feat(b2b_learner_records): refuse tokens past the contract end date - #73

Open

blarghmatey wants to merge 9 commits into

learner-records-jwt-verifyfrom

feat/learner-records-contract-end

Commits on Sep 22, 2026

fix(b2b_learner_records): verify the bearer JWT instead of trusting X-Userinfo

blarghmatey
and
claude
committed
da1977e
docs(openapi): say the service verifies the token, not only the gateway

blarghmatey
and
claude
committed
c0ab78e
fix(b2b_learner_records): harden the JWKS cache and check the token class

blarghmatey
and
claude
committed
419f14c
fix(b2b_learner_records): don't start the kid cooldown on a failed refetch

blarghmatey
and
claude
committed
f4a0eec
fix(b2b_learner_records): return the error code the contract has always required

blarghmatey
and
claude
committed
e379a26
test(b2b_learner_records): reconcile with the per-tenant spec work on main

blarghmatey
and
claude
committed
b267cd0

Commits on Sep 25, 2026

feat(b2b_learner_records): refuse tokens past the contract end date

blarghmatey
and
claude
committed
a98efa4
fix(b2b_learner_records): don't overflow on a 9999-12-31 contract end

blarghmatey
and
claude
committed
de326ef
test(b2b_learner_records): assert the contract-ended alert event

blarghmatey
and
claude
committed
351edcd