jobtrackingapp/docs/verification/sec-003-microsoft-tenant.md

SEC-003 Microsoft tenant validation verification

Date: 2026-08-02
Status: VERIFIED LOCALLY; JT-001 remains open pending SEC-004.

Implemented boundary

• Auth:MicrosoftTenant supports an exact tenant GUID, organizations, consumers, or explicit common; Production requires a value when Microsoft sign-in is enabled.
• Tokens require GUID-shaped tid and oid, exact https://login.microsoftonline.com/{tid}/v2.0 issuer agreement, allowed tenant mode, configured audience, valid signature and lifetime.
• The validator returns normalized tenant/object IDs and treats email-like claims as metadata (EmailVerified=false). Subject temporarily remains the normalized oid only for legacy controller compatibility until SEC-004.
• The undocumented raw Microsoft bearer scheme and smart-selector branch were removed. Microsoft identity tokens enter only through the exchange/link validator.
• The application sign-in tenant is explicitly separate from Microsoft:TenantId used for Graph mailbox OAuth.

Commands and results

Command/check	Result
focused Microsoft validator + auth controller tests	Pass; 42/42
full backend Release suite	Pass; 491/491
normalized deploy-shell syntax	Pass
production Compose config with synthetic organizations mode	Pass
source search for raw Microsoft bearer registration/selector	Removed; exchange validator is the remaining sign-in trust path

The focused validator suite covers Production missing configuration, invalid mode, common, organizations, consumers, exact single tenant, personal-account rejection/acceptance, missing and non-GUID tid/oid, issuer/tenant mismatch, wrong audience, wrong signature, expiry, and identical oid values in two tenants.

Remaining risk and gates

• JT-001 remains High / High / likely defect. ApplicationUser still lacks canonical tenant/object columns and controller lookups still contain legacy subject/email behavior. This package validates identity input but does not claim safe account ownership.
• No Microsoft provider was contacted. Browser/provider success, cancellation, wrong-tenant and consent behavior are unverified.
• Production must inventory legacy link counts/collisions and alternate credentials before enabling the stricter policy.
• SEC-004 must add canonical pair persistence, collision-safe lookup and the approved legacy recovery ceremony. Until then Microsoft sign-in should remain disabled in production.
• Rollback can restore the prior validator binaries, but must not be used to re-enable raw bearer trust in production. No database change exists in this package.