00:45 +02:00

helm

🔥(project) remove occurences of COLLABORATION_SERVER_SECRET

2026-09-22 16:00:45 +02:00

mail

🔖(release) minor 5.7.0

2026-09-15 16:19:39 +02:00

yhub-server

🔒️(collaboration) reject admin jwts not issued for the yhub audience

2026-09-22 16:00:46 +02:00