fix(auth): pin jwt verification algorithm to HS256

[aodus2]

Overview

This PR pins the JWT verification algorithm in requireAuth so the verifier no longer trusts the alg declared in the token header. The accepted algorithm is declared once and shared between the signing and verifying sides, closing the algorithm-confusion / alg: none gap described in the issue.

Related Issue

Changes

🔐 JWT Algorithm Pinning

• [MODIFY] src/middleware/auth.middleware.ts

  • jwt.verify is now called with an explicit { algorithms: [...] } option instead of relying on the token header.
  • Tokens signed with any algorithm outside the pinned list are rejected, surfacing as 401.

• [MODIFY] src/services/auth.service.ts

  • Signing side now uses the same single source of truth for the algorithm, so sign and verify cannot drift apart.

• [MODIFY] src/config/env.ts

  • Declares the accepted JWT algorithm in one place (defaulting to HS256), consumed by both the signing and verifying call sites.

• [MODIFY] src/__tests__/auth.middleware.test.ts

  • Adds coverage that a token signed with a non-pinned algorithm is rejected with 401, and that a correctly signed HS256 token still authenticates.

Verification Results

npm test
✅ auth middleware suite passes, including the new algorithm-rejection cases

Acceptance Criteria	Status
jwt.verify is called with an explicit algorithms list	✅ Passed via { algorithms: [JWT_ALGORITHM] } in requireAuth
A token signed with any other algorithm is rejected with 401	✅ Covered by new middleware test
The accepted algorithm is declared once, not duplicated across call sites	✅ Single declaration in src/config/env.ts, reused by sign + verify
npm test passes locally	✅ Passed

Closes #143

[drips-wave]

@aodus2 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits