# 0032 — Auth — Module Triage

**Milestone:** M3
**Owner:** TBD
**Status:** planning

## Goal

Consolidates 14 legacy issues from the
`MetaDrivenPlatform4AI` repo that share the same module / area label,
so they can be triaged together by the corresponding domain IC.

Module label scope: `module/auth`.

## Acceptance criteria

- [ ] All `ported` children below have a Story or Bug filed in pingcap-pack
- [ ] All filed Stories / Bugs have a linked test (existing or to-write task with scaffold)
- [ ] Engineering review confirms which children are still applicable under the new project's design

## Stories / Bugs (filed as GitHub issues)

14 children classified `ported`. Phase 3/4 will file each as
a Story (capability) or Bug (defect) in this repo and back-reference the
legacy issue. Initial child list:

- [ ] #TBD — legacy MetaDrivenPlatform4AI#88 — [API] OAuth userinfo endpoint returns incompatible claim set and field names
- [ ] #TBD — legacy MetaDrivenPlatform4AI#133 — [API] OAuth authorize error format differs from Salesforce
- [ ] #TBD — legacy MetaDrivenPlatform4AI#134 — OAuth revoke endpoint invalid-token behavior differs from Salesforce (always returns 200)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#140 — UpdateRecord checks authentication after schema lookup; enabling object-existence oracle
- [ ] #TBD — legacy MetaDrivenPlatform4AI#141 — Token helper script uses conflicting stdin redirections making token output unreliable
- [ ] #TBD — legacy MetaDrivenPlatform4AI#168 — Deactivated users can still authenticate and receive valid sessions
- [ ] #TBD — legacy MetaDrivenPlatform4AI#169 — Session validation is not bound to stored session token/user/expiry (privilege escalation + session extension)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#173 — `client_credentials` flow issues tokens as System Administrator (privilege escalation)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#175 — Lookup hydration bypasses object/record permissions (data leak)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#177 — JWT/session validation enables token-claim privilege escalation when `JWT_SECRET` is predictable/misconfigured
- [ ] #TBD — legacy MetaDrivenPlatform4AI#181 — Token revocation uses unverified JWT decoding (`ParseUnverified`)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#186 — Deactivated users can still authenticate (no `is_active` enforcement in login/session validation)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#219 — Salesforce sandbox token helper script fails with `bad substitution`
- [ ] #TBD — legacy MetaDrivenPlatform4AI#962 — SECURITY: Production TiDB Cloud credentials hardcoded in SKILL.md

## Non-goals

- Re-port legacy fixes that are no longer relevant under the new project's
  pure-platform design — engineering identifies these case-by-case
- Layer-belonging classification (L0 / L1 / L2) — engineering's job

## History

- 2026-05-03 — created during Phase 2 from clustered orphan issues.

## Stories (filed in Phase 3)

_Pending Phase 3 synthesis._