37832397929
91%

Ran 08 Oct 2026 07:34PM UTC

Jobs 1

Files 65

Run time 1min

Badge

Embed ▾

Committed 08 Oct 2026 07:29PM UTC coverage: 90.93% (+0.01%) from 90.916%

Build # 37832397929

Build Type

push

github

Committed by

web-flow

Commit Message

fix: throttle cache-busting JWKS refetches in JwtVerifier (#38)

An unknown `kid` made verify() delete the cached key set and fetch it
again. The exchange route accepts any Apple ID token, so a token with a
random kid forced an outbound HTTPS call on every request: the cache
held cold from outside, a 5-second fetch on every genuine sign-in, and
the site usable as an amplifier against the provider.

The refetch is now allowed once per key set per minute, claimed through
a transient keyed on the JWKS URL. Ported from Reach's verifier, which
this one was copied from before Reach gained the floor.

Coverage Stats

3579 of 3936 relevant lines covered (90.93%)

7.46 hits per line

Coverage Regressions

Lines	Coverage	∆	File
1	97.58	0.12%	fellowship/fellowship/src/Auth/JwtVerifier.php

Jobs

ID	Job ID	Ran	Files	Coverage
1	37832397929.1	08 Oct 2026 07:34PM UTC	65	90.93	GitHub Action Run

bleedingdeacons / fellowship / 37832397929
91%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Coverage Regressions

Jobs

Source Files on build 37832397929

bleedingdeacons / fellowship / 37832397929 91%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Coverage Regressions

Jobs

Source Files on build 37832397929

bleedingdeacons / fellowship / 37832397929
91%

README BADGES
x