fix(auth): P0/P1 bundle from senior reviews 2026-05-12 (aud claim, MFA fail-open, OTP exhausted, hs-2026-04 revoked)

[ahmetabdullahgultekin]

Summary

Four P0/P1 fixes from /opt/projects/SECURITY_REVIEW_2026-05-12.md and /opt/projects/BACKEND_REVIEW_2026-05-12.md.

Bug 1 (P0) — JWT aud claim not shipped (4th time)

Memory has missed this fix three times (2026-04-20, 2026-05-02, 2026-05-12). On HEAD only iss was bound on the parser; aud was never stamped or required.

• New app.security.jwt.audience property (single string for now; multi-audience parser supported via JJWT requireAudience).
• JwtService stamps the audience claim on every minted access token. Refresh tokens are opaque UUIDs in DB (V55/V60), not JWTs — no audience needed there.
• Parser requires the configured audience; empty config stays permissive (dev/test parity with expectedIssuer).
• application-prod.yml pins aud=fivucsas-api. JwtService.assertProdAudienceIsConfigured fails fast at boot if the prod profile loads with a blank audience.
• New JwtServiceAudienceTest (9 tests) pins mint, parse, prod boot assertion, and the empty-config permissive path so this fix cannot disappear a fourth time.

Bug 2 (P0) — FaceVerifyMfaStepHandler cosine fallback

PR #83 removed the 0.7 cosine confidence fallback in FaceAuthHandler and AuthController.verify2FAMethod but missed this N-step MFA handler — which is the one hosted login actually uses. INVESTIGATION_FAILOPEN_2026-05-07.md F3.

Mirrors PR #83's pattern: trust only the bio processor's verified field, hard-reject when missing, cache user.getId() once to stay inside the UserDomainBoundary ratchet.

Bug 3 (P0) — 5 MFA OTP call-sites swallowing exhausted

NIST 800-63B 5-strike lockout is correct at the primitive level (OtpService.validateWithResult) but all 5 MFA OTP call-sites used the boolean validate() overload and threw the flag away. Users had to wait 5min for TTL instead of getting an immediate "send another OTP."

Call-sites switched to validateWithResult:

• EmailOtpAuthHandler
• SmsOtpAuthHandler (local-Redis fallback only — Twilio Verify path enforces its own counter)
• EmailOtpVerifyMfaStepHandler
• AuthController.verify2FAMethod SMS_OTP arm
• AuthController.verify2FAMethod EMAIL_OTP arm

OtpAttemptsExhaustedException now maps to HTTP 429 with {errorCode:"OTP_ATTEMPTS_EXHAUSTED", action:"resend", remainingAttempts:0} + Retry-After: 300 (RFC 6585 §4) via a new GlobalExceptionHandler arm. verify2FAMethod's catch (Exception) now splits on this exception so it re-throws rather than being collapsed into a 500.

Bug 4 (P1) — Revoke leaked HS512 kid hs-2026-04

Bundled into the JWT commit because both fixes touch the same JwtService + application-prod.yml paths:

• app.security.jwt.allow-hs512: false pinned explicitly in application-prod.yml (was relying on the application.yml default).
• New app.security.jwt.revoked-kids config (comma-separated). Any JWT carrying a kid in this set is rejected during validation regardless of allow-hs512 state. Defence-in-depth even if the rollback flag flips back on.
• application-prod.yml revokes hs-2026-04 (the leaked f8ee668:.env.gcp kid).
• JwtServiceAudienceTest.revokedKidRejectedEvenIfHs512Allowed proves it: HS512 token signed with hs-2026-04 is rejected even when allowHs512=true.

Commits

• 9b58250 — fix(jwt): bind and validate aud claim (also revokes hs-2026-04 — same files)
• 6e955c3 — fix(mfa): close cosine fallback in FaceVerifyMfaStepHandler
• 9e4e772 — fix(otp): propagate exhausted state through 5 MFA call-sites

(Per spec the 4th commit would have been security(jwt): revoke hs-2026-04 kid, but the revoked-kid code logic and application-prod.yml lines were so tightly coupled with the aud commit that splitting them would have created a no-op file split. The behavior is fully tested under JwtServiceAudienceTest.revokedKidRejected*.)

Test plan

• mvn -T 2C test — 1271 passed, 0 failed, 58 skipped (skipped are pre-existing Testcontainers-gated integration tests).
• Grep permitAll in SecurityConfig.java — no changes (no new anonymous routes). git diff SecurityConfig.java returns empty.
• YAML lint pass on application.yml + application-prod.yml (Python yaml.safe_load).
• ArchUnit UserDomainBoundaryTest — baseline refreshed for line shifts; net +1 violation in verify2FAMethod for the new catch (OtpAttemptsExhaustedException) arm (cached as String exhaustedUid so the arm contributes only one getId() call).
• Symptom grep after the fix (memory feedback_verify_completion_claims):
  • grep "audience" src/main/java/com/fivucsas/identity/security/JwtService.java — present in mint + parse + boot assert.
  • grep "validateWithResult" src/main/java/com/fivucsas/identity/application/service/{handler,mfa/handler}/*.java src/main/java/com/fivucsas/identity/controller/AuthController.java — all 5 call-sites flipped.

Operator notes

• Default for APP_SECURITY_JWT_AUDIENCE env var: empty in application.yml, fivucsas-api in application-prod.yml. No .env.prod change required — the prod profile literal is the boot-time default.
• After deploy, all existing access tokens minted before the rebuild will fail validation because they have no aud claim. Frontends will see 401s and silently refresh via the refresh-token rotation flow (V55). No user-visible logout expected, but operator should monitor /refresh traffic spike for ~15 min post-deploy.

Cross-references

• /opt/projects/SECURITY_REVIEW_2026-05-12.md — §aud-claim, §P1 revoked kid
• /opt/projects/BACKEND_REVIEW_2026-05-12.md — §FaceVerifyMfaStepHandler, §OTP-exhausted
• INVESTIGATION_FAILOPEN_2026-05-07.md F3 — the fail-open vector this commit closes

🤖 Generated with Claude Code

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[ahmetabdullahgultekin]

CI note (2026-05-12)

The failing Integration tests (Testcontainers) job is pre-existing baseline rot, not a regression from this PR. Same root cause as #99: Script V40__partition_audit_logs.sql failed — V40 requires pg_partman extension which the Testcontainers postgres image (like prod's pgvector/pgvector:pg17) does not have. See OPERATOR_ACTIONS_2026-05-12.md item 1 in Rollingcat-Software/FIVUCSAS#67.

Maven unit tests pass: 1271 passed, 0 failed, 58 Testcontainers-gated tests skipped. GitGuardian + scan pass.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[ahmetabdullahgultekin]

FYI: #101 fixes the V40 audit_logs_pkey collision that's causing the Integration tests (Testcontainers) job to fail on this PR. Once #101 merges and you rebase, this PR's IT check should go green.

[ahmetabdullahgultekin]

Update on #101: my fixture resolves the first V40 failure (the audit_logs_pkey collision), but CI then surfaces a SECOND V40 bug — || operator inside COMMENT ON TABLE on line 270, which is invalid PG grammar. See #101 description for details. Fully fixing the IT job for your PR needs operator approval to either (a) edit V40 in place + flyway:repair on prod, or (b) keep accepting continue-on-error. #101 lands progress and clear diagnostics either way.