Final Auth Audit — Subagent B
Historical snapshot
This is a snapshot of authentication defects, fixes, and outstanding questions at audit time.
Use the current authentication contract and independent negative authorization tests for the present release decision.
| Defect | Verdict |
|---|---|
| PBKDF2 delimiter | FIXED (pbkdf2$iter$salt$hash) |
| Non-standard JWT | CONFIRMED (audit_hash≠HMAC-SHA256; claim seller_id≠sid) |
| User JWT vs shared secret | CONFIRMED (prod auth() rejects JWT; secret=unscoped) |
| Token-after-deactivate | CONFIRMED (no users.status check anywhere) |
| Role/seller claim over-trust | CONFIRMED (no DB revalidation; verify_impl defaults to seller_nougat) |
| No rate limit | CONFIRMED |
| Hash failure handling | CONFIRMED (unwrap_or_default→empty hash; non-constant-time compare) |
| No logout/revocation | CONFIRMED (stateless; no token_version) |