C-292 Phase 1 OAA Auth Hardening

[kaizencycle]

Summary

Phase 1 of the C-292 high-severity mesh cleanup hardens the OAA authentication layer.

This addresses:

1. JWT fallback secret must fail closed.
2. Magic links must not leak full login tokens into hosted logs.

What changed

• src/lib/auth/jwt.ts

  • Requires a configured JWT signing secret in production.
  • Rejects secrets shorter than 32 characters.
  • Rejects the development fallback secret in production.
  • Keeps the development fallback only for non-production local work.

• src/lib/auth/authService.ts

  • Stops logging full magic login URLs by default.
  • Logs only hashed metadata and expiration metadata.
  • Allows full magic URL logging only in non-production with explicit dev opt-in.

• docs/security/C292_PHASE1_AUTH_HARDENING.md

  • Adds operator notes and production requirements.

Files changed

• src/lib/auth/jwt.ts
• src/lib/auth/authService.ts
• docs/security/C292_PHASE1_AUTH_HARDENING.md

Merge readiness

• Branch is 3 commits ahead of main, 0 behind.
• No schema changes.
• No new dependency required.

Canon

Authentication must fail closed.
Magic links are credentials.
Credentials must not enter hosted logs.

We heal as we walk.